Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 17641 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Application control policy doesn't block BS Player, possibly other applications too

NikolaFBA

We have the latest console on 2012R2 server.

Application policy has ben set. With it we've blocked

all media players except Windows Media Player.

Afterwards, for instance PowerDVD player is blocked

but not BS.Player. Even worse user with restricted rights

(no installation rights) managed to install it. Maybe as

portable version, we didn't checked before returning

his computer to factory settings with R&R.

What to do, were to check in console?

Events in console don't show triggering of BS.player blocking

when i try to install it as admin while computer is

again in the same group. Very frustrating...

Thanks in advance for your help.

Nikola

P.S. In addition, how can I send private message to someone on forum?

I need QC's or someone of administrators' help regarding Sophos in general.

Please contact me. Thank you!

:53611


This thread was automatically locked due to age.
Parents
  • 0

    I suspect it's an update to the application and as a result the SophosLabs rule no longer pick it up. For the most part rules are generic enough but on this occasion it seems they aren't.  I would suggest, making the request via the form, specify the current version not being blocked and if you can link to the download of the file all the better.

    For the short term (before SophosLabs can update their detection), if you need to block it I would look into using software restriction policies in AD.  You can block the applicaiton in a variety of ways I would think.

    http://technet.microsoft.com/en-gb/library/bb457006.aspx


    Regards,

    Jak

    :53619
Reply
  • 0

    I suspect it's an update to the application and as a result the SophosLabs rule no longer pick it up. For the most part rules are generic enough but on this occasion it seems they aren't.  I would suggest, making the request via the form, specify the current version not being blocked and if you can link to the download of the file all the better.

    For the short term (before SophosLabs can update their detection), if you need to block it I would look into using software restriction policies in AD.  You can block the applicaiton in a variety of ways I would think.

    http://technet.microsoft.com/en-gb/library/bb457006.aspx


    Regards,

    Jak

    :53619
Children
No Data