Targets

• Include — Indicates that the subrule can match the specified target.
• Exclude — Indicates that the subrule must not match the specified target.

Add a target with either an Include or Exclude directive.

Access Protection rules treat files and folders as case insensitive — rules apply to all case variations of the specified files and folders. For example, if you create a rule to block C:\Temp\ABC, Access Protection also blocks C:\temp\abc and C:\TEMP\Abc.

• File path — Browse to select the file.
• Destination file — Browse to select the target file name or path for a Rename operation.

  If the Destination file target is selected, the Rename operation (only) must be selected.

• Drive type — Select the drive type target from the drop-down list:
  • Removable — Files on a USB drive or other removable drive connected to a USB port, including those with Windows To Go installed. This drive type doesn't include files on a CD, DVD, or floppy disk.

    Note

    Blocking this drive type also blocks drives with Windows To Go installed.

  • Network — Files on a network share
  • Fixed — Files on the local hard drive or other fixed hard disk
  • CD/DVD — Files on a CD or DVD
  • Floppy — Files on a floppy disk

You can use ?, *, and ** as wildcards.

System environment variables

Files subrule target best practices

For example, to protect:

• A file or folder named c:\testap, use a target of c:\testap or c:\testap\
• The contents of a folder, use the asterisk wildcard — c:\testap\*
• The contents of a folder and its subfolders, use 2 asterisks — c:\testap\**

Rename operation target examples

To prevent files from being renamed, select the Rename operation, then set the subrule target:

• To prevent any file from being renamed to newname.txt, set the Destination file target to "newname.txt".
• To prevent original.txt from being renamed to any other name, set the File path target to "original.txt".
• To prevent only the original.txt file from being renamed to newname.txt, specify 2 subrule targets:
  • Set the File path target to "original.txt".
  • Set the Destination file target to "newname.txt".

• HKLM or HKEY_LOCAL_MACHINE
• HKCU or HKEY_CURRENT_USER
• HKCR or HKEY_CLASSES_ROOT
• HKCCS matches HKLM/SYSTEM/CurrentControlSet and HKLM/SYSTEM/ControlSet00X
• HKLMS matches HKLM/Software on 32-bit and 64-bit systems, and HKLM/Software/Wow6432Node on 64-bit systems only
• HKCUS matches HKCU/Software on 32-bit and 64-bit systems, and HKCU/Software/Wow6432Node on 64-bit systems only
• HKULM treated as both HKLM and HKCU
• HKULMS treated as both HKLMS and HKCUS
• HKALL treated as both HKLM and HKU

You can use ?, *, and ** as wildcards, and | (pipe) as an escape character.

Registry key subrule target best practices

For example, to protect:

• A registry key named HKLM\SOFTWARE\testap, use a target of HKLM\SOFTWARE\testap or HKLM\SOFTWARE\testap\
• The contents of a registry key, use the asterisk wildcard — HKLM\SOFTWARE\testap\*
• The contents of a registry key and its subkeys, use 2 asterisks — HKLM\SOFTWARE\testap\**
• Registry keys and values under a registry key, enable the Write operation

• HKLM or HKEY_LOCAL_MACHINE
• HKCU or HKEY_CURRENT_USER
• HKCR or HKEY_CLASSES_ROOT
• HKCCS matches HKLM/SYSTEM/CurrentControlSet and HKLM/SYSTEM/ControlSet00X
• HKLMS matches HKLM/Software on 32-bit and 64-bit systems, and HKLM/Software/Wow6432Node on 64-bit systems only
• HKCUS matches HKCU/Software on 32-bit and 64-bit systems, and HKCU/Software/Wow6432Node on 64-bit systems only
• HKULM treated as both HKLM and HKCU
• HKULMS treated as both HKLMS and HKCUS
• HKALL treated as both HKLM and HKU

You can use ?, *, and ** as wildcards, and | (pipe) as an escape character.

Registry value subrule target best practices

For example, to protect:

• A registry value named HKLM\SOFTWARE\testap, use a target of HKLM\SOFTWARE\testap
• The registry values under a registry key, use the asterisk wildcard — HKLM\SOFTWARE\testap\*
• The registry values under a registry key and its subkeys, use 2 asterisks — HKLM\SOFTWARE\testap\**

You can use ?, *, and ** as wildcards for all except MD5 hash.

Processes subrule target best practices

For example, to protect:

• A process named c:\testap.exe, use a target file name or path of c:\testap.exe
• All processes in a folder, use the asterisk wildcard — c:\testap\*
• All processes in a folder and its subfolders, use 2 asterisks — c:\testap\**

• Service registered name — Contains the name of the service in the corresponding registry key under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.
• Service display name — Contains the display name of the service from the DisplayName registry value under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>\. This is the name that appears in the Services manager.

For example, "Adobe Acrobat Update Service" is the display name for the "AdobeARMservice" service name.

You can use ? and * as wildcards.

Services subrule target best practices

For example, to protect all Adobe services by display name, use the asterisk wildcard — Adobe*