Help CenterIf the ThreatLocker popup is not displaying when an item is blocked, there could be a number of reasons. This document goes through the possible reasons why the popup is not showing.
The ThreatLocker Tray is not Started
ThreatLocker uses a tray application to notify the user when something is blocked. The tray application automatically starts when the computer logs in. If you have just installed ThreatLocker using an RMM or MSI installer, the tray will not start until you have logged out and logged back in again.
To check to see if the ThreatLocker tray is running, you can view the system tray for the ThreatLocker icon, or you can open Windows Task Manager and verify that you can see ThreatLockerTray.exe in the list of running processes.
The Policy is Configured not to show the User the Option to Request Permission.
- Log into the ThreatLocker Portal
- Open the Unified Audit
- Search for the file that is being blocked. You can use wildcards in the search box, e.g., *putty*
- Expand the denied item
- Verify if the Option to Request label is on the item
If you do not see the Option to Request label, click on the Policy name to review the Policy settings.
- On the Edit Policy page, make sure that 'Yes' is selected under "Do you want to allow the user to request access?"
The item is being blocked for a different user, e.g., NT AUTHORITY\SYSTEM
- Log into the ThreatLocker Portal
- Open the Unified Audit
- Search for the file that is being blocked. You can use wildcards in the search box, e.g., *putty*
- Expand the denied item
- Verify that the username matches the logged-in user
