Help CenterIf the ThreatLocker popup is not displaying when an item is blocked, there could be a number of reasons. This document goes through the possible reasons why the popup is not showing.
The ThreatLocker Tray is not Started
ThreatLocker uses a tray application to notify the user when something is blocked. The tray application automatically starts when the computer logs in. If you have just installed ThreatLocker using an RMM or MSI installer, the tray will not start until you have logged out and logged back in again.
To check to see if the ThreatLocker tray is running, you can view the system tray for the ThreatLocker icon, or you can open Windows Task Manager and verify that you can see ThreatLockerTray.exe in the list of running processes.
The Policy is Configured not to show the User the Option to Request Permission.
-
Log into the ThreatLocker Portal
-
Navigate to the Unified Audit
-
Search for the file that is being blocked. You can use wildcards in the search box, e.g., *putty*
-
Select the denied item to open the popout window
-
Verify that the Option to Request label is on the item
If you do not see the Option to Request label, select the Policy name to review the Policy settings.
-
On the Edit Application Policy page, navigate to the bottom of the page where it says End User Experience. Confirm that the switch labeled Show Notification and Allow User to Request is enabled.
The item is being blocked for a different user, e.g., NT AUTHORITY\SYSTEM
-
Log into the ThreatLocker Portal
-
Open the Unified Audit
-
Search for the file that is being blocked. You can use wildcards in the search box, e.g., *putty*
-
Expand the denied item
-
Verify that the username matches the logged-in user
