I want to build a block list in EPM

Forum|Forum|9 hours ago
March 5, 2026
1 reply
11 views

tclowater
BeyondTrust Employee

For those who are looking to start out on building block lists for EPM, below are some tips and resources available.

Analytics can shift this exercise from ‘blocking by vibes’ to data-informed changes.

Tips for Implementing a Block Rule:

Check your analytics for application definitions that match your anticipated block rule
- This can help determine estimated impact
Check your policy for allow rules that may match your block (either on purpose or by accident)
- If so, then your allow or block may need to be altered to not conflict
Block Rules are the only time you’re going to want to be more generic, and typically the widest net possible. It’s the opposite of allow rules where we recommend more than one definition
- Examples:
  - One rule for the Publisher
  - One rule for the file name of the executable
  - One rule for the Product Name
Block rules will only block what can be managed by EPM - seems redundant but a general guide I have is that if the configuration of a function is done elsewhere, then EPM may not be the only/best space to place the block rule (e.g. browser extensions)
Optionally: put in a ‘monitoring’ block rule to audit everything that hits the rule so you’ll have better visibility of current usage in the environment in the case that events are being captured in a rule without analytics configured.

Additional Resources:

Ringed testing approaches: EPM Saas : Packages, Policies, and Preferable Practices | Community

If test groups need to be made and bulk move systems: Bulk move computers to different computer groups with API methods | Community

Kick Start Approach for EPM: Kick Start to EPM Windows & mac OS | Community

KB0017838 - How to create policy rules in EPM - Best practice for policy rule creation (application & On-Demand) - https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0017838

KB0017940 - Best Practices when using the QuickStart for Windows policy template - https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0017940

J

+4

Jens Hansen
Guru
Forum|Forum|9 hours ago
March 5, 2026

A few things to add here.

Don’t block anything using a clean HASH, Blocks are typically the first rules in policy and will force the EPM Client to calculate HASH on everything. it will slow down your Windows Systems.

Then get a Virtual Sandbox with the EPM Client installed and use that for generating events from software we do not want to run.
Once done, revert your snapshot we just polluted it with unwanted software and created rules to block them.
Test and validate your blocks.

The use of Source URL is only persistent on NTFS Drives & shares, so if using SourcUrl for blocking, be aware some cloud file services strip that from the files. that include the thick clients of BOX, Google Drive etc. Source URL is also only added form Edge, Chrome but seem to work without Chromium bases browsers, and legacy IE.

Then when creating block-listing think of the criteria a user would not be able to change.
Product Name, Product Description, Publisher, versions etc.

Note: that tools does exist to allow change of criteria, but will render the signing certificate invalid.

KR Jens