App Control: What are "File * would have blocked if the rule was not in Report Only mode." Events?

[#1]

Environment

• App Control Console 

Question

What are the "File * would have blocked if the rule was not in Report Only mode." events? Why do they occur?

Answer

• Creating a Ban (Report Only) rule allows observing how a ban might affect users
• With a report-only ban, the file is not blocked but would-have-blocked and would-have-terminated warnings are written to the Events log
• If certain this is a file that needs to be blocked from executing, it's possible to change the rule to a full Ban

Related Content

Cb Protection User v8.1.0 User Guide-GA version
Report read-only memory map operations on unapproved executable by .NET applications