Exclusions tab

Disable buffer overflow protection (CASP) for a process — Bypasses the specified process in the Process Name field from the Critical Address Space Protection (CASP) technique.

Disable buffer overflow protection (NX) for a process on 64-bit Windows — Bypasses the specified process in the Process Name field from the No eXecute (NX) technique. Select Enable Inheritance to bypass child processes launched by the file from the No eXecute (NX) technique.

Disable ROP protection for a process using Forced Relocation (VASR) — Bypasses the specified process in the Process Name field from the VASR Forced-Relocation technique. Optionally, the Library Name field allows you to specify the name of the DLL file associated with the process.

Disable ROP protection for a DLL using DLL Relocation (VASR) — Bypasses the specified DLL file in the Process Name field from the VASR DLL Relocation technique. The file is not rebased and is loaded from its preferred base address. This option is applicable for endpoints running version earlier than 7.0.0.

Disable ROP protection for a process using Stack Randomization (VASR) — Bypasses the specified process in the Process Name field from the VASR Process Stack Randomization technique. This option is applicable for endpoints running version earlier than 7.0.0.

Allow uninstallations — On endpoints running version 6.1.1 or later, this option allows execution of EXE-based uninstall files that come with the installer package. When the Allow Uninstallation subfeature (pkg-ctrl-allow-uninstall) for Package Control is disabled, the execution of uninstall files is blocked because there is no method to identify whether they are completing the installation process or performing uninstallation. However, this option bypasses the uninstall files from the Allow Uninstallation subfeature, thereby allowing the execution.

For example, in case of Firefox browser, the helper.exe uninstall file performs uninstallation and multiple other tasks, such as import settings from other browsers. When you try to uninstall the Firefox browser using Control Panel, the helper.exe file performs uninstallation. Also, the file tries to perform other tasks. However, when the Allow Uninstallation subfeature is disabled, such tasks are denied because the uninstall file is not allowed to run.

To allow the uninstall file to run when performing tasks other than uninstalling the software, we have designed a mechanism. The mechanism is based on applying a process-based rule. The process-based rule provides a specific context for bypassing the uninstall file from the Allow Uninstallation subfeature using the following command.

sadmin attr add -o parent=<parent_process_name> -i <process_name>

Using this rule, only when the <process_name> is launched by process <parent_process_name>, it is bypassed from the Allow Uninstallation subfeature and allowed to execute.

Specify the process name (uninstall file) in the Process Name field and the parent process name in the Parent Process Name field. Specifying the parent process name is mandatory to provide specific context for bypassing the file.

Note

For endpoints running versions earlier than 6.1.1, this option applies the default rules for Installation Detection bypass technique and the new behavior for uninstallation of EXE-based uninstall files is partially applied without an option to specify the parent process name.

Exclude file from write-protection rules and allow script execution — Bypasses the specified process in the Process Name field using the Process Context File Operations bypass technique. Optionally, the Parent Process Name field allows you to specify the name of the parent process. Sometimes, Application Control can prevent legitimate applications from running. Use this option to define a bypass rule for a file on 32-bit or 64-bit Windows platforms. Use this option carefully because it can affect default Application Control functionality.

Exclude file from registry operations — Bypasses registry operations (attr -g) for the specified process on the endpoint.

Ignore path for file operations — Specify the relative path in the Relative Path field to ignore the path for file operations. This option corresponds to the skiplist -i command.

Exclude path from file operations — Specify the relative path in the Relative Path field to bypass the path from file operations. This option corresponds to the skiplist -f command.

Exclude path from write-protection rules — Specify the relative path in the Relative Path field to bypass the file from write-protection rules. This option corresponds to the skiplist -d command.

Exclude local path and all its contained files and sub-directories from the allow list — Specify the local path in the Path field to bypass the local path and all its contained files and subdirectories from the allow list. This option corresponds to the skiplist -s command.

Exclude volume from Application Control protection — Specify the volume in the Volume field to bypass it from Application Control protection. In effect, this option detaches the specified volume from the allow list. This option corresponds to the skiplist -v command.

OK — Adds the rule.

Cancel — Exits without saving the rule.