Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 979171" data-attributes="member: 32260">Yes. The concrete information about blocked events can be seen only via SWH Logs. But, in most cases, Windows shows an alert that the file has been blocked by Administrator. For example:1. Alert when the script is blocked.[ATTACH=full]264963[/ATTACH]2. Alert for EXE file packed in the archive or run from email client.[ATTACH=full]264964[/ATTACH]3.Alert for MSI file packed in the archive or run from email client.[ATTACH=full]264967[/ATTACH]4. SmartScreen alert for EXE/MSI&nbsp; files downloaded from the Internet.[ATTACH=full]264970[/ATTACH]If SmartScreen is set to Block:[ATTACH=full]264972[/ATTACH]*************************************************************************************Usually, such alerts are displayed when the user tries to manually open/run the restricted files. There is no option in these alerts that could allow the file (except SmartScreen). If one wants to run/open the blocked file, then it must be whitelisted or the protection temporarily switched off.The silent blocks may occur sometimes when the file (usually non-executable) is going to be opened by the already running process. These blocks are very rare in SWH, they can be more frequent in Hard_Configurator set to Strict_Recommended_Settings.</blockquote>

[QUOTE="Andy Ful, post: 979171, member: 32260"] Yes. The concrete information about blocked events can be seen only via SWH Logs. But, in most cases, Windows shows an alert that the file has been blocked by Administrator. For example: 1. Alert when the script is blocked. [ATTACH type="full" alt="1647344082556.png"]264963[/ATTACH] 2. Alert for EXE file packed in the archive or run from email client. [ATTACH type="full" alt="1647344259509.png"]264964[/ATTACH] 3.Alert for MSI file packed in the archive or run from email client. [ATTACH type="full" alt="1647345768261.png"]264967[/ATTACH] 4. SmartScreen alert for EXE/MSI files downloaded from the Internet. [ATTACH type="full" alt="1647353622708.png"]264970[/ATTACH] If SmartScreen is set to Block: [ATTACH type="full" alt="1647353787675.png"]264972[/ATTACH] ************************************************************************************* Usually, such alerts are displayed when the user tries to manually open/run the restricted files. There is no option in these alerts that could allow the file (except SmartScreen). If one wants to run/open the blocked file, then it must be whitelisted or the protection temporarily switched off. The silent blocks may occur sometimes when the file (usually non-executable) is going to be opened by the already running process. These blocks are very rare in SWH, they can be more frequent in Hard_Configurator set to Strict_Recommended_Settings. [/QUOTE]

Verification