This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Application control policy doesn't block BS Player, possibly other applications too

NikolaFBA over 10 years ago

We have the latest console on 2012R2 server.

Application policy has ben set. With it we've blocked

all media players except Windows Media Player.

Afterwards, for instance PowerDVD player is blocked

but not BS.Player. Even worse user with restricted rights

(no installation rights) managed to install it. Maybe as

portable version, we didn't checked before returning

his computer to factory settings with R&R.

What to do, were to check in console?

Events in console don't show triggering of BS.player blocking

when i try to install it as admin while computer is

again in the same group. Very frustrating...

Thanks in advance for your help.

Nikola

P.S. In addition, how can I send private message to someone on forum?

I need QC's or someone of administrators' help regarding Sophos in general.

Please contact me. Thank you!

This thread was automatically locked due to age.

0 jak over 10 years ago

HI,
Applicaiton Control relies on data supplied by SophosLabs to block applications.
As applications change over time rules potentially need updating. I would suggest filling out:
https://secure2.sophos.com/en-us/support/contact-support/application-control-request.aspx
For the applications you want to detect, you should get a response quite quickly.
Regards,
Jak
:53613
Cancel
Vote Up 0 Vote Down

Cancel
0 NikolaFBA over 10 years ago

Hello jak,
Thank you for your response.
BS Player is already there, that's what bothering me.
And it was in block policy for years as far as Iknow.
Maybe software makerse chenge processes names with new
releases and in that way bypass blocking.
We really need to block it, but how?
Thanks once again.
Nikola
:53617
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 10 years ago

I suspect it's an update to the application and as a result the SophosLabs rule no longer pick it up. For the most part rules are generic enough but on this occasion it seems they aren't. I would suggest, making the request via the form, specify the current version not being blocked and if you can link to the download of the file all the better.
For the short term (before SophosLabs can update their detection), if you need to block it I would look into using software restriction policies in AD. You can block the applicaiton in a variety of ways I would think.
http://technet.microsoft.com/en-gb/library/bb457006.aspx

Regards,
Jak
:53619
Cancel
Vote Up 0 Vote Down

Cancel
0 NikolaFBA over 10 years ago

Thank you jak,
These are the things I will do.
Best regards,
Nikola
:53623
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 10 years ago

Hello Nikola,
how can I send private message
click the username, on the right there's the Contact Me section. If the user has PM enabled there'll be a Send this user a private message link. Note that you have to turn on PM (My settings->Preferences->Private Messenger) in order to receive replies.
Christian
:53635
Cancel
Vote Up 0 Vote Down

Cancel
0 NikolaFBA over 10 years ago

Hello QC,
Thank you for your answer.
jak and you haven't actiavated that option:( so I will post
my question here. I want to change my forum name.
Who and how to contact regarding this issue?
Thank you in advance!
:53649
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 10 years ago

Hello Nikola,
Jak and you haven't actiavated that option
at least I have, perhaps the link is rather inconspicuous. But anyway Jak and I are just members and this is a question for the Admins or Moderators (to whom I've pointed out your post).
Christian
:53651
Cancel
Vote Up 0 Vote Down

Cancel
0 NikolaFBA over 10 years ago

OK.
Thanks for reply all of you.
Best regards,
Nikola
:53803
Cancel
Vote Up 0 Vote Down

Cancel