Why is the DLL rule collection disabled by default?
Managing DLLs can be a difficult task. Each application requires that specific DLLs are allowed to run, and one application can start many DLLs. For this reason, implementing DLL rules is a more advanced way of using AppLocker. Improperly configuring DLL rules can cause application compatibility problems, and because AppLocker checks whether a DLL is allowed each time before it is allowed to run, many AppLocker events can be generated in the event log. Therefore, you should carefully plan your DLL rules before enabling the rule collection.
