About User-Level Blocking

To block applications after execution, apply user-level blocking.

User-level blocking allows applications to start and then stops them at the task level. This may be unable to stop certain applications after they start and is less feature-rich than kernel-level blocking. User-level blocking is unable to block link libraries (DLLs) and is unable to support the Trusted Source feature.

Note:

Trend Micro recommends user-level blocking only if you are having problems with kernel-level blocking.

User-level blocking has the following known limitations:

May be unable to stop an application quickly
May be unable to stop certain applications after they start
Unable to block link libraries (DLLs)
Unable to support the Trusted Source feature

See About Trusted Sources.

After Endpoint Application Control blocks an application start using the user-level method, Endpoint Application Control may display the following notification to end-users:

Figure 1. Endpoint Application Control Block Notification Example

To hide this notification, go to the Add or Edit Policy screen, expand User experience, and then clear the Display notification popups check box.

See Add or Edit Policy Screen and Policy User Experience.