The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Path considerations when defining rules

  • Published on Sep 1, 2026
  • 1 minute(s) read
Prev Next

Regardless of whether you create a policy or define a rule group, the framework available to define rules is the same.

Supported system variables

The path specified in a rule can include system environment variables. This table lists the supported system variables.

Variable

Example value (most Windows platforms)

%ALLUSERSPROFILE%

C:\Documents and Settings\All Users

%APPDATA%

C:\Documents and Settings\{username}\Application

%COMMONPROGRAMFILES%

C:\Program Files\Common Files

%COMMONPROGRAMFILES (x86)%

C:\Program Files (x86)\Common Files

%HOMEDRIVE%

C:

%HOMEPATH%

C:\Documents and Settings\{username} (\ on earlier Windows versions)

%PROGRAMFILES%

C:\Program Files

%PROGRAMFILES (x86)%

C:\Program Files (x86) (only for 64-bit versions)

%SYSTEMDRIVE%

C:

%SYSTEMROOT%

C:\windows (C:\WINNT on earlier Windows versions)

%TEMP% (system) %tmp% (user)

C:\Documents and Settings\{username}\local Settings\Temp

C:\Temp

%USERPROFILE%

C:\Documents and Settings\{username} (C:WINNT\profiles\{username} for earlier versions)

%WINDIR%

C:\Windows

These considerations apply to path-based rules.

  • Paths don't need to be absolute when specifying rules. For example, when defining an updater, you can specify partial or fully qualified paths.

    • Partial paths — If you specify partial paths, such as AcroRd32.exe or Reader\AcroRd32.exe, all programs with names that match the specified string are assigned updater rights. Similarly, when blocking a file, all programs with names that match the specified string are blocked.

    • Fully qualified paths — When you specify fully qualified paths, such as C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe or \Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe only the specified program is assigned updater rights. When blocking a file, if you specify the fully qualified path, for example C:\Windows\system32\notepad.exe, only the specified file is blocked.

  • Paths can contain white spaces.

  • Paths can include the wildcard characters to specify file paths and file names. When using wildcards, ensure that specified string matches a limited set of file paths or file names. If the specified string matches many files, we recommend you revise the string.

  • Paths can include the * and ? wildcard characters.