Rules Items

1. In the navigation pane, select the Allowed Item or Denied Item node for a rule.
2. In the Rule Items ribbon, select either:
   • Add Item > Allowed > File.

   • Add Item > Denied > File.

   The Add a File dialog displays.

3. In the Properties tab, click the ellipsis (...) in the text box, navigate to the file that you want to add and click OK.
4. If required, you can select the following:
   • Substitute environment variables where possible
   • Use regular expressions

5. Enter optional command line arguments in the Arguments text box. Enter all arguments as they appear in Process Explorer.

   Command line arguments extend the matching criteria beyond what is entered in the File field. If an argument is added, both file and argument must be satisfied for a match to occur. Any argument that appears on the command line for a process, such are flags, switches, files, and guids, can be added.

   For examples of valid argument, see Arguments Example.

6. To add metadata to the file, select the Metadata tab:
   1. Click Populate metadata from file.
   2. The following fields can be populated: Product Name, Vendor, Company Name, File Description, File Version, and Product Version.

   3. Select the checkboxes for the metadata to refine criteria for the file.

      If Vendor metadata is enabled, a further option becomes available - Verify certificate at runtime. When this option is enabled, the  agent verifies the certificate whilst it is matching the file. Click Verify Options to access a further set of criteria, used during file matching.

      For further information, see Verify Options.

7. To specify that the file may run at specific access times only, select the Access Times tab:
   1. Select Only allow files to run at certain access times.
   2. To specify a specific allowed period, right-click the time period in the calendar area, and select New Allowed Period.
8. To limit the number of instances of an application a user can have, select the Application Limits tab:
   1. Select Enable Application Limits.
   2. Enter the limit in the spinbox.
9. Click Add to add the file to the Allowed/Denied Items for the rule.
10. The item is added to the Allowed/Denied work area.
    If you want to disable a specific rule item, highlight the item, right-click and select Change State. This toggles between disable and enable. This can be useful when needing to trouble shoot with Support.

1. In the navigation pane, select the User Privileges node for a rule.

2. In the User Privileges ribbon, select Add Item > Application > File.

   The Add a File for User Privilege Management dialog displays.

3. In the Properties tab, click the ellipsis (...) in the text box:
   1. In the Open dialog, navigate to the file that you want to add and click OK.
   2. If required, you can select the following:
      • Substitute environment variables where possible
      • Use regular expressions
      • Make file an Allowed Item

4. Enter optional command line arguments in the Arguments text box. Enter all arguments as they appear in Process Explorer.

   Command line arguments extend the matching criteria beyond what is entered in the File field. If an argument is added, both file and argument must be satisfied for a match to occur. Any argument that appears on the command line for a process, such as flags, switches, files, and guids, can be added.

   For examples of valid argument, see Arguments Examples.

5. To apply a policy, select the policy from the drop-down in the Policy section.

   You can select the following options for the policy:

   • Apply to child processes
   • Apply to common dialogs
   • Install as a trusted owner
   • Prompt the user before elevating (and the related: Require a reason before elevating). See also Message Settings.
6. If required, enter an optional description of the file for your future reference.
7. To add metadata to the file, select the Metadata tab:
   1. Click Populate metadata from file.
   2. The following fields can be populated: Product Name, Vendor, Company Name, File Description, File Version, and Product Version.

   3. Select the checkboxes for the metadata to refine criteria for the file.

      If Vendor metadata is enabled, a further option becomes available - Verify certificate at runtime. When this option is enabled, the  agent verifies the certificate whilst it is matching the file. Click Verify Options to access a further set of criteria, used during file matching.

      For further information, see Verify Options.

8. Click Add to add the file to the User Privilege Management for the rule.
9. The item is added to the User Privileges work area.
   If you want to disable a specific rule item, highlight the item, right-click and select Change State. This toggles between disable and enable. This can be useful when needing to trouble shoot with Support.

To configure the arguments of an allowed or denied item correctly, they must appear as they do in Process Explorer for example:

File: C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Command line: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\example.docx

Would be configured as:

File: Absolute or relative path of winword.exe

Arguments: /n C:\example.docx

In the navigation pane, select the Allowed Item or Denied Item node for a rule.

