Block Executable

Creating and Removing Block Executable Policy

1. To create a Block Executable rule, navigate to Inventory > Block Executable > Add Policy.
2. Add Custom Group(s) to which this rule is to be applied.
3. Next, add the executable that needs to be blocked using either a Path Rule or Hash Rule

To remove a rule, navigate to Inventory > Block Executable and select the policies you wish to remove and click the "Remove Policy" button.

Block Executable using Path Rule

IT admins can block an executable using the Path Rule when the targeted file name/path name remains static. Path Rule works on the logic of filename and it's extensions. Rename or relocation of the file will lead to failure of execution of the rule applied. This rule can be used to block applications even if they are not available in your network. Using path rule, IT administrators can block the executables located inside the given value.

Block using Hash Value

Hash is a unique value, that represents the executable. To use this method, IT admins should compute the Hash value for the targeted application and add it to the rule to block that executable. If you want to block an executable that is greater than 200 MB in size, use the below attached code snippet to compute the Hash value. While computing the Hash value, provide the full path of the file location of the software that you want to block using Hash value.

Windows commands

File Size

dir <"FILE LOCATION">

Example command: dir "C:\Program Files\Google\Chrome\Application\chrome.exe"

File Hash MD5

certutil -hashfile <"FILE LOCATION"> md5

Example command: certutil -hashfile "C:\Program Files\Google\Chrome\Application\chrome.exe" md5

File Hash SHA256

certutil -hashfile <"FILE LOCATION"> sha256

Example command: certutil -hashfile "C:\Program Files\Google\Chrome\Application\chrome.exe" sha256

File Hash AppLocker

(Get-AppLockerFileInformation -Path <"FILE LOCATION">).Hash -replace '^SHA256 0x', 'Hash: '

Example command: (Get-AppLockerFileInformation -Path "C:\Program Files\Google\Chrome\Application\chrome.exe").Hash -replace '^SHA256 0x', 'Hash: '

Block Executable for All Computers

Endpoint Central by default has a custom group named "All Computers Group", which contains all the managed computers. If you want to block an executable for all the managed computers, then you can choose the default Custom Group and select the executable, which needs to be blocked.

Block Executable for Specific Computers

To block an executable for specific target, create a new custom group or use the existing custom groups. Custom groups can be of any type such as, unique or static. You can block executable by choosing custom group which contains computers.

Block executable does not support blocking executable which are initiated by the system.