To block applications after execution, apply user-level blocking.
User-level blocking allows applications to start and then stops them at the task level. This may be unable to stop certain applications after they start and is less feature-rich than kernel-level blocking. User-level blocking is unable to block link libraries (DLLs) and is unable to support the Trusted Source feature.
Trend Micro recommends user-level blocking only if you are having problems with kernel-level blocking.
User-level blocking has the following known limitations:
May be unable to stop an application quickly
May be unable to stop certain applications after they start
Unable to block link libraries (DLLs)
Unable to support the Trusted Source feature
After Endpoint Application Control blocks an application start using the user-level method, Endpoint Application Control may display the following notification to end-users:
To hide this notification, go to the Add or Edit Policy screen, expand User experience, and then clear the Display notification popups check box.