Setting up system lockdown

To set up system lockdown, you follow a two-step process:

• In step 1, you monitor the applications that the client computers run.

  In this step, you can track these applications in a list of unapproved applications. The list of unapproved applications includes the applications that clients run but are not listed in the file fingerprint list of approved applications. The client does not block the unapproved applications. You can track the applications that clients use for informational purposes before you block those applications. You can also test whether any applications appear on the unapproved applications list. If a test runs, the status says how long it has been running and whether or not exceptions have occurred. Run system lockdown in test mode long enough to discover which unapproved applications the client computers run. Then enable system lockdown.

  See About system lockdown.

  See System lockdown prerequisites.

• In step 2, you enable system lockdown.

  After you run system lockdown in test mode long enough to see which unapproved applications are run, you enable the following settings:

  Approve the use of those additional applications	Add applications to the list of approved applications, or add the applications to the image where you created the file fingerprint.
  Notify users	You can notify a user that the user no longer has access to a computer. You can also inform the user that the specified applications can be used at some future date that you state. You then proceed to enable system lockdown on that date.
  Continue to log the use of the unapproved applications	No further action is necessary.

  
  

Note:
You can also create firewall rules to allow approved applications on the client.

To set up system lockdown

1. On the console, click Clients.

2. Under View Clients, locate the group for which you want to set up system lockdown.

3. On the Policies tab, click System Lockdown.

4. In the System Lockdown for name of group dialog box, click Step 1: Log Unapproved Applications Only if you want to turn on this protection in test mode.

   This option logs the unapproved network applications that clients are currently running.

5. Click Step 2: Enable System Lockdown if you want to turn on this protection. This step blocks the unapproved applications that clients try to run.

6. Under Approved Applications, add or remove file fingerprint lists or specific files.

   See Editing a file fingerprint list in Symantec Endpoint Protection Manager.

7. Check Test Before Removal for the file fingerprint lists or applications that you want to test before you remove permanently remove them.

   When you check this option, the associated applications are logged in the Control log as unapproved applications. However, the applications are not blocked on your client computers. You can permanently remove the file fingerprint list or applications later.

8. To view the list of unapproved applications, click View Unapproved Applications.

   In the Unapproved Applications dialog box, review the applications. This list includes information about the time that the application was run, the computer host name, the client user name, and the executable file name.

9. Determine how you want to handle the unapproved applications.

   You can add the names of applications that you want to allow to the list of approved applications. You can add the executable to the computer image the next time that you create a file fingerprint.

10. Click Close.

11. To specify the executables that are always allowed even if they are not included in the file fingerprint list, under the File Name list, click Add.

12. In the Add File Definition dialog box, specify the full path name of the executable file (.exe or .dll).

    Names can be specified using a normal string or regular expression syntax. Names can include wildcard characters (* for any characters and ? for one character). The name can also include environment variables such as %ProgramFiles% to represent the location of your Program Files directory or %windir% for the Windows installation directory.

13. Either leave Use wildcard matching (* and ? supported) selected by default, or click Use regular expression matching if you used regular expressions in the filename instead.

14. If you want to allow the file only when it is executed on a particular drive type, click Only match files on the following drive types.

    Then unselect the drive types you do not want to include. By default, all drive types are selected.

15. If you want to match by device id type, check Only match files on the following device id type, and then click Select.

16. Click the device you want in the list, and then click OK.

17. Click OK.

18. To display a message on the client computer when the client blocks an application, check Notify the user if an application is blocked.

19. To write a custom message, click Notification, type the message, and click OK.

20. Click OK.