Application run - the module tracks application launching.
Application install - the module tracks installation/uninstallation of applications.
Rules: Monitoring - Application¶
This rule can exclude monitoring processes that are run automatically or set to run on workstations by the administrators, reducing the load on the StaffCop Server.
Disallow - forbids collecting data on events generated by an executable file, an application or a list of applications.
Allow - allow tracking events for the applications on the list. Other applications are not tracked.
Rules: Access - Applications¶
Block - block launching applications on the list. The applications not on the list are allowed.
Allow - the list of the allowed applications.
When adding new allowed applications to the list you should keep in mind that all the applications not stated on the list are blocked! This will lead to inoperability of the operating system.
For correct operation of the system you should whitelist the system processes. For example:
EXPLORER.EXE DLLHOST.EXE TASKHOST.EXE USERINIT.EXE DWM.EXE WMPNSCFG.EXE