Prevent users from opening an application

Prevent users from writing to a particular file

You may want to let users open a file but not modify the file. For example, a file may include the financial data that employees should view but not edit.

You can create a rule to give users read-only access to a file. For example, you can add a rule that lets you open a text file in Notepad but does not let you edit it.

Use the File and Folder Access Attempts condition to create this type of rule.

Block file shares on Windows computers

You can create a custom rule that applies to all applications to disable local file and print sharing on Windows computers.

You set the action for each condition to Block access.

You can also use firewall rules to prevent or allow client computers to share files.

See Permitting clients to browse for files and printers in the network.

Prevent users from running peer-to-peer applications

You can use application control to prevent users from running peer-to-peer applications on their computers.

You can create a custom rule with a Launch Process Attempts condition. In the condition, you must specify all peer-to-peer applications that you want to block, such as LimeWire.exe or *.torrent. You can set the action for the condition to Block access or Terminate process.

Use an Intrusion Prevention policy to block network traffic from peer-to-peer applications. Use a Firewall policy to block the ports that send and receive peer-to-peer application traffic.

See Managing intrusion prevention on your client computers.

See Creating a firewall policy.

Block write attempts to DVD drives

Currently, Symantec Endpoint Protection Manager does not support a rule set that specifies the blocking of write attempts to DVD drives. You can select the option in the Application and Device Control policy, however, the option is not enforced. Instead, you can create an Application and Device Control policy that blocks specific applications that write to DVD drives.

You should also create a Host Integrity policy that sets the Windows registry key to block write attempts to DVD drives.