The most common method for blocking unauthorized software is to block the primary program executable. To ensure that the correct file is blocked, Symantec recommends that you calculate an MD5 hash of the file.
Note: When an update for a program is available and its executable modified, you need to create and add a new MD5 hash. Hashes are necessary for all versions of the executable that may be in use.
Generate an MD5 hash
Use one of the following methods to generate an MD5 hash:
(Recommended) Use the checksum.exe utility that is installed with Symantec Endpoint Protection on the client computer to create a file fingerprint list.
Use the Get-FileHash command from within Windows PowerShell.
Note: Some of these tools are 32-bit applications. Due to Windows file system redirection on 64-bit operating systems, some unexpected behavior can occur.
If an application such as notepad.exe is present in both of the following folders, each file has different hash values. Symantec recommends that you add both hash values to the policy.
Note: Some MD5 hash tools may provide hash values of files in the C:\Windows\SysWOW64\ folder, even though you request values for files in the C:\Windows\System32\ folder. Symantec’s checksum.exe tool (recommended) generates hash values for the exact file path requested.
Create a rule
In Symantec Endpoint Protection Manager (SEPM), click Policies.
Click Application and Device Control.
Create a new Application and Device Control policy, or use an existing policy.
Click your selected policy to edit it.
Click Application Control.
Next to Apply this rule to the following processes, click Add.
In the Process name to match field, type an asterisk (*).
Under Rules in the bottom left, click Add.
Click Add Condition.
Click Launch Process Attempts.
Next to Apply to the following processes, click Add.
In the lower right, click Options.
Select Match the file fingerprint.
Copy the MD5 hash into the field for the fingerprint.
Click the Actions tab.
Decide if you want to block the file when it runs, or log it.
Log: Choose "Continue processing other rules” and check "Enable logging.” There are 16 levels of logging, but "Critical - 0" is usually sufficient.
Block: Choose "Block Access.” You can enable logging under this option as well.
Notification: Check "Notify User" to notify the user by pop-up message that the software is unauthorized.
Click OK. Ensure that the new rule is enabled and is set for production (test only logs) when you are ready to use it.
Click Yes to assign the policy.
Check any client group to which the policy should apply.