Policies match applications to rule types in the following order:
For example, the following policy applies a Lockdown rule to matching users and endpoints. Lockdown rules allow users to start any non-blocked application already on an endpoint before the Lockdown rule is applied. But, in this example, the policy still blocks the Chrome web browser, because the policy processes the Block rule before the Lockdown rule.
Endpoint Application Control combines criteria from the same types of rules for processing. If different rules of the same type match the same application, the policy applies only the first matching rule using the following order of matching methods:
Certified Safe Software and Endpoint Inventory Searches
Certified Safe Software Selection List
SHA-1 Hash Values