How to identify a blocked application?

Question

Active Directory

When a user is authorized in the domain, a window pops up "This application has been blocked by the system administrator" It is required to determine which application sits at startup and is blocked. In addition, the application stopped running with a similar message, which explicitly specified permission. What could have changed is not clear, I would like to read the lock log, but where is it? It would seem a simple task, but I can’t find it, but all kinds of crap is googled. Server OS is WS2019, client OS is W10Pro.

Answer 1

Watch for errors on the client computer.
https://docs.microsoft.com/en-us/windows/security/...
See events 8004-8007