{"id":4392,"date":"2026-06-08T17:53:00","date_gmt":"2026-06-08T14:53:00","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4392"},"modified":"2026-06-08T17:53:00","modified_gmt":"2026-06-08T14:53:00","slug":"elements-endpoint-protection-dataguard-feature-blocks-windows-processes-and-applications-installed-in-the-windows-users-or-appdata-folder","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/elements-endpoint-protection-dataguard-feature-blocks-windows-processes-and-applications-installed-in-the-windows-users-or-appdata-folder\/","title":{"rendered":"Elements Endpoint Protection &#8211; DataGuard feature blocks Windows processes and applications installed in the Windows Users or AppData folder"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>When the DataGuard features <b>Access control<\/b> and <b>Discover trusted applications automatically <\/b>are<b>\u00a0<\/b>enabled for Elements EPP for Computers\/Servers, DataGuard blocks Windows processes and applications installed in the Windows <b>Users<\/b>,\u00a0<b>AppData<\/b>\u00a0or <b>System32<\/b>\u00a0folder.<\/p>\n<p>The\u00a0<b>Security Events <\/b>tab in the Elements Security Center shows an alert with the <b>Source<\/b> as\u00a0<b>DataGuard\u00a0<\/b>and the <b>Description<\/b> &quot;<strong>DataGuard has blocked an attempt to access<\/strong>&quot;<\/p>\n<p>Elements Agent <b>Event History<\/b> on the device shows &quot;Application was blocked from accessing your files&quot; and the <b>Reason<\/b> as <strong>Ransomware:AccessControl<\/strong>.<br \/>\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p>If the blocked application (OneDrive.exe, Firefox.exe, Chrome.exe, WhatsApp.exe etc.) is in the Windows <b>Users<\/b> or <b>AppData<\/b> directory, it is not by default a trusted application location and therefore it will be blocked if it tries to modify a file that is located in a protected path. You can view the currently trusted application paths in the Elements Security Center:<\/p>\n<ol>\n<li>Select <strong>Environment <\/strong>from the left side bar<\/li>\n<li>Go to the <strong>Devices <\/strong>page<\/li>\n<li>Click the\u00a0device that has DataGuard enabled<\/li>\n<li>Under the <strong>Protection status<\/strong> tab, click on the <strong>DataGuard (Premium)<\/strong> section<\/li>\n<\/ol>\n<p>This will show you the currently protected paths and the currently trusted application paths.<\/p>\n<p>To prevent DataGuard from blocking an application, you can either:<\/p>\n<ul>\n<li>Install the application to a trusted path, such as C:\\Program Files (x86)\\<\/li>\n<li>Add the application path to the\u00a0<b>Manually added trusted applications and folders\u00a0<\/b>list<\/li>\n<\/ul>\n<p>How to add the application path to the <b>Manually added trusted applications and folders\u00a0<\/b>list in the Elements Security Center:<\/p>\n<ol>\n<li>Select <strong>Security Configurations\u00a0<\/strong>from the left side bar<\/li>\n<li>Go to the <b>Profiles<\/b> page<\/li>\n<li>Select the profile the device is using<\/li>\n<li>Go to the <b>DataGuard<\/b> settings page<\/li>\n<li>In the <b>Access Control<\/b>\u00a0section, click <b>Add path\u00a0<\/b>below\u00a0<b>Manually added trusted applications and folders<\/b><\/li>\n<li>Add the full path of the application, example C:\\Users\\Username\\Documents\\exampleprogram\\example.exe<\/li>\n<li>Click\u00a0<b>Save and publish<\/b> the profile<\/li>\n<\/ol>\n<p><b>Note:<\/b> \u00a0You can use system environment variables when you want to create an exclusion for many users. The supported environment variables are: %USERPROFILE%, %HOMEDRIVE%, %HOMEPATH%, %APPDATA%, %ProgramFIles%, %ProgramFiles(x86)% %ProgramData%, %windir%, %SystemRoot%, %SystemDrive%<\/p>\n<p>Example: %USERPROFILE%\\AppData\\Local\\Mozilla Firefox\\firefox.exe<\/p>\n<p>If you need to find out more about the detection (detection path, target path etc.), you can view it from the\u00a0<b>Security events\u00a0<\/b>page in the Elements Security Center:<\/p>\n<ol>\n<li>Select <strong>Events<\/strong> from the left side bar<\/li>\n<li>Go to the\u00a0<b>Security Events\u00a0<\/b>page<\/li>\n<li>Click on the arrow on the left side of the DataGuard detection<\/li>\n<\/ol>\n<p>From the <b>Security Events<\/b> page you can also add the application to the\u00a0<b>Manually added trusted applications and folders<\/b>\u00a0list:<\/p>\n<ol>\n<li>Click on the <b>Three dots<\/b> on the right side of the DataGuard detection<\/li>\n<li>Select <b>Add the application to the Dataguard&#39;s trusted list<\/b><\/li>\n<li>Click <b>Save and publish<\/b><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>With the Dataguard features Access control and Discover trusted applications automatically enabled in Elements Endpoint Protection, DataGuard blocks Windows processes and the application installed to the user directory.<\/p>\n<p>The Elements Security Center device\u00a0Infections\u00a0list shows a\u00a0Ransomware:AccessControl alert.<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4392","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000011680","source_version":8,"source_system":"salesforce","source_date_updated":"2026-06-08 14:53:00","import_hash":"ce6c74a84e1b5d8fd00c1572afadc702bd208cb1","vanilla_article_id":29733,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29733-elements-endpoint-protection-dataguard-feature-blocks-windows-processes-and-applications-installed-in-the-windows-users-or-appdata-folder","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4392"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}