Application control allows or blocks the defined applications that try to access system resources on a client computer. You can allow or block access to certain registry keys, files, and folders. You can also define which applications are allowed to run, which applications that cannot be terminated through irregular processes, and which applications can call DLLs.
Use the following steps to set up application control on a group of client computers. Setting up application control Description Open a policy and enable default application control rule setsApplication Control policies contain predefined rule sets, which are disabled by default. You can enable any sets that you need, and apply the policy to a group. The predefined rule sets are configured in production mode rather than test mode. However, you should change the setting to test mode and test the rules in your test network before you apply them to your production network. See:
Add additional application control rules (optional)If the default rule sets do not meet your requirements, add new rule sets and rules. Typically, only advanced administrators should perform this task. See:
Add exceptions for applicationsApplication control injects code in some applications to examine them, which can slow applications that run on the computer. If necessary, you can exclude some applications from application control. You use an Exceptions policy to add file exceptions or folder exceptions for application control. See:
View the Application Control logsIf you are testing a new policy or are troubleshooting an issue, you should monitor application control events in the log.
In both test mode and production mode, application control events are in the Application Control log in
Symantec Endpoint Protection Manager . On the client computer, application control and device control events appear in the Control log.You might see duplicate or multiple log entries for a single application control action. For example, if explorer.exe tries to copy a file, it sets the write and delete bits of the file's access mask.
Symantec Endpoint Protectionlogs the event. If the copy action fails because an application control rule blocks the action, explorer.exe tries to copy the file by using only the delete bit in the access mask.