Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Network Performance Monitor (NPM) > NPM - Knowledgebase Articles > Allow one specific exe to run from USB and block all others

Allow one specific exe to run from USB and block all others

Table of contents

Overview

This article explains how you can allow one specific exe to run from USB and block all others.

Environment

LEM 6.2 and later

Steps

A user can make use of the ready template: Detach USB - File Executed

It is searching for any FileExecute that has the providerSID = USB (for the usb defender). A user can then add one extra line to this to look for FileExecute.ExtraneousInfo Not Equal to *executableYouWantToAllowNameHere.exe*

Example:

If Calc.exe is the exe we want to run from the USB but want to block all other exes from running:

FileExecute.ProviderSID = *USB*

AND

FileExecute.ExtraneousInfo NotEqual to *calc.exe*

This should then cause the rule to look for additional information on the file executed, if it doesn't equal executableYouWantToAllowNameHere.exe, then it will detach the USB, to stop it from running. Then if the executableYouWantToAllowNameHere.exe is running, this rule won't fire and the user can still use that one exe to run from the USB.

 

 

 

Last modified

Tags

Classifications

Public