Environment
- App Control: All Supported Versions
- Microsoft Windows: All Supported Versions
Objective
This article explains how to see who modified a policy from within the console, and when this happened.
Resolution
1. In the console, navigate to Reports > Events.
2. Add a column for 'Subtype' and click Apply.
3. Add a filter for 'Subtype' 'is' 'Policy modified', and click Apply.
4. Set the Max Age to 3 months for maximum visibility and click Apply.
Additional Notes
This will show who modified a policy and when, but it will not show what was actually changed in most cases.
Further information on using the Reports > Events view can be found in the
User Guide for each App Control version.
To view an endpoint enforcement level change add the Subtype = Computer modified
Related Content
