{"id":4505,"date":"2026-06-09T12:22:57","date_gmt":"2026-06-09T09:22:57","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=4505"},"modified":"2026-06-09T12:22:57","modified_gmt":"2026-06-09T09:22:57","slug":"client-security-or-server-security-tamper-protection-generates-access-to-file-was-blocked-alert","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/de\/support-articles\/client-security-or-server-security-tamper-protection-generates-access-to-file-was-blocked-alert\/","title":{"rendered":"Client Security or Server Security Tamper Protection generates „Access to file was blocked“ alert"},"content":{"rendered":"

Issue:<\/h3>\n

Why do Client Security and Server Security host devices send the following alert to the Policy Manager Consoler Alerts<\/b>\u00a0tab?<\/p>\n

Access to file was blocked.
Application path:\u00a0C:Example\\Example.exe<\/a>
Path: C:\\ProgramData\\Example\\Example\\<\/p>\n

Resolution:<\/h3>\n

This type of block is the function of the Tamper Protection functionality. The alerts you are seeing are expected behaviour and not a cause for alarm.<\/p>\n

Tamper protection functionality sees that some process tries to open a protected file with write access rights. Tamper protection blocks this operation, so the application gets ACCESS_DENIED error. Importantly, this block does not affect the normal operation of either third party application or Client Security itself, it is a cosmetic alert.<\/p>\n

To stop the flood of alerts without reducing your protection level, you can create an alert sending exclusion in Policy Manager Console for that specific alert type:<\/p>\n

    \n
  1. Log in to Policy Manager Console<\/li>\n
  2. Select a host or policy domain from the Domain Tree<\/li>\n
  3. Go to the\u00a0Settings<\/b>\u00a0tab<\/li>\n
  4. Go to the\u00a0Alert sending<\/b>\u00a0page<\/li>\n
  5. Scroll down to the Alert sending exclusions list and click\u00a0Add<\/b><\/li>\n
  6. Select\u00a0Source\u00a0<\/b>as\u00a0Tamper protection<\/b><\/li>\n
  7. Select the Type<\/b>, Action <\/strong>and Alert <\/strong>shown in the security event<\/li>\n
  8. Click\u00a0OK\u00a0<\/b>to finish adding rule<\/li>\n
  9. Distribute policy (Ctrl + D)<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    Why do Client Security and Server Security host devices send the following alert to the Policy Manager Consoler Alerts tab?<\/p>\n

    Access to file was blocked.
    \nApplication path: C:Example\\Example.exe
    \nPath: C:\\ProgramData\\Example\\Example\\<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4505","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000009911","source_version":1,"source_system":"salesforce","source_date_updated":"2026-06-09 09:22:57","import_hash":"a80271a78b56c309a8ee4262918bce6a22378b1a","vanilla_article_id":33008,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/33008-client-security-or-server-security-tamper-protection-generates-access-to-file-was-blocked-alert","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article\/4505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/media?parent=4505"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/de\/wp-json\/wp\/v2\/support_article_product?post=4505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}