{"id":4087,"date":"2026-06-08T18:01:50","date_gmt":"2026-06-08T15:01:50","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4087"},"modified":"2026-06-08T18:01:50","modified_gmt":"2026-06-08T15:01:50","slug":"the-application-control-rule-block-rare-and-unknown-files-in-temp-folder-or-block-rare-and-unknown-files-in-downloads-folder-in-the-elements-endpoint-protection-client-block-an-application-from-ru","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/de\/support-articles\/the-application-control-rule-block-rare-and-unknown-files-in-temp-folder-or-block-rare-and-unknown-files-in-downloads-folder-in-the-elements-endpoint-protection-client-block-an-application-from-ru\/","title":{"rendered":"The Application Control rule &#8222;Block rare and unknown files in Temp folder&#8220; or &#8222;Block rare and unknown files in Downloads folder&#8220; in the Elements Endpoint Protection client block an application from running"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>The Application Control rule &quot;Block rare and unknown files in Temp folder&quot; or &quot;Block rare and unknown files in Downloads folder&quot; in the Elements Endpoint Protection client (Elements EPP for Computers or Elements EPP for Servers) block an application from running.<\/p>\n<p>How can we create an Application Control exclusion to allow the application to run?<\/p>\n<h3>Resolution:<\/h3>\n<p>The Application Control exclusion can be created using several different conditions. To view the details of the application or file which was blocked:<\/p>\n<ol>\n<li>Log in to the <strong>Elements Security Center<\/strong><\/li>\n<li>Navigate to <strong>Events &gt; Security Events<\/strong><\/li>\n<li>Click the arrow on the left of the corresponding\u00a0security event to view the details.<\/li>\n<\/ol>\n<p>From here, you can easily copy details such as the <strong>Target Product Name<\/strong>, <strong>Target Signature Signer Name<\/strong>, etc., of the blocked file.<\/p>\n<p>Once you have the details of the blocked file, you can create an Application Control exclusion.<\/p>\n<ol>\n<li>Navigate to <strong>Security Configurations<\/strong> &gt; <strong>Profiles<\/strong>.<\/li>\n<li>Select the profile that you want to edit.<\/li>\n<li>Go to the <strong>Application Control<\/strong> settings.<\/li>\n<li>Click\u00a0<b>Add a new top rule<\/b><\/li>\n<li>Select <strong>Application start and module load<\/strong> from the <strong>Event<\/strong> drop-down menu and <strong>Allow<\/strong> from the <strong>Action<\/strong> drop-down menu.<\/li>\n<li>Define the condition(s) accordingly, such as:\n<ul>\n<li><strong>Target signer name<\/strong> &gt; <strong>is equal to<\/strong> &gt; <strong>Target signature signer name<\/strong> (copied from the corresponding security event details), or<\/li>\n<li><strong>Target Path<\/strong> &gt; <strong>is equal to<\/strong> &gt; <strong>Target path<\/strong> (copied from the corresponding security event details), etc.<\/li>\n<\/ul>\n<\/li>\n<li>Click\u00a0<b>Save profile<\/b><\/li>\n<\/ol>\n<p>In step 6, you can also use any other condition that suits your needs. You do not have to use the <strong>Target signer name<\/strong>, or <strong>Target Path<\/strong>. <strong>Target product name<\/strong>, <strong>Target company<\/strong>, etc. are other conditions that could be used in this situation. All of these can be found from the block detection on the <strong>Security Events<\/strong> page.<\/p>\n<p>Additionally, ensure that the newly created whitelisting rule is moved to the top, so it stays above the blocking rule. Application Control processes rules from top to bottom.<\/p>\n<p>If necessary, you can refer to the product help guide for more information: <a href=\"https:\/\/support.withsecure.com\/userguides\/product.html#business\/psb-portal\/latest\/en\/task_D5DDA11EBAE543F0977322A363DE879D-psb-portal-latest-en\" target=\"_blank\">Adding application control rules | Elements Endpoint Protection | Latest | WithSecure User Guides<\/a>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Application Control rules &#8222;Block rare and unknown files in Temp folder&#8220; or &#8222;Block rare and unknown files in Downloads folder&#8220; in the Elements Endpoint Protection client (Elements EPP for Computers or Elements EPP for Servers) block an application from running.<\/p>\n<p>How can we create an Application Control exclusion to allow the application to run?<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4087","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013902","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:01:50","import_hash":"8fc9cbe59440528907faa6106e59af531124e12d","vanilla_article_id":32299,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32299-the-application-control-rule-block-rare-and-unknown-files-in-temp-folder-or-block-rare-and-unknown-files-in-downloads-folder-in-the-elements-endpoint-protection-client-block-an-application-from-ru","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article\/4087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/media?parent=4087"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article_product?post=4087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}