About User-Level Blocking

To block applications after execution, apply user-level blocking.

User-level blocking allows applications to start and then stops them at the task level. This may be unable to stop certain applications after they start and does not support the Trusted Source feature and blocking of link libraries (DLLs) and Java interpreter applications.

Note:

Trend Micro recommends user-level blocking only if you are having problems with kernel-level blocking.

User-level blocking has the following known limitations:

  • May be unable to stop an application quickly

  • May be unable to stop certain applications after they start

  • Unable to block link libraries (DLLs)

  • Unable to support the Trusted Source feature

    See About Trusted Sources.

After Endpoint Application Control blocks an application start using the user-level method, Endpoint Application Control may display the following notification to end-users:

Figure 1. Endpoint Application Control Block Notification Example

To hide this notification, go to the Add or Edit Policy screen, expand User experience, and then clear the Display notification popups check box.

See Add or Edit Policy Screen and Policy User Experience.