PDA

View Full Version : Permit once?

tonyjl
December 7th, 2005, 06:31 AM
As AD logs the cmd line of appz such as svchost (see below),does that mean we can 'allow always'? or should we keep them as 'permit once' like in PG?
tonyjl
December 9th, 2005, 04:27 PM
Guess not,i'll leave them in permit once mode then :lurking:
Pilli
December 10th, 2005, 03:30 AM
You should be able to give those apps that create a command line the "Allow always" as the rule is for scvhosts only to allow the precise process as shown in the command line. As far as I know this is also applies to rundll32.

HTH Pilli
tonyjl
December 10th, 2005, 10:31 PM
-{ Quote: "You should be able to give those apps that create a command line the "Allow always" as the rule is for scvhosts only to allow the precise process as shown in the command line. As far as I know this is also applies to rundll32.

HTH Pilli" }-

Thanks Pilli,
Now all we need are the cmd lines to give permit once to :) . Have any ideas on where to look for info what cmd lines are used to do certain actions,for certain services,etc,etc.