When using Application Control and Change Control in a standalone configuration, you can use different commands and arguments to manage the software and its features.
attr
This command changes or lists the software configuration attributes.
Command syntax conventions
- sadmin attr add -a|-p|-u file...
- sadmin attr add -o parent=PARENT_FILE -p FILE
- sadmin attr remove [-a|-p|-u]
- sadmin attr list [-a|-p|-u] [file...]
- sadmin attr flush [-a|-p|-u ]
auth
This command authorizes an application (whitelist), or unauthorizes it (blacklist). The application (executable or script) can be installed or invoked from a local drive or a network folder.
Command syntax conventions
- sadmin auth add { -a | -u [ -t rule-id ] | -au [-t rule-id ] | -b } <checksum>
- sadmin auth flush
- sadmin auth list
- sadmin auth remove <checksum>
begin-update (bu)
This command initiates Update mode to help perform software updates and installations.
Command syntax conventions
- sadmin begin-update [workflow-id [ comment]]
check
This command validates and fixes the attributes of the specified file against the inventory.
Command syntax conventions
- sadmin check [-r] file name|directory name|volume name
config
This command exports current configuration settings to a file or imports configuration settings from a file to an existing installation.
Command syntax conventions
- sadmin config export file
- sadmin config import [-a] file
- sadmin config set name=value
- sadmin config show
disable
This command activates Disabled mode. Restart the system to make sure that the command is applied.
Command syntax conventions
- sadmin disable
enable
This command activates Enabled mode. Restart the system to make sure that the command is applied.
Command syntax conventions
- sadmin enable
end-update (eu)
This command ends Update mode and activates Enabled mode.
Command syntax conventions
- sadmin end-update
event
This command configures the log targets (sinks) for generated events.
Command syntax conventions
- sadmin event sink [eventname sinkname]
- sadmin event sink -a|-r { eventname | ALL } { sinkname | ALL }
features
This command enables, disables, or lists the features on an existing installation.
Command syntax conventions
- sadmin features [enable|disable|list] [feature name]
help
This command provides information about basic commands.
Command syntax conventions
- sadmin help [command]
help-advanced
This command provides information about advanced commands.
Command syntax conventions
- sadmin help-advanced [command]
license
This command adds or displays licensing information.
Command syntax conventions
- sadmin license add <license key>
- sadmin license list
list-solidified (ls)
This command lists the whitelisted files, directories, and volumes.
Command syntax conventions
- sadmin list-solidified [-l] [file name|directory name|volume name]
list-unsolidified (lu)
This command lists the files, directories, and volumes that are not whitelisted.
Command syntax conventions
- sadmin list-unsolidified [file name|directory name|volume name]
lockdown
This command disables the local command line interface. After lockdown, you can only issue the help, help-advanced, status, version, and recover commands.
Command syntax conventions
- sadmin lockdown
monitor (mon)
With this command, you can monitor changes to files, user activity and process execution or termination.
Command syntax conventions
- sadmin monitor file [ -e |-i | -r ] file name|directory name|volume name
passwd
This command sets a password for the command line interface. If the password is set, you must verify the password before executing critical commands. Using sadmin passwd -d command removes the password.
Command syntax conventions
- sadmin passwd [-d]
read-protect (rp)
This command displays or changes the read protection rules. You must specify complete file or directory names with this command.
Command syntax conventions
- read-protect/rp [-e | -i | -r ] path
recover
This command recovers the local command line interface from locked down state.
Command syntax conventions
- sadmin recover [-f]
solidify (so)
This command adds specified files in a directory or system volume to the whitelist.
Command syntax conventions
- sadmin solidify [-q|-v] [file|directory|volume]
status
This command displays the status of the software. You can view the operational mode, operational mode on system restart, connectivity with Trellix ePO - On-prem, access status, and whitelist status of the local CLI.
Command syntax conventions
- sadmin status
trusted
This command identifies a local or remote share as a trusted file path, volume, or directory. You can include, exclude, remove, list, or flush the trusted volumes or directories.
Command syntax conventions
- sadmin trusted -e|-i|-r|-f|-l [path name|volume name]
unsolidify (unso)
This command removes specified files from the whitelist.
Command syntax conventions
- sadmin unsolidify [ -v ] [file name|directory name|volume name]
updaters
This command adds, deletes, lists, or flushes programs from the list of authorized updaters.
Command syntax conventions
- sadmin updaters add [-d|-n] binaryname
- sadmin updaters add [-p parent-binaryname] binaryname
- sadmin updaters add [-t rule-id] binaryname
- sadmin updaters add [-d] [-n] [-t rule-id] [-p parent-binaryname] binaryname
- sadmin updaters remove [-p parent-binaryname] binaryname
- sadmin updaters remove [-l libraryname] binaryname
- sadmin updaters list
- sadmin updaters flush
version
This command displays the version of the software that you have installed in your system.
Command syntax conventions
- sadmin version
write-protect (wp)
This command write-protects specified files including the whitelisted files. You must specify complete file or directory names with this command.
Command syntax conventions
- sadmin write-protect -e|-i|-r pathname
- sadmin write-protect -f|-l