Application Control Monitor Only Appearing When Dotnet DLL Options are Enabled

ThreatLocker provides users with four different Dotnet DLL Options that can be applied to your organization/group/machine:

• DotnetDllLearnComputer
• DotnetDllLearnGroup
• DotnetDllLearnSystem
• DotnetDllMonitorOnly

These Options work and help limit unintended .dll blocks by learning or monitoring .dll extensions and logging the behaviors in the Unified Audit. Due to how these Options work, enabling them for an organization/group/machine will cause Unified Audit logs for affected computers to show that the machine is in Application Control Monitor Only mode, even if it is in a secured state.

The Application Control Monitor Only mode will only be applicable to Dotnet DLLs. All other file activity will be enforced according to policy settings. You can verify that the machine is secured by selecting the 'Asset Name' shown in the Unified Audit log. Selecting this will open the asset's Computer Details page, showing if the machine is in Secured Mode.