ThreatLocker Application Control Quick Start Guide

However, you may need to create exceptions to prevent your antivirus from blocking ThreatLocker. Please review the following article for the up-to-date exclusions required:

Working with Your Existing Antivirus | ThreatLocker Help Center

Reviewing and Managing your Policies 

After a few days of running ThreatLocker in Learning Mode, we recommend that you review the policies that were automatically created to see if there are any applications you do not want to be permitted. To review automatically created policies:

1. Select the 'Modules' tab dropdown, then 'Application Control' from the left-hand navigation menu. 

2. Change the tab from Applications to Policies utilizing the buttons on the top right portion of the screen. 

3. Change the Applies To dropdown menu to the group you would like to check. This dropdown contains all levels of policies that exist in your organization, including ones for the Entire Organization, Global, Computer Group, and individual machine. In this example, we will be reviewing policies that were permitted for the TESTTL machine. 

You can now review all of the policies that have been created in your organization. This list will also show you the Policy Action, which is a quick way to view if this policy is permitted, denied, ringfenced, or elevated for that group or computer. 

By selecting the individual policy, a popout window will appear labeled 'Edit Application Policy'. This window will allow you to change the parameters of the policy. 

You can change the policy to 'Deny' by changing the 'Actions' from 'Permit' to 'Deny', then selecting 'Save'. 

Alternatively, you can delete the policy by selecting the trashcan icon on the right-hand side of the screen. 

Note: Exercise caution when removing applications that may interact with the kernel. We recommend you uninstall these applications before blocking them. 

Learning Mode will bypass all Application Allowlisting Deny Policies but does not stop our Advanced Ringfencing or Storage Control Polices from protecting your systems. 

Reviewing the Audit 

After you have reviewed your automatic policies that have been created, you can utilize the Unified Audit to review what files are executing and which Policies apply. 

Select 'Unified Audit' from the left-hand menu. 

The Unified Audit displays a list of all Applications and libraries that are executed on your computers. 

From here, you can set filters to simplify use of the Unified Audit. To get the desired parameters, the 'Action Type' has been changed to 'Execute' utilizing the dropdown menu. After this, select the 'Advanced Filter' button located to the right of the 'Search' button. 

Once the 'Advanced Search' popup appears, you can then change the 'Field' dropdown to 'Policy Name' and insert your desired application name into the 'Keyword' space. Select search after this is done. 

You will now be shown a list of audit logs that meets the inserted parameters. 

Permitting Software that was not Automatically Profiled 

ThreatLocker does not automatically profile software in certain folders, such as the Desktop and Downloads folder, or other software that might imitate suspicious software trends. You may permit this software manually from the Unified Audit.

Selecting one of the logs in the Unified Audit will open a popout window. 

From this window, the user is given the option to permit the application. Select the button labeled Permit Application shown at the top of the screen.

Selecting this button will open the Permit Application window. Instructions on how to permit applications from this window can be found in the following article:

Approval Center – Revamped | ThreatLocker Help Center 

Q: What about software that keeps hitting the deny policy after I have permitted it? 

If you find software keeps hitting the default Policy after you have permitted it. It could be that the software is self-updating, not signed and/or not a known Application. We recommend you contact ThreatLocker for assistance to create a restrictive policy that will allow this software to run. 

Securing your Computers 

Once you are satisfied that you have the policies you require, you may take your computers out of Learning Mode and Secure them. This ensures that anything that has not already been permitted is denied. 

To Secure your machine, navigate to the Devices page utilizing the left-hand menu. 

From here, all machines in the organization will be listed. Select the machines you want to put in Secure Mode and then select the Secure Mode button: 

Additionally, you can choose the Select All Checkbox to select all machines at once, then select the Secure Mode Button. 

Confirm if you want to continue with the computers you have selected. 

After selecting 'Yes', your selected machines will now be put into 'Secured Mode'. 

Select the 'Deploy Policies' button after this is done.