Managing Application Policies

Within this field, enter the Policy Name for the new policy you are creating. This is a mandatory field as denoted by the * beside ‘Policy Name’. 

Enter a brief description of the policy here, if desired, to help you keep track of your policies and what they do.  

By default, the ‘Policy Active’ switch will be turned on. This can be switched to the off position to turn the policy off, rendering it inactive until the switch is flipped on. This allows you to create policies that might not be needed until a later date, or to turn off policies after they are no longer needed without deleting the policy. 

By default, ‘Add Policy to Top’ is selected, which places new policies at the top of the list. They will be run before other Policies. Policies can be reordered up or down the list after creation by changing their number. If you wish the Policy to be placed at the bottom of the list, select ‘Add Policy to Bottom’ instead of the default selection chosen. 

By default, all Application executions are logged in the Unified Audit. For permit policies, if you do not wish to log when an Application is executed, you can de-select the ‘Log in the Unified Audit’ button. 

Here, you can select which computer or group this policy will apply to. Depending on your needs, you can apply it to the Entire Organization, Globally, or to any computer group or workstation within the organization. 

While Application Policies are applied to a computer, computer group, or organization, it is also possible to only apply the Policy to certain logged-in users by inputting the name as DOMAIN\USERNAME. (e.g. you may want to permit iTunes for the C.E.O. only). Though not required, if you are using the Active Directory Sync tool, you can select the option ‘Selected Users & Groups’ and select Active Directory groups from this dropdown list. For more information about applying Policies to users or groups, see Applying Policies to Users or Active Directory Groups. 

Add the Applications that you want to permit or deny under ‘Selected Applications’. Applications are lists of file hashes, signatures, or other patterns. You can use pre-defined Applications that are created by ThreatLocker, or you can create your own Applications. (See Managing Application Definitions). Alternatively, you can select ‘All Applications’, which will apply to every Application that can be requested. ThreatLocker does not recommend setting a permit policy to apply to ‘All Applications’ as this is a security risk, permitting any application to run in your environment. The ‘All Applications’ option is provided to create your own Default Deny Policy. 

By default, ‘All Interfaces’ will be selected, but sometimes you will have a need for other interfaces. Selecting ‘Selected Interface’ will allow you to select from the following list of interfaces:

Here, you can set the policy expiration. By default, ThreatLocker will not apply a policy expiration. You can select from ‘Set Policy Expiration’, which will provide you with a calendar to select the date and time that the policy will expire by. This is useful for users that require limited use of an application. Additionally, you can select ‘Schedule Policy’, which will apply the policy during the days and times that are specified by you. 

Here, select whether you would like this policy to be permitted or denied. You can additionally select ‘Permit with Ringfence’. Ringfencing™ allows you to control how an Application can interact with other Applications, files, the registry, and network locations. For more information, see Ringfencing | ThreatLocker Help Center. Choosing the ‘Permit with Ringfence’ option will give you the following options: 

Selecting the ‘Assist with programs that require local administrator privileges’ will give you the option to apply Elevation to this policy. 

Selecting ‘Elevate to run as local administrator will allow the specified Application to run with administrator privileges. You can select the ‘Notify User’ checkbox as well to generate a popup on the user’s end, letting them know that elevation has been granted. 

The slider bar shown here will allow you to choose how long this application will be elevated for. 

The ‘Show Notification and Allow User to Request’ switch will permit ThreatLocker to send a notification to the user when an application is blocked. The user will have the option to send up an Application Request. 

Turning the ‘Email/SMS Administrator on Request’ switch on will allow you to insert Administrator names and phone numbers to send notifications if a user requests access related to the policy. Input the email address into the field. If inputting a cell number, enter the number prefixed with ‘sms:’ (e.g. sms:5556661234).