Application control

• Application run - the module tracks application launching.

• Application install - the module tracks installation/uninstallation of applications.

Rules: Monitoring - Application

This rule can exclude monitoring processes that are run automatically or set to run on workstations by the administrators, reducing the load on the StaffCop Server.

Disallow - forbids collecting data on events generated by an executable file, an application or a list of applications.

Allow - allow tracking events for the applications on the list. Other applications are not tracked.

Rules: Access - Applications

Block - block launching applications on the list. The applications not on the list are allowed.

Allow - the list of the allowed applications.

Note

When adding new allowed applications to the list you should keep in mind that all the applications not stated on the list are blocked! This will lead to inoperability of the operating system.

For correct operation of the system you should whitelist the system processes. For example:

EXPLORER.EXE
DLLHOST.EXE
TASKHOST.EXE
USERINIT.EXE
DWM.EXE
WMPNSCFG.EXE