Software Restriction Policies feature does not log events as expected

In Microsoft Windows XP Professional, you (an administrator) can use the Software Restriction Policies feature to restrict a user's ability to run particular programs. You can implement these policies either through Local Group Policy or through a Group Policy object from the Microsoft Windows Server 2003 Active Directory directory service.

When you implement software restriction policies, users who try to run a restricted program in Windows XP Professional receive a message that the program has been restricted by the administrator and will not run. You expect an event to be logged in the event log so that you can audit the instances when users try to start restricted programs. However, although the Software Restriction Policies feature restricts the user from running the program, an event is not logged in the event log. After you install this hotfix, an event is logged in the application event log when a user tries to run a restricted program.


http://www.kbalertz.com/Feedback_823726.aspx