Second Look

Beginning with Windows Agent 10.8.3 or greater, Advanced Settings allows users to enable a Second Look check. This Second Look can be used to ensure that legitimate applications that are temporarily blocked are still allowed without disrupting you. A temporary block can occur in instances such as machine reboots, after Microsoft Edge updates, and other similar events. By enabling this feature, instead of blocking the application, ThreatLocker will run a 'Second Look' and confirm whether an application should be permitted without requiring the user to request it.

To enable this 'Second Look' feature, navigate to the 'Advanced Settings' page and, within the 'Create Settings' sidebar, select the 'Second Look' option from the 'Setting Type' dropdown.

Ensure that you select the level to which this Advanced Setting will apply, as well as the 'Order By'.

Once this has been selected, a new switch will become available in the 'Parameters' section titled 'Enable Second Look'. Ensure this switch is turned on, then select the 'Create' button to create your new Advanced Setting.

After selecting 'Create', ensure that you choose the 'Update Agents' button at the top of the page to update ThreatLocker Agents with the added information.