Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Endpoint Management Community Blog

How do you monitor an application when a user renames the file?

Created: 06 Jul 2006 • Updated: 11 Mar 2009 • 2 comments
Admin's picture
0 0 Votes
Login to vote

Q:
A monitor was set up by specifying the File Name and Internal Name which prevents the user from running the application. If the user renames the file, the denial no longer works. Is there a solution?

A:
When monitoring an application, the attributes of the file must match all values specified in the monitor. If a value is specified in the monitor, and the application does not match that value, then the application will not be denied.

To resolve this issue, instead of specifying the File Name and Internal Name, only specify the Internal Name. Then if the user modifies the file name, it will still be denied.

Comments 2 CommentsJump to latest comment

Scott Hardie's picture

If you run into applications that have no internal name choose one or more attibutes. File Name should be the last choice as a best practice.

James "Scott" Hardie
Vice President of Technology Services
shardie@xcendgroup.com
http://www.xcendgroup.com

James "Scott" Hardie
Security Architect
Security Business Practice
Symantec Corporation
www.symantec.com
__________________________________
Office: (810) 588 9464
Mobile: (810) 588 9464<

0
Login to vote
mszczesniak's picture

But there is still issue when end users put application on network drive - some of them still works. Even if application has Internal Name or other attributes these are not seen be Altiris Agent and can be started. Do anyone has soution for that ?

0
Login to vote