Apply protection rules

Select Menu → Policy → Policy Catalog.

Select Solidcore 8.x.x: Change Control for the product.

You can create a policy or duplicate an existing one.

Read-protect files and directories.

1. Select a policy from the list, then click Add on the Read-Protect tab. The Add File dialog box appears.

2. Specify the file or directory name and indicate whether to include or exclude from read protection.

3. Click OK.

Write-protect files and directories.

1. Select a policy from the list, then click Add on the Write-Protect File tab. The Add File dialog box appears.

2. Specify the file or directory name and indicate whether to include or exclude from write protection.

3. Click OK.

Write-protect registry keys:

1. Click Add on the Write-Protect Registry tab. The Add Registry dialog box appears.

2. Specify the registry key and indicate whether to include or exclude from write protection.

3. Click OK.

Specify trusted programs permitted to override the read and write protection rules.

1. Click Add on the Updater Processes tab. The Add Updater dialog box appears.

2. Specify whether to add the updater based on the file name, SHA-1, or SHA-256. If you add the updater by name, it isn't authorized automatically. But, when you add the updater by SHA-1 or SHA-256, the updater is authorized.

3. Enter the location of the file (when adding by name), SHA-1, or SHA-256 of the executable file.

4. Enter a unique identification label for the executable file. For example, if you specify Adobe Updater Changes as the identification label for the Adobe_Updater.exe file, all change events made by the Adobe_Updater.exe file are tagged with this label.

5. Specify conditions that the file must meet to run as an updater:

   • Select None to allow the file to run as an updater without any conditions.

   • Select Library to allow the file to run as updater only when it has loaded the specified library. For example, when configuring iexplore.exe as an updater to allow Windows Updates using Internet Explorer, specify wuweb.dll as the library. This makes sure that the iexplore.exe program has updater rights only until the Web Control library (wuweb.dll) is loaded.

   • Select Parent to allow the file to run as an updater only if it is started by the specified parent. For example, when configuring updater.sh as an updater to allow changes to Mozilla Firefox, specify firefox as the parent. Although updater.exe is a generic name that can be part of any installed application, using the parent makes sure that only the correct program is allowed to run as an updater.

6. Indicate whether to disable inheritance for the updater. For example, if Process A (that is set as an updater) starts Process B, disabling inheritance for Process A makes sure that Process B doesn't become an updater.

7. Indicate whether to suppress events generated for the actions performed by the updater. Typically, when an updater changes a protected file, a File Modified event is generated for the file. If you select this option, no events are generated for changes made by the updater.

8. Click OK.

Specify users permitted to override the read and write protection rules.

1. On the Users tab, click Add. The Add User dialog box appears.

2. On the Add User dialog box, create two rules for each user: one with UPN/SAM and domain account name (in domainName\user format) and another with domain netbiosName (in netbiosName\user format).

3. Specify a unique identification label for the user. For example, if you specify John Doe Changes as the identification label for the John Doe user, all changes made by the user are tagged with this label.

4. Type the user name, then click OK.