When using Application Control and Change Control in a standalone configuration, you can use different commands and arguments to manage the software and its features.
attr
This command changes or lists the software configuration attributes.
Command syntax conventions
- sadmin attr add -a|-p|-u file...
- sadmin attr add -o parent=PARENT_FILE -p FILE
- sadmin attr remove [-a|-p|-u]
- sadmin attr list [-a|-p|-u] [file...]
- sadmin attr flush [-a|-p|-u ]
auth
This command authorizes an application (whitelist), or unauthorizes it (blacklist). The application (executable or script) can be installed or invoked from a local drive or a network folder.
Command syntax conventions
- sadmin auth add { -a | -u [ -t rule-id ] | -au [-t rule-id ] | -b } <checksum>
- sadmin auth flush
- sadmin auth list
- sadmin auth remove <checksum>
begin-update (bu)
This command initiates Update mode to help perform software updates and installations.
Command syntax conventions
- sadmin begin-update [workflow-id [ comment]]
check
This command validates and fixes the attributes of the specified file against the inventory.
Command syntax conventions
- sadmin check [-r] file name|directory name|volume name
config
This command exports current configuration settings to a file or imports configuration settings from a file to an existing installation.
Command syntax conventions
- sadmin config export file
- sadmin config import [-a] file
- sadmin config set name=value
- sadmin config show
disable
This command activates Disabled mode. Restart the system to make sure that the command is applied.
Command syntax conventions
- sadmin disable
enable
This command activates Enabled mode. Restart the system to make sure that the command is applied.
Command syntax conventions
- sadmin enable
end-update (eu)
This command ends Update mode and activates Enabled mode.
Command syntax conventions
- sadmin end-update
event
This command configures the log targets (sinks) for generated events.
Command syntax conventions
- sadmin event sink [eventname sinkname]
- sadmin event sink -a|-r { eventname | ALL } { sinkname | ALL }
features
This command enables, disables, or lists the features on an existing installation.
Command syntax conventions
- sadmin features [enable|disable|list] [feature name]
help
This command provides information about basic commands.
Command syntax conventions
- sadmin help [command]
help-advanced
This command provides information about advanced commands.
Command syntax conventions
- sadmin help-advanced [command]
license
This command adds or displays licensing information.
Command syntax conventions
- sadmin license add <license key>
- sadmin license list
list-solidified (ls)
This command lists the whitelisted files, directories, and volumes.
Command syntax conventions
- sadmin list-solidified [-l] [file name|directory name|volume name]
list-unsolidified (lu)
This command lists the files, directories, and volumes that are not whitelisted.
Command syntax conventions
- sadmin list-unsolidified [file name|directory name|volume name]
lockdown
This command disables the local command line interface. After lockdown, you can only issue the help, help-advanced, status, version, and recover commands.
Command syntax conventions
- sadmin lockdown
monitor (mon)
With this command, you can monitor changes to files, user activity and process execution or termination.
Command syntax conventions
- sadmin monitor file [ -e |-i | -r ] file name|directory name|volume name
passwd
This command sets a password for the command line interface. If the password is set, you must verify the password before executing critical commands. Using sadmin passwd -d command removes the password.
Command syntax conventions
- sadmin passwd [-d]
read-protect (rp)
This command displays or changes the read protection rules. You must specify complete file or directory names with this command.
Command syntax conventions
- read-protect/rp [-e | -i | -r ] path
recover
This command recovers the local command line interface from locked down state.
Command syntax conventions
- sadmin recover [-f]
solidify (so)
This command adds specified files in a directory or system volume to the whitelist.
Command syntax conventions
- sadmin solidify [-q|-v] [file|directory|volume]
status
This command displays the status of the software. You can view the operational mode, operational mode on system restart, connectivity with Trellix ePO - On-prem, access status, and whitelist status of the local CLI.
Command syntax conventions
- sadmin status
trusted
This command identifies a local or remote share as a trusted file path, volume, or directory. You can include, exclude, remove, list, or flush the trusted volumes or directories.
Command syntax conventions
- sadmin trusted -e|-i|-r|-f|-l [path name|volume name]
unsolidify (unso)
This command removes specified files from the whitelist.
Command syntax conventions
- sadmin unsolidify [ -v ] [file name|directory name|volume name]
updaters
This command adds, deletes, lists, or flushes programs from the list of authorized updaters.
Command syntax conventions
- sadmin updaters add [-d|-n] binaryname
- sadmin updaters add [-p parent-binaryname] binaryname
- sadmin updaters add [-t rule-id] binaryname
- sadmin updaters add [-d] [-n] [-t rule-id] [-p parent-binaryname] binaryname
- sadmin updaters remove [-p parent-binaryname] binaryname
- sadmin updaters remove [-l libraryname] binaryname
- sadmin updaters list
- sadmin updaters flush
version
This command displays the version of the software that you have installed in your system.
Command syntax conventions
- sadmin version
write-protect (wp)
This command write-protects specified files including the whitelisted files. You must specify complete file or directory names with this command.
Command syntax conventions
- sadmin write-protect -e|-i|-r pathname
- sadmin write-protect -f|-l
deploy-on
This command enables a large number of container deployments in Change Control to avoid performance issues.
Note
The CLI options for large number of container deployments do not work in Application Control.
Command syntax conventions
- sadmin deploy-on
deploy-off
This command disables container deployment in Change Control.
Command syntax conventions
- sadmin deploy-off