Threat Prevention — Access Protection

Protect your system's access points based on configured rules. Access Protection compares a requested action against the list of configured rules and acts according to the rule.

Tip
Best practice: For information about creating Access Protection rules to protect against ransomware, see KB89335, and KB89540.

Options
Section	Option	Definition
ACCESS PROTECTION	Enable Access Protection	Enables the Access Protection feature.

Advanced options
Section	Option	Description
Exclusions		Allows access to the specified item for all rules. Add — Adds a item to the exclusion list. Double-click an item — Changes the selected item. Delete — Deletes the selected item. Duplicate — Creates a copy of the selected item. Note Access Protection exclusions don't apply to the Windows Services subrule type.
Rules		Configures Access Protection rules. You can enable, disable, and change Trellix-defined rules, but you can't delete these rules. Add — Creates a custom rule and adds it to the list. Double-click an item — Changes the selected item. Delete — Deletes the selected item. Duplicate — Creates a copy of the selected item. Block (only) — Blocks access attempts without logging. Report (only) — Logs without blocking access attempts. Block and Report — Blocks and logs access attempts. To block or report all, select Block or Report in the first row. To disable the rule, deselect both Block and Report.