Add Subrule or Edit Subrule

Add or edit user-defined Access Protection subrules.

Options
	Option	Definition
	Name	Specifies the name of the subrule.
	Subrule type	Specifies the subrule type. Changing the subrule type removes any previously defined entries in the Targets table. Files — Protects a file or directory. For example, create a custom rule to block or report attempts to delete an Excel spreadsheet that contains sensitive information. Registry key — Protects the specified key. A registry key is the container for the registry value. For example, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Registry value — Protects the specified value. Registry values are stored in registry keys and are referenced separately from registry keys. For example, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Autorun. Processes — Protects the specified process. For example, create a custom rule to block or report attempted operations on a process. Services — Protects the specified service. For example, create a custom rule to prevent a service from being stopped or started.
	Operations	Indicates the operations permitted with the specified subrule type. You must specify at least one operation to apply to the subrule. Files: Change read-only or hidden attributes — Blocks or reports changing these attributes of files in the specified folder. Create — Blocks or reports creation of files in the specified folder. Delete — Blocks or reports deletion of files in the specified folder. Execute — Blocks or reports execution of files in the specified folder. Change permissions — Blocks or reports changing permissions settings of files in the specified folder. Read — Blocks or reports read access to the specified files. Rename — Blocks or reports rename access to the specified files. If the Destination file target is specified, Rename is the only valid operation. See Rename operation target examples. Write — Blocks or reports write access to the specified files. Registry key: Write — Blocks or reports write access to the specified key. Create — Blocks or reports creation of the specified key. Delete — Blocks or reports deletion of the specified key. Read — Blocks or reports read access to the specified key. Enumerate — Blocks or reports enumeration of the subkeys for the specified registry key. Load — Blocks or reports the ability to unload the specified registry key and its subkeys from the registry. Replace — Blocks or reports replacement of the specified registry key and its subkeys with another file. Restore — Blocks or reports the ability to save registry information in a specified file and copies over the specified key. Change permissions — Blocks or reports changing permissions settings of specified registry key and its subkeys. Registry value: Write — Blocks or reports write access to the specified value. Create — Blocks or reports creation of the specified value. Delete — Blocks or reports deletion of the specified value. Read — Blocks or reports read access to the specified value. Processes: Any access — Blocks or reports opening the process with any access. Create thread — Blocks or reports opening the process with access to create a thread. Change — Blocks or reports opening the process with access to change. Terminate — Blocks or reports opening the process with access to terminate. Run — Blocks or reports running the specified target executable. You must add at least one target executable to the rule. For the Run operation, an event is generated when an attempt is made to run the target process. For all other operations, an event is generated when the target is opened. Services: Note With Microsoft Windows 8.1 and later, Access Protection rules no longer support operations for the Services subrule type. This is because Microsoft made services.exe a protected process in Windows 8.1 and later. Start — Blocks or reports starting the service. Stop — Blocks or reports stopping the service. Pause — Blocks or reports pausing the service. Continue — Blocks or reports continuing the service after a pause. Create — Blocks or reports creating the service. Delete — Blocks or reports deleting the service. Enable hardware profile — Blocks or reports enabling the hardware profile of the service. Disable hardware profile — Blocks or reports disabling the hardware profile of the service. Change startup mode — Blocks or reports changing the startup mode (Boot, System, Automatic, Manual, Disabled) of the service. Change logon information — Blocks or reports changing the logon information of the service.
	Targets	Add — Specifies the targets for the rule. Targets vary depending on the rule type selection. You must add at least one target to the subrule. Click Add, select the inclusion status, then enter or select the target to include or exclude. Double-click an item — Changes the selected item. Delete — Deletes the selected item.