Deployment and Imaging Group

I need trust process can run and call sub-process.

The other process can be deny.

I set the policy content below...

I can deny non-trust process, but can't allow trust process call sub-process.

Such as

cmd.exe is trusted updaters process.

cmd.exe call putty.exe can't be run.

log is deny_ps.

How can i do?

Thanks

deny_ps means its being explicitly denied.  You need to find where it's being denied and remove it.  Go to the policy summary and search for cmd.exe and putty.exe

Then create a new sandbox called somthing like "allowed applications" and allow cmd to call putty.exe within Process Access control