Procedure

1. Navigate to Networked Computers → Client Management.
2. In the client tree, click the root domain icon () to include all clients or select specific domains or clients.
3. Click Settings → Behavior Monitoring Settings.
4. Select Enable Malware Behavior Blocking.
5. Configure Event Monitoring settings.
   1. Select Enable Event Monitoring.
   2. Choose the system events to monitor and select an action for each of the selected events. For information about monitored system events and actions, see Event Monitoring.
6. Configure the exception list.
   1. Under Enter Program Full Path, type the full path of the program to approve or block. Separate multiple entries with semicolons (;). The exception list supports wildcards and UNC paths.
   2. Click Approve Programs or Block Programs.
   3. To remove a blocked or approved program from the list, click the trash bin icon () next to the program.

      Note OfficeScan accepts a maximum of 100 approved programs and 100 blocked programs.

7. If you selected domain(s) or client(s) in the client tree, click Save. If you clicked the root domain icon, choose from the following options:
   • Apply to All Clients: Applies settings to all existing clients and to any new client added to an existing/future domain. Future domains are domains not yet created at the time you configured the settings.
   • Apply to Future Domains Only: Applies settings only to clients added to future domains. This option will not apply settings to new clients added to an existing domain.