You're very welcome, my please. I am glad that you have that working well now. You can also take that same approach to Program Files and ProgramData if you wanted to lock it down more. @novirusthanks I agree 100% with @Cutting_Edgetech here. This can be extremely beneficial for the user to test their rule set initially but also determine what else may need to be added to their rules. So in this case, it would log what would normally be blocked but not actually block.