But that is beginning to change with the recent addition of several new state names used by the kernel code integrity manager, which now uses WNF to notify the system about interesting code integrity events that might be useful to security tools. Well, to dump all well-known state names on the machine, you’d have to install the Microsoft SDK, then run WnfNameDumper to retrieve all WNF names defined in perf_nt_c.dll and dump their human-friendly names, IDs, and descriptions into a file, which would look like this: {“WNF_CI_BLOCKED_DRIVER”, 0x41c6072ea3bc1875}, // This event signals that an image has been blocked from loading by PNP {“WNF_CI_CODEINTEGRITY_MODE_CHANGE”, 0x41c6072ea3bc2075}, // This event signals that change of CodeIntegrity enforcement mode has occurred.