great thanks........I think i see what the problem is.
my word, what an overly complex way to whitelist applications. So i need to create a file fingerprint file first using the document Vikram linked to.....
I mean, so there's no purpose in 'view unapproved applications' button on the system lockdown section..... it's like saying, here's a piece cake, you like it don't you?....but you can't have it, you've got to go and sodding bake it yourself!
But that's not your fault. How i can I split the solution on this as you both helped equally?