Security Agents constantly monitor clients for unusual modifications to the operating system or on installed software. Administrators (or users) can create exception lists that allow certain programs to start while violating a monitored change, or completely block certain programs. In addition, programs with a valid digital signature are always allowed to start.
Another feature of Behavior Monitoring is to protect EXE and DLL files from being deleted or modified. When Behavior Monitoring is enabled, users create exceptions to approve or block specific programs. In addition, users can select to collectively protect all Intuit QuickBooks programs.