1. In the Rule Items ribbon, select either:
   • Add Item > Allowed > Folder.

   • Add Item > Denied > Folder.

   The Add a Folder dialog displays.

2. In the Properties tab, click the ellipsis (...) in the text box, navigate to the folder that you want to add and click OK.
3. If required, select the following:
   • Substitute environment variables where possible
   • Use regular expressions
   • Include subfolders
4. To add metadata to the folder, select the Metadata tab:
   1. Click Populate metadata from file.
   2. The following fields can be populated: Product Name, Vendor, Company Name, File Description, File Version, and Product Version.

   3. Select the checkboxes for the metadata to refine criteria for the file.

      If Vendor metadata is enabled, a further option becomes available - Verify certificate at runtime. When this option is enabled, the agent verifies the certificate whilst it is matching the file. Click Verify Options to access a further set of criteria, used during file matching.

      For further information, see Verify Options.

5. Click Add to add the folder to the Allowed/Denied Items for the rule.
6. The item is added to the Allowed/Denied work area.
   If you want to disable a specific rule item, highlight the item, right-click and select Change State. This toggles between disable and enable. This can be useful when needing to trouble shoot with Support.

1. In the navigation pane, select the User Privileges node for a rule.

2. In the User Privileges ribbon, select Add Item > Application > Folder.

   The Add a Folder for User Privilege Management dialog displays.

3. In the Properties tab, click the ellipsis (...) in the text box:
   1. In the Open dialog, navigate to the file that you want to add and click OK.
   2. If required, you can select the following:
      • Substitute environment variables where possible
      • Include subfolders
      • Use regular expressions
      • Make folder an Allowed Item

4. To apply a policy, select the policy from the drop-down in the Policy section.

   You can select the following options for the policy:

   • Apply to child processes
   • Apply to common dialogs
   • Install as a trusted owner
   • Prompt the user before elevating (and the related: Require a reason before elevating). See also Message Settings.
5. If required, enter an optional description of the folder for your future reference.
6. To add metadata to the file, select the Metadata tab:
   1. Click Populate metadata from file.
   2. The following fields can be populated: Product Name, Vendor, Company Name, File Description, File Version, and Product Version.

   3. Select the checkboxes for the metadata to refine criteria for the folder.

      If Vendor metadata is enabled, a further option becomes available - Verify certificate at runtime. When this option is enabled, the agent verifies the certificate whilst it is matching the file. Click Verify Options to access a further set of criteria, used during file matching.

      For further information, see Verify Options.

7. Click Add to add the file to the User Privilege Management for the rule.
8. The item is added to the User Privileges work area.
   If you want to disable a specific rule item, highlight the item, right-click and select Change State. This toggles between disable and enable. This can be useful when needing to trouble shoot with Support.

1. Select the Allowed Items or Denied Items node for a rule.
2. In the Rule Items ribbon, select either:
   • Add Item > Allowed > Drive.
   • Add Item > Denied > Drive.
3. The Add a Drive dialog displays.
4. Enter the drive letter and an options description for your future reference.
5. Click Add to add the drive to the list of allowed or denied items for the rule.

1. In the navigation pane, select the Allowed Item or Denied Item node for a rule.
2. In the Rule Items ribbon, select either:
   • Add Item > Allowed > Signature Item.

   • Add Item > Denied > Signature Item.

   The Add a Signature dialog displays.

3. In the Properties tab, click the ellipsis (...) in the text box. In the Open dialog, navigate to the file, for example an EXE file, that you want to add and click OK.

   The Signature Hash Value field is populated with the signature hash value of the file.

4. To specify that the file may run at specific access times only, select the Access Times tab:
   1. Select Only allow files to run at certain access times.
   2. To specify a specific allowed period, right-click the time period in the calendar area, and select New Allowed Period.
5. Click Add to add the signature file to the Allowed/Denied Items for the rule.

1. In the navigation pane, select the User Privileges node for a rule.

2. In the User Privileges ribbon, select Add Item > Application > Signature.

   The Add a Folder for User Privilege Management dialog displays.

3. In the Properties tab, click the ellipsis (...) in the text box:
4. In the Open dialog, navigate to the file that you want to add and click OK.
5. If required, you can select Make signature file an Allowed Item
6. Enter optional command line arguments in the Arguments text box.

