Problem
A Blacklisting Policy which has no targets will apply to all programs and services and prevent them from running on an end-user's machine. After trying to reboot the machine the only thing that shows up is the desktop background or Login screen. The computer acts as if it is frozen and will not allow the Task Manager or other programs to run.
Solution
...
Issue
This document tells you how to recover computers that have been locked out due to an improper manually created deny execute policy.
Solution
1. Disable the policy
Disable the manually created deny execute policy that has resulted in locking out computers.
2. Update affected computers
You can update affected computers by running a task via the Arellia Security Manager Console, or by manually restarting the affected computer(s).
Run a task
If you're still able to log into the affected computer, then you can run a task from the Security Manager Console to update the computer by doing the following steps:
- Click the Tasks tab.
- In the file library in the left pane, navigate to Jobs and Tasks > Client Tasks.
- Click Update Applicable Policies.
- In the right pane under Task Status, click Run Now.
- In the Run Task Now dialog box under Input Parameters, next to ResourceIds target all computers or only the affected computers.
- Click Run Task.
Perform a configuration update on each of the affected endpoints by creating a new Update Client Configuration Task and schedule it to run immediately on all computers, or on the computers that are known to have been affected by the deny execute policy.
Manual Update
If you cannot log into the affected computer, then you have to update the computer manually by doing the following steps:
- Restart the affected computer(s) in safe mode. (For details about starting in safe mode, go to Start your computer in safe mode.)
- In the Control Panel open Administrator Tools > Services.
- Right-click Arellia Application Control and click Properties.
- Change the Startup Type to Disabled,
- Click OK and restart the computer.
- After restarting the computer right click on the Symantec Management Agent icon in the taskbar and select Symantec Management Agent Settings and then click Update to update your policy.
- You should now be able to open all the programs and services that were previously blacklisted.
- Open Services again from the Control Panel and change
Restart the computer.
- Go to the Control Panel again and open Administrator Tools > Services.
- Change the Arellia Application Control Startup Type to to Automatic.
- Restart your computer and everything should work as normal.
How to Avoid this Problem
- Deny Execute (Blacklist) policies should target specific applications unless being used in conjunction with whitelist policies. Targeting no applications will target all applications with conditions.
- To ensure blacklist policies do not affect system or service applications: from the Arellia Management Console click on Policies, open Policies->Arellia->Application Control->Policies and select your Blacklisting Policy.
- Select they hyperlink next to Exclude Any:
- Then select Arellia->Application Control->Filters->Dynamic Filters->Application Context-> "LocalSystem and Service application" and move that to the right side. Doing so should prevent the blacklist policy from stopping any Windows Services and Programs from running. This will allow you to update a policy and recover from a bad Deny Execute (blacklist) condition.
...
More information on how to configure blacklisting policies
Additional Info
A manually created blacklisting or deny execute policy that has no application targets will apply to all programs and services and prevent them from running on an end-user's machine. If a new deny execute policy is created and enabled with out limiting the application target scope of the policy or is not being used with a proper whitelist, the bad blacklist policy will get rolled out and begin denying execution of all applications. This includes userinit.exe which will prevent users from logging in after a reboot. Those computers will act as if they are frozen because no new processes can get created.