Reply to thread

Message

<blockquote data-quote="shmu26" data-source="post: 701103" data-attributes="member: 37647">Hi, the prompt that you took screenshot of is not the one I was talking about. Child programs is a different thing. In a prompt like this, usually the best choice is &quot;inspect children&quot;. But if it is a very safe program, and &quot;inspect children&quot; leads to too many prompts, then just choose &quot;allow&quot;. About expert mode:1 by default, you will not be able to double click Word files etc that are in real user space, but you can allow it, if you wish, by modifying the settings.2 trusted publishers list is ignored, so you can expect a lot of prompts, and get ready to edit your rules with wildcards.3 An additional tweak&nbsp; is to enable lockdown when there is no GUI. This way, anything new is blocked by the ReHIPS service, which starts quickly after system reboot, and this blocking continues until the GUI loads, at which point you will start to get prompts instead of blocks. About learning mode:I enable it, and I go through a couple reboots, and signing in and out of my various user accounts, to make sure nothing is being blocked in the boot process. Other users who are more paranoid than me don&#039;t like learning mode, because you can&#039;t be sure what you are whitelisting.</blockquote>

[QUOTE="shmu26, post: 701103, member: 37647"] Hi, the prompt that you took screenshot of is not the one I was talking about. Child programs is a different thing. In a prompt like this, usually the best choice is "inspect children". But if it is a very safe program, and "inspect children" leads to too many prompts, then just choose "allow". About expert mode: 1 by default, you will not be able to double click Word files etc that are in real user space, but you can allow it, if you wish, by modifying the settings. 2 trusted publishers list is ignored, so you can expect a lot of prompts, and get ready to edit your rules with wildcards. 3 An additional tweak is to enable lockdown when there is no GUI. This way, anything new is blocked by the ReHIPS service, which starts quickly after system reboot, and this blocking continues until the GUI loads, at which point you will start to get prompts instead of blocks. About learning mode: I enable it, and I go through a couple reboots, and signing in and out of my various user accounts, to make sure nothing is being blocked in the boot process. Other users who are more paranoid than me don't like learning mode, because you can't be sure what you are whitelisting. [/QUOTE]

Verification