By default, application activity is controlled based on the application rights that are defined for the specific trust group that Kaspersky Endpoint Security assigned to the application when it started for the first time. If necessary, you can edit the application rights for an entire trust group, for an individual application, or for a group of applications within a trust group.
Manually defined application rights have a higher priority than application rights that were defined for a trust group. In other words, if manually defined application rights differ from the application rights defined for a trust group, the Host Intrusion Prevention component controls application activity according to the manually defined application rights.
The rules that you create for applications are inherited by child applications. For example, if you deny all network activity for cmd.exe, all network activity will also be denied for notepad.exe if it is started using cmd.exe. When an application is not a child of the application it runs from, rules are not inherited.
How to change application rights in the Administration Console (MMC)
This opens the application rights configuration window and the list of protected resources.
You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the *
and ?
characters when entering a mask.
Kaspersky Endpoint Security will search for the application in the consolidated list of applications installed on managed computers. Kaspersky Endpoint Security will show a list of applications that satisfy your search criteria.
The application will be added to the default group.
This opens the application properties.
Network activity of applications is controlled by the Firewall using network rules.
Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
How to change application rights in the Web Console and Cloud Console
The policy properties window opens.
This opens the application rights configuration window and the list of protected resources.
You will see a list of trust groups on the left side of the window and their properties on the right side.
This starts the Wizard for adding an application to a trust group.
If you want to change the trust group for multiple applications, select the Group type and define a name for the application group.
Use a filter. You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the *
and ?
characters when entering a mask.
The application will be added to the trust group.
Network activity of applications is controlled by the Firewall using network rules.
Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
How to change application rights in the application interface
This opens the list of installed applications.
This opens the application properties.
Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
Advanced Settings of the application
Parameter |
Description |
---|---|
Do not scan opened files |
All files that are opened by the application are excluded from scans by Kaspersky Endpoint Security. For example, if you are using applications to back up files, this feature helps reduce the consumption of resources by Kaspersky Endpoint Security. |
Do not monitor application activity |
Kaspersky Endpoint Security will not monitor the application's file- and network activity in the operating system. Application activity is monitored by the following components: Behavior Detection, Exploit Prevention, Host Intrusion Prevention, Remediation Engine and Firewall. |
Do not inherit restrictions of the parent process (application) |
The restrictions configured for the parent process will not be applied by Kaspersky Endpoint Security to a child process. The parent process is started by an application for which application rights (Host Intrusion Prevention) and application network rules (Firewall) are configured. |
Do not monitor child application activity |
Kaspersky Endpoint Security will not monitor the file activity or network activity of applications that are started by this application. |
Allow interaction with the application interface |
Kaspersky Endpoint Security Self-Defense blocks all attempts to manage application services from a remote computer. If the check box is selected, the remote access application is allowed to manage Kaspersky Endpoint Security settings through the Kaspersky Endpoint Security interface. |
Do not scan encrypted traffic / Do not scan all traffic |
Network traffic initiated by the application will be excluded from scans by Kaspersky Endpoint Security. You can exclude either all traffic or only encrypted traffic from scans. You can also exclude individual IP addresses and port numbers from scans. |