Forum Discussion
Smart App Control block logs
I have recently started receiving constant messages from Defender about Smart APp control blocking a "cer.mst" file, but I can't find the logs or protection history related to it. Doing a broad search of my computer I located a file with that name in "C:\Windows\Installer\..." but apparently the file has been there since Frebruary, VirutTotal show no warnings other than it being unsigned and while opening in with notepad the only legible text mentions Autodesk, so it feels legit.
Where is the log located? Is there any way to know why was it blocked?
Thanks in advanced.
1 Reply
Hi Carles, Smart App Control events can be hard to spot in the normal Defender history view. I would check Event Viewer under Microsoft, Windows, AppLocker and CodeIntegrity, then inspect the cer.mst file location and signature. If you do not recognize the file, upload it to Microsoft Defender or remove it only after confirming what installed it.