Export a list the blocked applications from application control

Hi,

I can give you some information that might help.  It could be rolled up into a script I suppose to dump something slightly more meaningful.

This file should have the latest data regarding application control and feeds the UI indirectly:

C:\ProgramData\Sophos\Sophos Endpoint Management\[ver]\Updates\Secure\SDFs\SophosMA\sec\MSDC\vvf.xml

For example CRMTool cat has an ID of 47:

<vtyp:subtype sid="CRMTool" id="47" typeid="5">

You can use the ExportConfig.exe tool to export the Sophos Application Control (SAC) policy to XML, e.g.

"C:\Program Files (x86)\Sophos\Enterprise Console\ExportConfig.exe" -type SAC -policy test

So if you have blocked certain items in a group, then you will see the applications individually.  E.g. 7-Zip above.  If you have blocked the whole group then you just get the group ID.

Hopefully this is something of use although not a straight answer as such.

Regards,
Jak

Hi Jak,

Just another question about application control. I have authorized a group "System Tools" (group id 54).

Is there a way to show all Authorized groups with the allowed applications?

I know when you have blocked the whole group you just get the group ID, but when you have authorized the whole group you don't see the Allowed groups (ID) in the SAC policy XML file.

Regards,

Jeffrey

Hi Jak,

Just another question about application control. I have authorized a group "System Tools" (group id 54).

Is there a way to show all Authorized groups with the allowed applications?

I know when you have blocked the whole group you just get the group ID, but when you have authorized the whole group you don't see the Allowed groups (ID) in the SAC policy XML file.

Regards,

Jeffrey