Path Access Control

The Path Access Control feature protects critical files, folders, and registry paths from unauthorized access or modification. It allows you to define protected paths and ensure that only trusted processes are permitted to access them, helping safeguard sensitive system and application resources.

You can configure path protection by adding individual files, folders, registry keys, or registry values. The feature also supports importing multiple path entries from a .dat file for faster configuration.

Note: Ensure that the DLP license is assigned to the endpoint for this feature to work as expected.

Configuring Path Access Control

To configure Path Access Control:

1. Go to Policies > Feature/Container Policies.

2. Create a new policy or edit an existing policy.

3. Expand Path Access Control.

4. Turn on the Path Access Control toggle.

5. Click Add Path.

6. In the Add Path dialog box, specify the following details:

   • Type: Select the type of path to protect. Available options include Folder, File, Registry Key, and Registry Value.

   • System Macro: Select a predefined system macro to simplify path configuration. (Mandatory for registry key and registry value)

   • Protected Path: Enter the path to protect. The input varies based on the selected type:

     • Enter folder path
     • Enter file path
     • Enter registry key path
     • Enter registry value path

   • Protected Path Preview: Displays the resolved protected path based on the selected type, macro, and entered path. Verify the preview before saving the configuration.

7. Click Add Path.

The configured path is added to the protected path list.

Note: Verify the protected path preview before adding it to the list to ensure that the intended path is protected.

Managing Protected Paths

The Path Access Control page displays all configured protected paths.

You can perform the following actions:

Important: The following system-critical directories are excluded from User Protection to avoid interference with operating system functionality and ensure system stability:

• (“%SystemRoot%”),
• (“%SystemRoot%\\\\System32”),
• (“%SystemRoot%\\\\SysWOW64”),
• (“%SystemRoot%\\\\System32\\\\drivers”),
• (“%SystemRoot%\\\\Boot”),
• (“%SystemRoot%\\\\System32\\\\config”),
• (“%ProgramFiles%”),
• (“%ProgramFiles(x86)%”)
• (%SystemDrive%”)

Refer this list of macros that can be used while configuring file/folder paths and registry locations.

File and Folder Locations

• < QH_FOLDER >
• < QH_NATIVE_FOLDER>
• < WINDOWS_FOLDER>
• < SYSTEM32_FOLDER>
• < PROGRAM_FILES_FOLDER>
• < DRIVERS_FOLDER>
• < QH_ADMIN_FOLDER>
• < TEMP_FOLDER>
• < BOOT_DRIVE>
• < QH_CLIENTAGENT_FOLDER>
• < SYSTEMWOW64_DRIVE>
• < SYSTEM_DRIVE>
• < UPDMGR_FOLDER>
• < PATCH_MANAGEMENT_FOLDER>
• < PATCH_MANAGEMENT_CONTENT>

Registry Locations:

• < HKLM>
• < HKCU>
• < RUN>
• < SERVICES>

File and Folder Macros:

Registry Macros:

Trusted Processes

Use Trusted Processes to allow specific applications or processes to access protected paths without being restricted by Path Access Control.

To add a trusted process:

1. In the Trusted Process section, enter the Application Name.
2. Enter the Process Name or Path associated with the application.
3. Click Add.

The configured trusted process is added to the list and is allowed to access the protected paths.

Note: Add only applications or processes that you trust. A trusted process can access protected paths and may therefore bypass the restrictions applied by Path Access Control.

Importing Path Entries

The Import option enables you to add multiple protected paths in a single operation.

To import path entries:

1. Click Import.
2. Browse to and select the required .dat file.
3. Click Open.

The path entries from the selected file are added to the protected path list.

Exporting Path Entries

To export the configured path entries:

1. Click Export.
2. Save the generated .dat file to the required location.

You can use the exported file to import the same configuration into another policy or deployment.