App Control: How does Local Approval differ from Low Enforcement policy?
search cancel

App Control: How does Local Approval differ from Low Enforcement policy?

book

Article ID: 291250

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How does Local Approval differ from Low Enforcement policy?

Environment

  • App Control Server: All Supported Versions
  • App Control Agent: All Supported Versions

Resolution

Low Enforcement:

  • When you are not concerned about unknown files and only need to block files that you have specifically created a File Ban Rule for: use Low Enforcement. 
  • Low Enforcement, by default, will enforce banned files while allowing users to install software that is either Approved or Unapproved (neither banned nor approved).
  • Although unapproved files are permitted to execute, you can monitor them and respond with Emergency Lockdown if necessary.
  • Low Enforcement is available to any Policy with the Mode, Control.

Local Approval:

  • Local Approval is reserved for system use, and cannot be chosen directly when creating a Policy, regardless of Mode.
  • This Enforcement Level instructs the Agent to issue Local Approvals of any new software (files created during local approval), even for computers otherwise under High Enforcement.
  • While in Local Approval the only active Device Control settings are: Block writes to banned removable devices and Block executes from banned removable devices.

Additional Information

  • Moving an Agent into Local Approval will require a Full Suite License (Visibility and Control). Environments with only a Visibility License cannot use Local Approval.
  • More details about Local Approval can be found in the User Guide chapter, "Approving and Banning Software".