{"id":7993,"date":"2026-10-15T16:27:31","date_gmt":"2026-10-15T13:27:31","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&#038;p=7993"},"modified":"2026-10-15T16:27:31","modified_gmt":"2026-10-15T13:27:31","slug":"why-does-elements-application-control-not-block-an-application-even-if-global-rule-is-set-as-block-all-untrusted-applications","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/why-does-elements-application-control-not-block-an-application-even-if-global-rule-is-set-as-block-all-untrusted-applications\/","title":{"rendered":"Why does Elements Application Control not block an application, even if Global rule is set as Block all untrusted applications"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>Why does Elements Endpoint Protection Application Control\u00a0 feature not block an application, even if Global rule is set as &quot;Block all untrusted applications&quot;.\u00a0<\/p>\n<p>How to know which applications are allowed by the Application Control feature when Global rule is set as &quot;Block all untrusted applications&quot;<\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p>In case you set the Elements Endpoint Protection Application Control Global rule is to &quot;Block all untrusted applications&quot;, Application Control will allow applications to run if they:<\/p>\n<ul>\n<li>Are running from SYSTEM account<\/li>\n<li>Have a target prevalence greater than 40 and reputation less than 9<\/li>\n<li>Application is a known clean application and trusted signed application<\/li>\n<li>Application has an explicit allow rule created for it<\/li>\n<\/ul>\n<p>Here is an explanation of the target prevalence and reputation values:<\/p>\n<h3>Reputation properties<\/h3>\n<div>Reputation properties can have the following values:<\/p>\n<div>\n<div>\n<table style=\"width: 670px;\">\n<colgroup>\n<col><\/col>\n<col><\/col>\n<col><\/col>\n<\/colgroup>\n<thead>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">Range<\/th>\n<th colspan=\"1\" rowspan=\"1\">Type<\/th>\n<th colspan=\"1\" rowspan=\"1\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">0-9<\/td>\n<td colspan=\"1\" rowspan=\"1\">CLEAN<\/td>\n<td colspan=\"1\" rowspan=\"1\">Known clean. Allow everything.<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">10-79<\/td>\n<td colspan=\"1\" rowspan=\"1\">PROMPT<\/td>\n<td colspan=\"1\" rowspan=\"1\">Suspicious or potential unwanted (PUA) or Riskware. Prompt the action from the local user.<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">80-89<\/td>\n<td colspan=\"1\" rowspan=\"1\">UNWANTED<\/td>\n<td colspan=\"1\" rowspan=\"1\">Unwanted Application. Automatic quarantine with option to exclude.<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">90-100<\/td>\n<td colspan=\"1\" rowspan=\"1\">BLOCK<\/td>\n<td colspan=\"1\" rowspan=\"1\">Known malicious. Block all actions.<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">101-999<\/td>\n<td colspan=\"1\" rowspan=\"1\">UNKNOWN<\/td>\n<td colspan=\"1\" rowspan=\"1\">Make a local decision. This is the default also when there is no response (empty response).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<h3>Prevalence property<\/h3>\n<div>Prevalence property can have the following values:<\/p>\n<div>\n<div>\n<table style=\"width: 670px;\">\n<colgroup>\n<col><\/col>\n<col><\/col>\n<\/colgroup>\n<thead>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">Value<\/th>\n<th colspan=\"1\" rowspan=\"1\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">0<\/td>\n<td colspan=\"1\" rowspan=\"1\">Undefined or not known. This is the default also when no response or if this flag is missing.<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">1<\/td>\n<td colspan=\"1\" rowspan=\"1\">Unique file (3 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">10<\/td>\n<td colspan=\"1\" rowspan=\"1\">Very rare file (10 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">20<\/td>\n<td colspan=\"1\" rowspan=\"1\">Quite rare file (100 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">30<\/td>\n<td colspan=\"1\" rowspan=\"1\">Rare file (1000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">40<\/td>\n<td colspan=\"1\" rowspan=\"1\">Unusual file (10 000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">50<\/td>\n<td colspan=\"1\" rowspan=\"1\">Semi-common file (100 000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">60<\/td>\n<td colspan=\"1\" rowspan=\"1\">Common file (1 000 000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">70<\/td>\n<td colspan=\"1\" rowspan=\"1\">Common file (10 000 000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">80<\/td>\n<td colspan=\"1\" rowspan=\"1\">A very common file (100 000 000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">90<\/td>\n<td colspan=\"1\" rowspan=\"1\">A very very common file (1 000 000 000 or less hits)<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">100<\/td>\n<td colspan=\"1\" rowspan=\"1\">Everybody basically has this (10 000 000 000 or less hits)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<p>We recommend to change the Global rule\u00a0 to &quot;Allow and monitor all applications&quot; to monitor the situation at first, and slowly creating new Application Control rule(s) to allow the application running in your environment.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Why does Elements Endpoint Protection Application Control\u00a0 feature not block an application, even if Global rule is set as \u00ab\u00a0Block all untrusted applications\u00a0\u00bb.\u00a0<\/p>\n<p>How to know which applications are allowed by the Application Control feature when Global rule is set as \u00ab\u00a0Block all untrusted applications\u00a0\u00bb<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-7993","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005666","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-15 13:27:31","import_hash":"c31e1f7b2266d6c72ad00148cf23813a06afb3d3","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/7993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=7993"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=7993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}