Reference Guide

Security Management Server - AdminHelp v9.8
169
%SYSTEMROOT%\Security
The following directories have Category 3 exclusions:
<Encryption client install directory>\.dll.exe.sys.mac.ddp.tbp.wip.rty.nmd.inv.config.sdf.installstate
%SYSTEMROOT%\system32\drivers\CmgHiber.dat
Modifiers – What they are and what they do
The ^ character is the “Override” command. It causes the listed policy to override protected directories. It
may be followed by a “2” or a “3”, indicating the level of the override.
The @ character is the “At” command. It will cause the listed policy to be applied at the specified folder
location only (subdirectories of that folder will not be subject to that policy).
The - is the “Not” command. It will cause the listed policy to be an exclusion policy instead of an inclusion
policy.
Using the Override Modifier
The Override Modifier can be used to allow for inclusion or exclusion in cases where there is a higher level of
protection. The following are the different override levels supported:
^ Category 1 Override
^2 Category 2 Override
^3 Category 3 Override
Encrypting/Not Encrypting Extensions
In order to include or exclude filename extensions using encryption rules, use the following within your
rules:
• After specifying your directory location, use a semi-colon (;) before listing your extensions.
• After specifying your directory location, you do not need to list a trailing backslash (\).
• The period is used as a delineator. It is not meant to be used as “dot-extension.” However, you can
precede the first extension with a period.
• The Override command (^) can be used with extensions.
• The At command (@)can be used with extensions.
• The Not command (-) can be used with extensions.
• You can make any combination of the modifiers with an extension inclusion or exclusion.
Examples of extension inclusions/exclusion
C:\;doc.xls.ppt.docx.xlsx.pptx
What this does: On the C: drive, this encrypts all doc, docx, xls, xlsx, ppt, and pptx files that do not
exist within any protected directory.
^C:\;txt
What this does: On the C: drive, this encrypts all txt files that are not in a directory that has
protection of Category 1 or better.
-C:\;bat.exe.dll