Event banner
Event details
A adaptive application control question. Do you know if there is a way to investigate whats wrong if a device falls under the No recommendation? The device is up and running for more then 3 weeks. Heartbeat of the AMA agent is reporting ok. File integrity is working fine on that device. But still the device isn't showing in the recommended tab. Is there some logs file we can check for this?
Tom_Janetscheck
Microsoft
MicrosoftHi Thomas,
in case it is a Windows machine, you might have a pre-existing AppLocker policy, or AppLocker is not available on it. In this case, the machine will have no recommendation. Please also look at https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls#enable-application-controls-on-a-group-of-machines.
- The Event viewer app lockers logs are empty so i'm pretty sure app locker isn't running on that machine. It is also the windows server Datacenter edition with GUI so that is also not the case
- I'm more thinking that it doens't work correctly with AMA agent.
- Tom_JanetscheckIn this case please raise a support ticket, as AMA is expected to support both, File Integrity Monitoring, and Adaptive Application Controls.