IT admins always handle a lots of software and applications for their IT. With a lot of applications to handle, IT admins will have the need to restrict the usage of certain applications, IT admins can leverage the Block Executable capability of Endpoint Central.
Block Executable is the capability using which IT admins can restrict the initialization and working of an executable. This blocks the running of exe which are launched without installation on the network. All the file formats supported under Windows "Software Restriction Policy" can be blocked using Endpoint Central. If in case, a software is to be prohibited from your network, prohibited software can be configured to achieve the same.
Check these pre-requisites to deploy a block executable rule
Click here to watch the video:
To remove a rule, navigate to Inventory > Block Executable and select the policies you wish to remove and click the "Remove Policy" button.
IT admins can block an executable using the Path Rule when the targeted file name/path name remains static. Path Rule works on the logic of filename and it's extensions. Rename or relocation of the file will lead to failure of execution of the rule applied. This rule can be used to block applications even if they are not available in your network. With the help of path rule, all the versions of the specified application can be blocked. For example, when block executable is configured for Google Chrome based on Path Rule for a specific version, all the versions of the Google Chrome will be blocked.
Hash is a unique value, that represents the executable. Blocking an executable using Hash Rule will restrict the application, irrespective of any changes to that application. IT admins should compute the Hash value for the targeted application and add it to the rule to block that executable.
Endpoint Central by default has a custom group named "All Computers Group", which contains all the managed computers. If you want to block an executable for all the managed computers, then you can choose the default Custom Group and select the executable, which needs to be blocked. If you want to block the executable for a selected target, follow the below method.
To block an executable for specific target, create a new custom group or use the existing custom groups. Custom groups can be of any type such as, unique or static or dynamic. You can block executable by choosing custom group which contains computers.
Block executable does not support blocking executable which are initiated by the system.
Type gpedit.msc
Click Group Policy
Click on "Turn Off Local Group Policy Objects Processing" as shown below.
Ensure that you have chosen "Not Configured" as shown in the below image.
You have now enabled Local Group Policy on the target machine.
Type gpedit.msc
Type gpedit.msc
Type gpedit.msc
Click "Software Restriction Policy"
Double click "Enforcement" to ensure that "All Users" is selected as shown in the image below
You have now enabled Local Group Policy for Administrators.