There are three modes Read-Only Blanketing:
- In disabled mode, users can access and modify data on local disks and no data is logged.
- In learning mode, attempts to access local disks will not be blocked. However, you can choose to log these events in the Log file. When you have fine-tuned your environment sufficiently in learning mode, you can set Read-Only Blanketing to enabled mode.
- In enabled mode, all local drives on servers and desktops are rendered read-only. You can choose to log security events in the Log file.
- If you select the option Log security events, security events will also be logged if Read-Only Blanketing is in learning mode.
- If you select the option Notify users about security events, users will also be notified if Read-Only Blanketing is in learning mode.