COMMAND EVERYTHING.

Get-AppLockerFileInformation

Gets the file information necessary to create AppLocker rules from a list of files or an event log.

PowerShell · Risk: Low · Documentation Verified

Last verified: 2026-10-26

Microsoft AppLocker reference: Gets the file information necessary to create AppLocker rules from a list of files or an event log. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Get-AppLockerFileInformation -Directory <String>
 [-FileType <System.Collections.Generic.List`1[Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.AppLockerFileType]>]
 [-Recurse] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Get-AppLockerFileInformation. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / AppLocker · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Directory (required): Specifies the directory that contains the files for which to get the file information. If all subfolders and files in the specified directory are to be searched, then include the *Recurse* parameter
-EventLog (required): Specifies that the file information is retrieved from the event log.
-EventType: Specifies the event type by which to filter the events. The acceptable values for this parameter are: Allowed, Denied, or Audited. The event types correspond to the Informational, Error, and Warning level events in the AppLocker event logs.
-FileType: Specifies the generic file type for which to search. All files having the appropriate file name extension will be included. The acceptable values for this parameter are: - Exe - Dll - WindowsInstaller - Script - Appx.
-LogPath: Specifies the log name or file path of the event log where the AppLocker events are located. By default, if this parameter is not specified, the local Microsoft-Windows-AppLocker/EXE and DLL channel is used.
-Packages: Specifies a list of installed packaged applications, from which the file information is retrieved.
-Path: Specifies a list of paths to the files from which the file information is retrieved. Supports regular expressions.
-Recurse: Specifies that all files and folders in the specified directory will be searched.
-Statistics: Specifies the statistics to retrieve on the files included in the event log. Calculates a simple sum of the number of times a file is included in the event log based on specified parameters.

Prerequisites

Windows with the AppLocker module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This is a read-oriented cmdlet; protect any sensitive results and check the documented effects of your selected parameters.

Examples

Example 1: Get file information for .exe files and scripts

Get-AppLockerFileInformation -Directory C:\Windows\system32\ -Recurse -FileType exe, script

This example gets the file information for all the .exe files and scripts under %windir%\system32. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/AppLocker/Get-AppLockerFileInformation.md

https://learn.microsoft.com/powershell/module/applocker/get-applockerfileinformation?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands