Managing application rights
By default, application activity is controlled based on the application rights that are defined for the specific trust group that Kaspersky Endpoint Security assigned to the application when it started for the first time. If necessary, you can edit the application rights for an entire trust group, for an individual application, or for a group of applications within a trust group.
Manually defined application rights have a higher priority than application rights that were defined for a trust group. In other words, if manually defined application rights differ from the application rights defined for a trust group, the Host Intrusion Prevention component controls application activity according to the manually defined application rights.
The rules that you create for applications are inherited by child applications. For example, if you deny all network activity for cmd.exe, all network activity will also be denied for notepad.exe if it is started using cmd.exe. When an application is not a child of the application it runs from, rules are not inherited.
How to change application rights in the Administration Console (MMC)
- Open the Kaspersky Security Center Administration Console.
- In the console tree, select Policies.
- Select the necessary policy and double-click to open the policy properties.
- In the policy window, select Advanced Threat Protection → Host Intrusion Prevention.
Intrusion Prevention settings
- In the Application rights and protected resources block, click the Settings button.
This opens the application rights configuration window and the list of protected resources.
- Select the Application rights tab.
- Click Add.
- In the window that opens, enter criteria to search for the application whose application rights you want to change.
You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the
*and?characters when entering a mask. - Click Refresh.
Kaspersky Endpoint Security will search for the application in the consolidated list of applications installed on managed computers. Kaspersky Endpoint Security will show a list of applications that satisfy your search criteria.
- Select the necessary application.
- In the Add selected application to the trust group drop-down list, select Default groups and click OK.
The application will be added to the default group.
- Select the relevant application and then select Application rights from the context menu of the application.
This opens the application properties.
- Do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select the Files and system registry tab.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select the Rights tab.
Network activity of applications is controlled by the Firewall using network rules.
- For the relevant resource, in the column of the corresponding action, right-click to open the context menu and select the necessary option: Inherit, Allow (
) or Block (
). - If you want to monitor the use of computer resources, select Log events (
/ 
).Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
- Save your changes.
How to change application rights in the Web Console and Cloud Console
- In the main window of the Web Console, select Devices → Policies & profiles.
- Click the name of the Kaspersky Endpoint Security policy.
The policy properties window opens.
- Select the Application settings tab.
- Go to Advanced Threat Protection → Host Intrusion Prevention.
Intrusion Prevention settings
- In the Application rights and protected resources block, click the Application rights and protected resources link.
This opens the application rights configuration window and the list of protected resources.
- Select the Application rights tab.
You will see a list of trust groups on the left side of the window and their properties on the right side.
- Click Add.
This starts the Wizard for adding an application to a trust group.
- Select the relevant trust group for the application.
- Select the Application type. Go to the next step.
If you want to change the trust group for multiple applications, select the Group type and define a name for the application group.
- In the opened list of applications, select the applications whose application rights you want to change.
Use a filter. You can enter the name of the application or the name of the vendor. Kaspersky Endpoint Security supports environment variables and the
*and?characters when entering a mask. - Exit the Wizard.
The application will be added to the trust group.
- In the left part of the window, select the relevant application.
- In the right part of the window, in the drop-down list, do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select Files and system registry.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select Rights.
Network activity of applications is controlled by the Firewall using network rules.
- For the relevant resource, in the column of the corresponding action, select the necessary option: Inherit, Allow (
), Block (
). - If you want to monitor the use of computer resources, select Log events (
/ 
).Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
- Save your changes.
How to change application rights in the application interface
- In the main application window, click the
button. - In the application settings window, select Advanced Threat Protection → Host Intrusion Prevention.
- Click Manage applications.
This opens the list of installed applications.
- Select the necessary application.
- In the context menu of the application, select Details and rules.
This opens the application properties.
- Do one of the following:
- If you want to edit trust group rights that regulate operations with the operating system registry, user files, and application settings, select the Files and system registry tab.
- If you want to edit trust group rights that regulate access to operating system processes and objects, select the Rights tab.
- For the relevant resource, in the column of the corresponding action, right-click to open the context menu and select the necessary option: Inherit, Allow (
) or Deny (
). - If you want to monitor the use of computer resources, select Log events (
).Kaspersky Endpoint Security will record information about the operation of the Host Intrusion Prevention component. Reports contain information about operations with computer resources performed by the application (allowed or forbidden). Reports also contain information about the applications that utilize each resource.
- Select the Exclusions tab and configure the advanced settings of the application (see the table below).
- Save your changes.
Advanced Settings of the application
Parameter
Description
Do not scan files before opening
All files that are opened by the application are excluded from scans by Kaspersky Endpoint Security. For example, if you are using applications to back up files, this feature helps reduce the consumption of resources by Kaspersky Endpoint Security.
Do not monitor application activity
Kaspersky Endpoint Security will not monitor the application's file- and network activity in the operating system. You can configure application activity monitoring for different components of Kaspersky Endpoint Security:
- Do not monitor for protection and control components. Application activity is monitored by the following components: Behavior Detection, Exploit Prevention, Host Intrusion Prevention, Remediation Engine and Firewall.
- Do not monitor for Managed Detection and Response and Endpoint Detection and Response. Application activity is monitored by built-in MDR agent and built-in EDR (KATA) agent.
- Do not intercept console interactive input for Endpoint Detection and Response. Kaspersky Endpoint Security does not send telemetry data about managing the application on the console. Telemetry data is used by Kaspersky Anti Targeted Attack Platform (EDR).
Do not inherit restrictions from the parent process (application)
The restrictions configured for the parent process will not be applied by Kaspersky Endpoint Security to a child process. The parent process is started by an application for which application rights (Host Intrusion Prevention) and application network rules (Firewall) are configured.
Do not monitor child application activity
Kaspersky Endpoint Security will not monitor the file activity or network activity of applications that are started by this application. You can apply the exclusion recursively. So that the application does not monitor the activity of the entire chain of child applications.
Allow interaction with the Kaspersky Endpoint Security interface
Kaspersky Endpoint Security Self-Defense blocks all attempts to manage application services from a remote computer. If the check box is selected, the remote access application is allowed to manage Kaspersky Endpoint Security settings through the Kaspersky Endpoint Security interface.
Do not scan encrypted traffic / Do not scan all traffic
Network traffic initiated by the application will be excluded from scans by Kaspersky Endpoint Security. You can exclude either all traffic or only encrypted traffic from scans. You can also exclude individual IP addresses and port numbers from scans.