Prevent Read and Write Access to File Types or Locations

You can restrict access to specific file types or locations using Privilege Manager. To prevent read / write access to file types or locations, do the following steps:

  • Create a Deny File Access Action
  • Create an Application Control Policy to which you will add the Deny File Access Action
  • Test the privilege reduction you've just created

In the following scenario you will create a Microsoft Word document and save it on your machine to:

c:\company invoices\invoice 101.doc

Create a Deny File Access Action

  1. Navigate to Admin | Actions.

  2. Search for Deny File Access Action.

  3. Click on Deny Read/Write Access to Microsoft Office Document Files.

    select

  4. Click on Duplicate.

  5. Name the new copy of the action and click Create.

  6. Enter the path of the file location (e.g., c:\company invoices), for our example we also set the switch to include subdirectories.

    edit

  7. Click Save Changes.

Create an Application Control Policy

  1. Under your Computer Group select Application Policies.

  2. Click Create Policy.

  3. Select Skip the wizard, take me to a blank policy.

  4. Add Name and Description, click Create Policy.

    new

  5. Under Conditions | Applications Targeted, click Add Application Targeted.

  6. Search for word and add the MS Word filter.

  7. Click Update.

  8. Under Actions, click Add Actions.

  9. Search for and add your Deny Read/Write Access to Microsoft Office Document Files Action.

  10. Click Update.

    policy

  11. Click Save Changes.

  12. Set the Inactive switch to Active.

  13. Next to Deployment, click the i icon and run the Resource and Collection Targeting Update. After you run update, the appropriate endpoints will receive the new policy.

Test Access

Verify that the restricted access you set up was successful by applying the following tests:

  • In Microsoft Word, open C:\company invoices\invoice 101.doc. The file is read only and can't be modified.
  • Create a new document and attempt to save it to c:\company invoices\. You will be unable to open it and will receive a File Permission error.
  • Verify that you can create or modify a Word document in a different directory.
  • In Microsoft Excel, save a spreadsheet to c:\company invoices\invoice 101.doc. The permissions are limited to Microsoft Word.