Support articles
Find clear, step-by-step solutions to common WithSecure issues across installation, configuration, updates, and product performance.
Why does Elements Application Control not block an application, even if Global rule is set as Block all untrusted applications
Last updated
Issue:
Why does Elements Endpoint Protection Application Control feature not block an application, even if Global rule is set as "Block all untrusted applications".
How to know which applications are allowed by the Application Control feature when Global rule is set as "Block all untrusted applications"
Resolution:
In case you set the Elements Endpoint Protection Application Control Global rule is to "Block all untrusted applications", Application Control will allow applications to run if they:
- Are running from SYSTEM account
- Have a target prevalence greater than 40 and reputation less than 9
- Application is a known clean application and trusted signed application
- Application has an explicit allow rule created for it
Here is an explanation of the target prevalence and reputation values:
Reputation properties
| Range | Type | Meaning |
|---|---|---|
| 0-9 | CLEAN | Known clean. Allow everything. |
| 10-79 | PROMPT | Suspicious or potential unwanted (PUA) or Riskware. Prompt the action from the local user. |
| 80-89 | UNWANTED | Unwanted Application. Automatic quarantine with option to exclude. |
| 90-100 | BLOCK | Known malicious. Block all actions. |
| 101-999 | UNKNOWN | Make a local decision. This is the default also when there is no response (empty response). |
Prevalence property
| Value | Meaning |
|---|---|
| 0 | Undefined or not known. This is the default also when no response or if this flag is missing. |
| 1 | Unique file (3 or less hits) |
| 10 | Very rare file (10 or less hits) |
| 20 | Quite rare file (100 or less hits) |
| 30 | Rare file (1000 or less hits) |
| 40 | Unusual file (10 000 or less hits) |
| 50 | Semi-common file (100 000 or less hits) |
| 60 | Common file (1 000 000 or less hits) |
| 70 | Common file (10 000 000 or less hits) |
| 80 | A very common file (100 000 000 or less hits) |
| 90 | A very very common file (1 000 000 000 or less hits) |
| 100 | Everybody basically has this (10 000 000 000 or less hits) |
We recommend to change the Global rule to "Allow and monitor all applications" to monitor the situation at first, and slowly creating new Application Control rule(s) to allow the application running in your environment.