Subrule Target page

• Include — Indicates that the subrule can match the specified target.
• Exclude — Indicates that the subrule must not match the specified target.

Add a target with either an Include or Exclude directive.

Access Protection rules treat files and folders as case insensitive — rules apply to all case variations of the specified files and folders. For example, if you create a rule to block C:\Temp\ABC, Access Protection also blocks C:\temp\abc and C:\TEMP\Abc.

• File path — Enter the file name, folder name, or file path.
• Destination file — Enter the target file name or path for Rename, Symlink, or Hard link operations.

  If the Destination file target is selected, the Rename, Symlink (Linux only), or Hard link operation (Linux only) must be selected.

• Drive type (Windows only) — Select the drive type target from the drop-down list:
  • Removable — Files on a USB drive or other removable drive connected to a USB port, including those with Windows To Go installed. This drive type doesn't include files on a CD, DVD, or floppy disk.

    Note

    Blocking this drive type also blocks drives with Windows To Go installed.

  • Network — Files on a network share
  • Fixed — Files on the local hard drive or other fixed hard disk
  • CD/DVD — Files on a CD or DVD
  • Floppy — Files on a floppy disk

You can use ?, *, and ** as wildcards.

System environment variables (Windows only)

Files subrule target best practices (Windows only)

For example, to protect:

• A file or folder named c:\testap, use a target of c:\testap or c:\testap\
• The contents of a folder, use the asterisk wildcard — c:\testap\*
• The contents of a folder and its subfolders, use 2 asterisks — c:\testap\**

Files subrule target best practices (Linux only)

For example, to protect:

• A file or folder named /tmp/test, use a target of /tmp/test
• The contents of the folder, use the asterisk wildcard — /tmp/testdir/*
• The contents of the folder and its subfolders, use 2 asterisks — /tmp/testdir/**

Rename operation target examples

To prevent files from being renamed, select the Rename operation, then set the subrule target:

• To prevent any file from being renamed to newname.txt, set the Destination file target to "newname.txt".
• To prevent original.txt from being renamed to any other name, set the File path target to "original.txt".
• To prevent only the original.txt file from being renamed to newname.txt, specify 2 subrule targets:
  • Set the File path target to "original.txt".
  • Set the Destination file target to "newname.txt".

Hard link operation target examples (Linux only)

To prevent creating hard links to files, select the Hard link operation, the set the subrule target:

• To prevent creating a hard link with the name hardlinktofile to any file, set the Destination file target to "hardlinktofile"
• To prevent creating a hard link with any other name to the originalfile.txt file, set the File path target to "originalfile.txt"
• To prevent only creating a hard link to the originalfile.txt file with the name hardlinktofile, specify 2 subrule targets:
  • Set the File path target to "originalfile.txt".
  • Set the Destination file target to "hardlinktofile".

Symlink operation target examples (Linux only)

To prevent creating symbolic links to files, select the Symlink operation, the set the subrule target:

• To prevent creating a symbolic link with the name symlinktofile to any file, set the Destination file target to "symlinktofile".
• To prevent creating a symbolic link with any other name to the originalfile.txt file, set the File path target to "originalfile.txt"
• To prevent only creating a symbolic link to the originalfile.txt file with the name symlinktofile, specify 2 subrule targets:
  • Set the File path target to "originalfile.txt".
  • Set the Destination file target to "symlinktofile".

Change owner operation target examples (Linux only)

To prevent changing file ownership, select the Change owner operation, the set the subrule target. For example, to protect a file or path named /tmp/mypath, set the subrule target to "/tmp/mypath".

• HKLM or HKEY_LOCAL_MACHINE
• HKCU or HKEY_CURRENT_USER
• HKCR or HKEY_CLASSES_ROOT
• HKCCS matches HKLM/SYSTEM/CurrentControlSet and HKLM/SYSTEM/ControlSet00X
• HKLMS matches HKLM/Software on 32-bit and 64-bit systems, and HKLM/Software/Wow6432Node on 64-bit systems only
• HKCUS matches HKCU/Software on 32-bit and 64-bit systems, and HKCU/Software/Wow6432Node on 64-bit systems only
• HKULM treated as both HKLM and HKCU
• HKULMS treated as both HKLMS and HKCUS
• HKALL treated as both HKLM and HKU

You can use ?, *, and ** as wildcards, and | (pipe) as an escape character.

Registry key subrule target best practices

For example, to protect:

• A registry key named HKLM\SOFTWARE\testap, use a target of HKLM\SOFTWARE\testap or HKLM\SOFTWARE\testap\
• The contents of a registry key, use the asterisk wildcard — HKLM\SOFTWARE\testap\*
• The contents of a registry key and its subkeys, use 2 asterisks — HKLM\SOFTWARE\testap\**
• Registry keys and values under a registry key, enable the Write operation

• HKLM or HKEY_LOCAL_MACHINE
• HKCU or HKEY_CURRENT_USER
• HKCR or HKEY_CLASSES_ROOT
• HKCCS matches HKLM/SYSTEM/CurrentControlSet and HKLM/SYSTEM/ControlSet00X
• HKLMS matches HKLM/Software on 32-bit and 64-bit systems, and HKLM/Software/Wow6432Node on 64-bit systems only
• HKCUS matches HKCU/Software on 32-bit and 64-bit systems, and HKCU/Software/Wow6432Node on 64-bit systems only
• HKULM treated as both HKLM and HKCU
• HKULMS treated as both HKLMS and HKCUS
• HKALL treated as both HKLM and HKU

You can use ?, *, and ** as wildcards, and | (pipe) as an escape character.

Registry value subrule target best practices

For example, to protect:

• A registry value named HKLM\SOFTWARE\testap, use a target of HKLM\SOFTWARE\testap
• The registry values under a registry key, use the asterisk wildcard — HKLM\SOFTWARE\testap\*
• The registry values under a registry key and its subkeys, use 2 asterisks — HKLM\SOFTWARE\testap\**

You can use ?, *, and ** as wildcards for all except MD5 hash.

Processes subrule target best practices (Windows only)

For example, to protect:

• A process named c:\testap.exe, use a target file name or path of c:\testap.exe
• All processes in a folder, use the asterisk wildcard — c:\testap\*
• All processes in a folder and its subfolders, use 2 asterisks — c:\testap\**

Processes subrule target best practices (Linux only)

For example, to protect:

• A process named /testExec, use a target file name or path of /testExec
• All processes in a folder, use the asterisk wildcard — /tmp/test/*
• All processes in a folder and its subfolders, use 2 asterisks — /tmp/test/**

• Service registered name — Contains the name of the service in the corresponding registry key under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.
• Service display name — Contains the display name of the service from the DisplayName registry value under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service_name>\. This is the name that appears in the Services manager.

For example, "Adobe Acrobat Update Service" is the display name for the "AdobeARMservice" service name.

You can use ? and * as wildcards.

Services subrule target best practices

For example, to protect all Adobe services by display name, use the asterisk wildcard — Adobe*