Reference Guide

Manage Policies
Block
Alert monito
rs Office macros running in the environment.
Recommended for initial deployment.
Block allows Office macros
to run only from specific
folders. This should be used only after testing in Alert
mode.
Note:
Starting with Office 2013, macros are disabled by
default. Most of the time, users should not be required to
enable macros to view the content of an Office document.
Dell recommends enabling macros only for documents from
trusted users. Otherwise, macros should always be
disabled.
PowerShell Alert
Alert
B
lock
Alert (default)
- Monitors PowerShell scripts running in
the environment. Recommended for initial deployment.
Block
-
Allow PowerShell scripts to run only from specific
folders. This should be used only after testing in Alert
mode.
This policy does no
t apply to Mac clients.
PowerShell
Console
Allow
Allow
Block
Allow (default)
- Allows the PowerShell v3 console to be
launched.
Block
- Blocks the PowerShell v3 console from being
launched. Provides additional security by protecting
against the use of Pow
erShell one-liners.
Note: If this policy is set to Block and you use a script
that launches the PowerShell console, the script will
fail. It is recommended that users change their scripts to
invoke the PowerShell scripts, not the PowerShell console.
This p
olicy applies only to PowerShell v3 and does not
apply to Mac clients.
Enable Approve
Scripts in
Folders (and
Subfolders)
Not Selected
Selected
Not Selected
Allows scripts stored in specific folders to be
automatically approved to run. This policy must be
selected to use the Script Control Approve Scripts in
Folders (and Subfolders policy).
Approve Scripts
in Folders (and
Subfolders)
String
String
Folders specified in this policy are excluded from actions
performed based on the Script Control policy. This
exclusion extends to subfolders of folders that are
specified with this policy.
A folder must be specified using its
relative
path. A path
may not include the drive letter. Example:
\
Cases\ScriptsAllowed
A specified path may represent any of the following
:
- local drive path
- mapped network drive path
- universal naming convention (UNC) path
Quarantine String
String
The value of this policy includes a collection of hashes for portable executable
that need to be automatically quarantined within the Endpoi
nt Group or on
the specific Endpoint. This policy will force quarantine files based on a SHA256
hash of the specific portable executable.
202