7. To apply a policy, select the policy from the drop-down in the Policy section.

   You can select the following options for the policy:

   • Apply to child processes
   • Apply to common dialogs
   • Install as a trusted owner
   • Prompt the user before elevating (and the related: Require a reason before elevating). See also Message Settings.
8. If required, enter an optional description of the folder for your future reference.
9. Click Add to add the signature file to the User Privilege Management for the rule.

1. In the navigation pane, select the Allowed Item or Denied Item node for a rule.
2. In the Rule Items ribbon, select either:
   • Add Item > Allowed > Network Connection.

   • Add Item > Denied > Network Connection.

   The Add a Network Connection dialog displays.

3. Select the connection type:
   • IP Address - Select to control access to a specific IP Address.
   • Network Share - Select to control access to UNC paths. The prefix \\ is added to the Host field.
   • Host Name - Select to control access to a specific Host Name.
4. Complete the connection details. The combined number of characters for all three fields, Host, Port and Path must not exceed 400.

   • Host - The IP Address or Host Name for the network connection. This depends on the type of connection selected. You can use the ? and * wildcards. Additionally, ranges can be used for IP Addresses, which are indicated by use of a hyphen (-). An IP Address must be in IP4 octal format, for example, n.n.n.n. If Network Share is selected as the connection type, the \\ prefix is required.

     The full path for the target resource can be entered in Host, for example http://server1.company.local:80/resource1/.

     Move focus away from Host and the path is automatically split into the separate connection options:

     • http:// is removed from the Host field and server1.company.local remains.
     • : is removed and 80 is moved to Port.
     • /resource1/ is moved to Path.
   • Port - The port number of the network connection. This can be used in combination with IP Address or Host Name to control access to a specific port. Ranges and comma separated values are allowed as a part of the port number. Click Ports to display a list of commonly used ports. Select as many ports as required.

   • Path - The path of the network connection. You can use the ? and * wildcards. To use wildcards in the path, select the Text contains wildcard characters option.

     The path is only relevant for controlling HTTP and

   • Description - Enter a meaningful description to describe the network connection.
5. Click Add to add the network connection to the list of Allowed or Denied Items for the rule.

1. In the navigation pane, select the Allowed Items or Denied Items node for a rule.
2. In the Rule Items ribbon, select either:
   • Add Item > Allowed > Windows Store App.
   • Add Item > Denied > Windows Store App.
3. Select the required option:
   • All Installed Apps - Include any app that users have installed.
   • Individual Apps - Include specific apps selected from built-in snippets and snippets downloaded from Ivanti Marketplace. Use the Version Matching drop-down to target the required app versions.
   • Publisher - Include all apps from a named publisher. You can enter publisher details manually or extract details from a locally installed app.
4. Click OK.

1. In the navigation pane, select the Allowed Item or Denied Item node for a rule.
2. In the Rule Items ribbon, select either:
   • Add Item > Allowed > Group.

   • Add Item > Denied > Group.

   The Group Selection dialog displays listing the available groups.

3. Select the groups you want to add.
4. If you want to execute all the listed rule items regardless of the owner, select the Allow Untrusted Owner checkbox for the app.
5. Click OK.

1. In the navigation pane, select the User Privileges node for a rule.

2. In the User Privileges ribbon, select Add Item > Applications > Group.

   The Group Selection dialog displays. The available groups are listed.

3. To assign the User Privileges rules to the selected group, select Add To Rule.
4. You can also select the following options:
   • Policy - Select the policy - for example Builtin Elevate - from the drop-down list.
   • Make Allowed - Make the selected group allowed and overwrite any associated allowed items.
   • Allow Untrusted owner - Execute all the listed rule items regardless of the owner. This option becomes available when Make Accessible is selected.
   • Apply to Child Processes - Apply the policy to all the children and other descendants of the parent process.
   • Apply to Common Dialogs - Allow the open and save dialogs to run with administrative privileges when selected from an elevated process.
   • Install as Trusted Owner - Make local administrators the owner of all files created by the defined application.
   • Prompt the user before elevating (and the related: Require a reason before elevating) - Displays a configured message that helps the user determine whether they wish to elevate privileges or not. The prompt can require the user to enter a reason before privileges are elevated. See also Message Settings.
5. Click OK.