Conversion of the Event log int a WDAC Policy XML file was unsuccessful

[Ross-Curley]

I've Deployed WDAC in Audit mode and have started collecting logs with windows event forwarding. When I try to parse the .evtx I get a none specific error can anyone tell me what could be the issue?

[jgeurten]

Hi @Ross-Curley, can you please share the evtx file with me so I can verify the issue? Thanks

[Ross-Curley]

ForwardedEvents.zip
Hi @jgeurten, here is my event logs

[jgeurten]

Thank you. I am going to create a bug for this case. I don't see any reason why these events should not parse.

[Ross-Curley]

thanks for your help

[jgeurten]

To confirm my assumptions, do you use Windows event forwarding to generate these evtx files like the one you shared? It appears the service converts everything to a string (which was the reason for the bug)

[Ross-Curley]

yes, we're forwarding the code integrity logs to a central server. is there a better way to collect logs from multiple machines?

[Ross-Curley]

@jgeurten is there an update on this?