I saw 5 lines of this message in the log: [end task] c:\windows\explorer.exe [1012] was blocked from terminating an application using end task. What's odd is that explorer.exe is in the list of pg's programs and has 'terminate' among its allowed privileges. Did I misunderstand the help file? I thought it said that allowed privileges take precedence over blocked privileges, so shouldn't explorer.exe be allowed to terminate anything?
Your understanding is correct I think It is the logging that is a bit obscure, this is dealt with in the new version 1.250 due for release within the next few days. The new logging should enable you to see what explorer is trying to End task which will help with your rule making.
End Task isn't part of the normal "Terminate" allow/block. It is handled by a General Protection option and when that is enabled no End Task termination can occur. Explorer will sometimes try to End Task applications which are not responsive which is why you got the log. -Jason-
