Environment
- App Control: All Supported Versions
Question
Why are files being approved by the "approve writes from trusted processes" rule?
Answer
This rule will be triggered if the process or parent process is promoted
Additional Notes
There are a few reasons a process is being promoted, but the most common are:
- File has been marked as an installer either manually or through a trusted directory
- Custom rule with the Promote action is selected
- Updater rules, can sometimes promote specific processes
Related Content
