Skiplist -d

[mlajoie]

I have users that save executable files on their desktop, documents folder, downloads folder, etc.  They are trying to move them or delete them and, of course, are blocked from doing so.  If I put those locations in a skiplist (I was thinking D), what ramifications would that have?  

I want users to be able to delete and/or move files as they need to but want to continue to preserve the blocking of unauthorized applications (i.e., not allowing them to run).

Please advise.

[ktankink · Accepted solution]

Hi @mlajoie The 'skiplist -d' rule allows any processes to be able to modify/delete a whitelisted (solidified) file without that process being an Updater.  This is particularly useful when the process doing the write/delete is something critical that should not be an Updater (e.g. svchost.exe).  In general, unless the files in those locations are solidified or you have a rule that allows execution, they will be blocked in Enable mode.

[mlajoie]

they're using explorer.exe to move/delete files.  so, yes, it should not be an updater.

Based on this, I think we're OK in using the skiplist -d option to allow users to modify their desktop, documents, and downloads folder.

Thanks a lot for the clarification.