The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Remove authorized and banned rules

  • Published on Aug 28, 2026
  • 1 minute(s) read
Prev Next

You can remove binaries authorized by name to prevent them from executing on a protected system.

  • Run these commands at the command prompt.

    Command

    Description

    sadmin attr remove -a <filename>

    Removes the added rule to authorize the specified binary by name. Specify the same file name or path that was used to add the rule.

    sadmin attr remove -m <filename>

    Removes the added rule to block the interactive mode for a file.

    sadmin attr remove -u <filename>

    Removes the added rule to ban the specified binary by name. Specify the same file name or path that was used to add the rule.

    sadmin attr flush -a

    Removes the authorized by name rules for all files.

    sadmin attr flush -m

    Removes the block in interactive mode rules for all files.

    sadmin attr flush -u

    Removes the banned by name rules for all files.