WMI query to Read 'Microsoft-Windows-AppLocker/EXE and DLL' C#

It seems that the WMI Query parses the registry location HKLM\SYSTEM\CurrentControlSet\Services\EventLog for available event logs (see MSDN Forum post). Check the list you find there with the result of the query Select * FROM Win32_NTEventLogFile.

To add a logfile for WMI operations, add a new key under the above registry location with the name of the log ('Microsoft-Windows-AppLocker/EXE and DLL' in your case). Now it should return that log with your WMI query.

Tags:

C#

Wmi

Wql