List of Commands for Application Control and Change Control

When using Application Control and Change Control in a standalone configuration, you can use different commands and arguments to manage the software and its features.

attr

This command changes or lists the software configuration attributes.

Command syntax conventions

sadmin attr add -a|-p|-u file...
sadmin attr remove [-a|-p|-u]
sadmin attr list [-a|-p|-u] [file...]
sadmin attr flush [-a|-p|-u ]

auth

This command authorizes an application (allow list), or unauthorizes it (blocklist). The application (executable or script) can be installed or invoked from a local drive or a network folder.

Command syntax conventions

sadmin auth add { -a | -u [ -t rule-id ] | -au [-t rule-id ] | -b } <checksum>
sadmin auth flush
sadmin auth list
sadmin auth remove <checksum>

begin-update (bu)

This command initiates Update mode to help perform software updates and installations.

Command syntax conventions

sadmin begin-update [workflow-id [ comment]]

check

This command validates and fixes the attributes of the specified file against the inventory.

Command syntax conventions

sadmin check [-r] file name|directory name|volume name

config

This command exports current configuration settings to a file or imports configuration settings from a file to an existing installation.

Command syntax conventions

sadmin config export file
sadmin config import [-a] file
sadmin config set name=value
sadmin config show

diag

This command runs diagnostics and offers suggestions on programs and applications to authorize (to perform updates).

Command syntax conventions

sadmin diag

disable

This command activates Disabled mode. Restart the system to make sure that the command is applied.

Command syntax conventions

sadmin disable

enable

This command activates Enabled mode. Restart the system to make sure that the command is applied.

Command syntax conventions

sadmin enable

end-update (eu)

This command ends Update mode and activates Enabled mode.

Command syntax conventions

sadmin end-update

event

This command configures the log targets (sinks) for generated events.

Command syntax conventions

sadmin event sink [eventname sinkname]
sadmin event sink -a|-r { eventname | ALL } { sinkname | ALL }

features

This command enables, disables, or lists the features on an existing installation.

Command syntax conventions

sadmin features [enable|disable|list] [feature name]

help

This command provides information about basic commands.

Command syntax conventions

sadmin help [command]

help-advanced

This command provides information about advanced commands.

Command syntax conventions

sadmin help-advanced [command]

license

This command adds or displays licensing information.

Command syntax conventions

sadmin license add <license key>
sadmin license list

list-solidified (ls)

This command lists the files, directories, and volumes in the allow list.

Command syntax conventions

sadmin list-solidified [-l] [file name|directory name|volume name]

list-unsolidified (lu)

This command lists the files, directories, and volumes that are not in the allow list.

Command syntax conventions

sadmin list-unsolidified [file name|directory name|volume name]

lockdown

This command disables the local command line interface. After lockdown, you can only issue the help, help-advanced, status, version, and recover commands.

Command syntax conventions

sadmin lockdown

monitor (mon)

With this command, you can monitor changes to files, user activity and process execution or termination.

Command syntax conventions

sadmin monitor file [ -e |-i | -r ] file name|directory name|volume name

passwd

This command sets a password for the command line interface. If the password is set, you must verify the password before executing critical commands. Using sadmin passwd -d command removes the password.

Command syntax conventions

sadmin passwd [-d]

read-protect (rp)

This command displays or changes the read protection rules. You must specify complete file or directory names with this command.

Command syntax conventions

read-protect/rp [-e | -i | -r ] path

recover

This command recovers the local command line interface from locked down state.

Command syntax conventions

sadmin recover [-f]

skiplist -s

This command removes files present under the specified path component and subdirectories from the allow list.

Command syntax conventions

sadmin skiplist add -s pathname
sadmin skiplist remove -s pathname
sadmin skiplist list -s
sadmin skiplist flush -s

solidify (so)

This command adds specified files in a directory or system volume to the allow list.

Command syntax conventions

sadmin solidify [-q|-v] [file|directory|volume]

status

This command displays the status of the software. You can view the operational mode, operational mode on system restart, connectivity with ePO - On-prem, access status, and allow list status of the local CLI.

Command syntax conventions

sadmin status

trusted

This command identifies a local or remote share as a trusted file path, volume, or directory. You can include, exclude, remove, list, or flush the trusted volumes or directories.

Command syntax conventions

sadmin trusted -e|-i|-r|-f|-l [path name|volume name]

unsolidify (unso)

This command removes specified files from the allow list.

Command syntax conventions

sadmin unsolidify [ -v ] [file name|directory name|volume name]

updaters

This command adds, deletes, lists, or flushes programs from the list of authorized updaters.

Command syntax conventions

sadmin updaters add [-d|-n] binaryname
sadmin updaters add [-p parent-binaryname] binaryname
sadmin updaters add [-t rule-id] binaryname
sadmin updaters add [-d] [-n] [-t rule-id] [-p parent-binaryname] binaryname
sadmin updaters remove [-p parent-binaryname] binaryname
sadmin updaters remove [-l libraryname] binaryname
sadmin updaters list
sadmin updaters flush

version

This command displays the version of the software that you have installed in your system.

Command syntax conventions

sadmin version

write-protect (wp)

This command write-protects specified files including files in the allow list. You must specify complete file or directory names with this command.

Command syntax conventions

sadmin write-protect -e|-i|-r pathname
sadmin write-protect -f|-l