Read-Only Blanketing security Modes: disabled, learning, enabled

There are three modes Read-Only Blanketing:

In disabled mode, users can access and modify data on local disks and no data is logged.
In learning mode, attempts to access local disks will not be blocked. However, you can choose to log these events in the Log file. When you have fine-tuned your environment sufficiently in learning mode, you can set Read-Only Blanketing to enabled mode.
In enabled mode, all local drives on servers and desktops are rendered read-only. You can choose to log security events in the Log file.

If you select the option Log security events, security events will also be logged if Read-Only Blanketing is in learning mode.
If you select the option Notify users about security events, users will also be notified if Read-Only Blanketing is in learning mode.