You can identify a list of possible updaters that can be added in a Windows system. In the feature list, this is identified as discover-updaters.
When running in Enabled mode, Application Control protection can prevent a legitimate application from running (if the required rules are not defined). The software tracks all failed attempts made by authorized executable to change protected files or run other executable files. You can review the information of failed attempts to identify update rules to allow legitimate applications to run.
Get a list of components that can be added as updaters:
sadmin diagNote
Review the list to ensure that no restricted program or programs with generic names such as,
setup.exe, are set as authorized updaters.The output of executing this command displays these configuration parameters.
Symbol
Configuration Rules
!
The configuration for the program exists. The existing configuration is displayed on the next line.
*
The configuration is for a restricted program, which can provide capability to change the system. Hence, such programs must have restricted configuration.
* and !
The configuration of the program exists but some changes are required in the configuration to execute the program successfully.
Apply the diagnosed configuration changes:
sadmin diag fixApply the diagnosed configuration changes for restricted programs:
sadmin diag fix -fRestricted programs are Windows critical programs. For example,
services.exe,winlogon.exe,svchost.exe, andexplorer.exe.