Managing application rights
By default, application activity is controlled based on the application rights that are defined for the specific trust group that Kaspersky Endpoint Security assigned to the application when it started for the first time. If necessary, you can edit the application rights for an entire trust group, for an individual application, or for a group of applications within a trust group.
Manually defined application rights have a higher priority than application rights that were defined for a trust group. In other words, if manually defined application rights differ from the application rights defined for a trust group, the Host Intrusion Prevention component controls application activity according to the manually defined application rights.
The rules that you create for applications are inherited by child applications. For example, if you deny all network activity for cmd.exe, all network activity will also be denied for notepad.exe if it is started using cmd.exe. If an application is started indirectly by another application but is not a child of the application it runs from, rules are not inherited.
How to change application rights in the Administration Console (MMC)
- Open the Kaspersky Security Center Administration Console.
- In the Managed devices folder in the Administration Console tree, open the folder with the name of the administration group to which the relevant client computers belong.
- In the workspace, select the Policies tab.
- Select the necessary policy and double-click to open the policy properties.
- In the policy window, select Advanced Threat Protection → Host Intrusion Prevention.
- In the Application rights block, click the Settings button.
This opens the application rights configuration window and the list of protected resources.
- Select the Application rights tab.
- Click the Add button.
- In the opened window, enter criteria to search for the application whose application rights you want to change.
You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the
*and?characters when entering a mask. - Click the Refresh button.
Kaspersky Endpoint Security will search for the application in the consolidated list of applications installed on managed computers. Kaspersky Endpoint Security will show a list of applications that satisfy your search criteria.
- Select the necessary application.
- In the Add selected applications to <trust group> group drop-down list, select Default groups and click OK.
The application will be added to the default group.
- Select the relevant application and then select Application rights from the context menu of the application.
This opens the application properties.
- Do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select the Files and system registry tab.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select the Rights tab.
Network activity of applications is controlled by the Firewall using network rules.
- For the relevant resource, in the column of the corresponding action, right-click to open the context menu and select the necessary option: Inherit, Allow (
) or Forbid (
). - If you want to monitor the use of computer resources, select Write to report (
/ 
).Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
- Save your changes.
How to change application rights in the Web Console and Cloud Console
- In the main window of Web Console, select Devices → Policies and profiles.
- Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
- Select the Application settings tab.
- Select Advanced Threat Protection → Host Intrusion Prevention.
- In the Application rights and protected resources block, click the Application rights and protected resources link.
This opens the application rights configuration window and the list of protected resources.
- Select the Application rights tab.
You will see a list of trust groups on the left side of the window and their properties on the right side.
- Click the Add button.
This starts the Wizard for adding an application to a trust group.
- Click the Selected target group link to select the relevant trust group for the application.
- Select the Application type. Click the Next button.
If you want to change the trust group for multiple applications, select the Group type and define a name for the application group.
- In the opened list of applications, select the applications whose application rights you want to change.
Use a filter. You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the
*and?characters when entering a mask. - Finish the Wizard by clicking OK.
The application will be added to the trust group.
- In the left part of the window, select the relevant application.
- In the right part of the window, in the drop-down list, do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select Files and system registry.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select Rights.
Network activity of applications is controlled by the Firewall using network rules.
- For the relevant resource, in the column of the corresponding action, select the necessary option: Inherit, Allow (
), or Forbid (
). - If you want to monitor the use of computer resources, select Write to report (
/ 
).Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
- Save your changes.
How to change application rights in the application interface
- In the lower part of the main application window, click the
button. - In the application settings window, select Protection → Advanced Threat Protection → Host Intrusion Prevention.
- Click the Manage applications button.
This opens the list of installed applications.
- Select the necessary application.
- In the context menu of the application, select Details and rules.
This opens the application properties.
- Do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select the Files and system registry tab.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select the Rights tab.
- For the relevant resource, in the column of the corresponding action, right-click to open the context menu and select the necessary option: Inherit, Allow (
), or Forbid (
). - If you want to monitor the use of computer resources, select Write to report (
).Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
- Select the Exclusions tab and configure the advanced settings of the application (see the table below).
- Save your changes.
Advanced Settings of the application
Parameter
Description
Do not scan opened files
All files that are opened by the application are excluded from scans by Kaspersky Endpoint Security. For example, if you are using applications to back up files, this feature helps reduce the consumption of resources by Kaspersky Endpoint Security.
Do not monitor application activity
Kaspersky Endpoint Security will not monitor the application's file- and network activity in the operating system. Application activity is monitored by the following components: Behavior Detection, Exploit Prevention, Host Intrusion Prevention, Remediation Engine and Firewall.
Do not inherit restrictions of the parent process (application)
The restrictions configured for the parent process will not be applied by Kaspersky Endpoint Security to a child process. The parent process is started by an application for which application rights (Host Intrusion Prevention) and application network rules (Firewall) are configured.
Do not monitor the activity of child applications
Kaspersky Endpoint Security will not monitor the file activity or network activity of applications that are started by this application.
Allow interaction with Kaspersky Endpoint Security interface
Kaspersky Endpoint Security Self-Defense blocks all attempts to manage application services from a remote computer. If the check box is selected, the remote access application is allowed to manage Kaspersky Endpoint Security settings through the Kaspersky Endpoint Security interface.
Do not scan encrypted traffic / Do not scan all traffic
Network traffic initiated by the application will be excluded from scans by Kaspersky Endpoint Security. You can exclude either all traffic or only encrypted traffic from scans. You can also exclude individual IP addresses and port numbers from scans.