Managing application rights

Computer protection > Host Intrusion Prevention > Managing application rights

Managing application rights

By default, application activity is controlled based on the application rights that are defined for the specific trust group that Kaspersky Endpoint Security assigned to the application when it started for the first time. If necessary, you can edit the application rights for an entire trust group, for an individual application, or for a group of applications within a trust group.

Manually defined application rights have a higher priority than application rights that were defined for a trust group. In other words, if manually defined application rights differ from the application rights defined for a trust group, the Host Intrusion Prevention component controls application activity according to the manually defined application rights.

The rules that you create for applications are inherited by child applications. For example, if you deny all network activity for cmd.exe, all network activity will also be denied for notepad.exe if it is started using cmd.exe. If an application is started indirectly by another application but is not a child of the application it runs from, rules are not inherited.

How to change application rights in the Administration Console (MMC)

Open the Kaspersky Security Center Administration Console.
In the Managed devices folder in the Administration Console tree, open the folder with the name of the administration group to which the relevant client computers belong.
In the workspace, select the Policies tab.
Select the necessary policy and double-click to open the policy properties.
In the policy window, select Advanced Threat Protection → Host Intrusion Prevention.
Under Application control rules and protected resources, click Settings.
This opens the application rights configuration window and the list of protected resources.
Select the Application rights tab.
Click the Add button.
In the opened window, enter criteria to search for the application whose application rights you want to change.
You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the * and ? characters when entering a mask.
Click the Refresh button.
Kaspersky Endpoint Security will search for the application in the consolidated list of applications installed on managed computers. Kaspersky Endpoint Security will show a list of applications that satisfy your search criteria.
Select the necessary application.
In the Add selected application to the trust group drop-down list, select Default groups and click OK.
The application will be added to the default group.
Select the relevant application and then select Application rights from the context menu of the application.
This opens the application properties.
Do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select the Files and system registry tab.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select the Rights tab.
Network activity of applications is controlled by the Firewall using network rules.
For the relevant resource, in the column of the corresponding action, right-click to open the context menu and select the necessary option: Inherit, Allow () or Forbid ().
If you want to monitor the use of computer resources, select Log events ( / ).
Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
Save your changes.

How to change application rights in the Web Console and Cloud Console

In the main window of Web Console, select Devices → Policies & profiles.
Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
Select the Application settings tab.
Select Advanced Threat Protection → Host Intrusion Prevention.
In the Application rights and protected resources block, click the Application rights and protected resources link.
This opens the application rights configuration window and the list of protected resources.
Select the Application rights tab.
You will see a list of trust groups on the left side of the window and their properties on the right side.
Click the Add button.
This starts the Wizard for adding an application to a trust group.
Select the relevant trust group for the application.
Select the Application type. Click the Next button.
If you want to change the trust group for multiple applications, select the Group type and define a name for the application group.
In the opened list of applications, select the applications whose application rights you want to change.
Use a filter. You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the * and ? characters when entering a mask.
Finish the Wizard by clicking OK.
The application will be added to the trust group.
In the left part of the window, select the relevant application.
In the right part of the window, in the drop-down list, do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select Files and system registry.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select Rights.
Network activity of applications is controlled by the Firewall using network rules.
For the relevant resource, in the column of the corresponding action, select the necessary option: Inherit, Allow (), or Forbid ().
If you want to monitor the use of computer resources, select Log events ( / ).
Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
Save your changes.

How to change application rights in the application interface

In the main application window, click the button .
In the application settings window, select Advanced Threat Protection → Host Intrusion Prevention.
Click the Manage applications button.
This opens the list of installed applications.
Select the necessary application.
In the context menu of the application, select Details and rules.
This opens the application properties.
Do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select the Files and system registry tab.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select the Rights tab.
For the relevant resource, in the column of the corresponding action, right-click to open the context menu and select the necessary option: Inherit, Allow (), or Forbid ().
If you want to monitor the use of computer resources, select Log events ().
Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
Select the Exclusions tab and configure the advanced settings of the application (see the table below).

Save your changes.

Advanced Settings of the application

Parameter	Description
Do not scan opened files	All files that are opened by the application are excluded from scans by Kaspersky Endpoint Security. For example, if you are using applications to back up files, this feature helps reduce the consumption of resources by Kaspersky Endpoint Security.
Do not monitor application activity	Kaspersky Endpoint Security will not monitor the application's file- and network activity in the operating system. Application activity is monitored by the following components: Behavior Detection, Exploit Prevention, Host Intrusion Prevention, Remediation Engine and Firewall.
Do not inherit restrictions of the parent process (application)	The restrictions configured for the parent process will not be applied by Kaspersky Endpoint Security to a child process. The parent process is started by an application for which application rights (Host Intrusion Prevention) and application network rules (Firewall) are configured.
Do not monitor child application activity	Kaspersky Endpoint Security will not monitor the file activity or network activity of applications that are started by this application.
Allow interaction with the application interface	Kaspersky Endpoint Security Self-Defense blocks all attempts to manage application services from a remote computer. If the check box is selected, the remote access application is allowed to manage Kaspersky Endpoint Security settings through the Kaspersky Endpoint Security interface.
Do not scan encrypted traffic / Do not scan all traffic	Network traffic initiated by the application will be excluded from scans by Kaspersky Endpoint Security. You can exclude either all traffic or only encrypted traffic from scans. You can also exclude individual IP addresses and port numbers from scans.

Article ID: 39278, Last review: Jul 20, 2023

Page top