How do I exempt a particular computer from application denial?

artsky · 07-16-2007, 08:51 PM

Hi Guys,

This is my first post. My boss has instructed me to block all skype applications from running. I have implemented the rule and now skype cannot be used.

However, there are certain users that need to be exempted from this rule. I'm trying to find out how can I easily add a certain user or computername so that they can use skype while the others cant.

Kindly help me.

Thanks!!

sporta · 07-17-2007, 03:05 AM

hi artsky,

For you to be able to excempt certain computers from being denied, you have to create a collection of computers with Skype application and list down from the exclusion list those computers you want to exclude.

Hope this helps.

Nick · 07-17-2007, 07:54 AM

Sporta has the right answer.

You will want to create/clone a collection (maybe call it Skype Denied) and then edit that collection.

Once you are in edit mode there is a section for "Explicit Inclusions and Exclusions". From here you could use a collection as an exclusion to the Skype Denied collection (maybe call it Skype Allowed).

artsky · 07-17-2007, 08:20 PM

thank you much for the replies, it became clearer now.

now, i only have one problem. he wants me to enable skype when it is outside our company network (e.g. at home). but im sure this isn't possible.

maybe in the future, application denial can also be set to such parameters.

thank you very much!

bgreen · 08-13-2007, 04:39 PM

The closest thing you could do would be to set times when Skype could and could not be used. I guess it doesn't really help in the scenario where a laptop user is working from home during normal business hours.

Honestly, if the end goal is for people to be able to use it anytime but when they're in the office, you're better off restricting access to skype services via a more network-oriented solution. My first recommendation would be to block the Skype services on the corporate firewall.

Brandon · 08-13-2007, 05:38 PM

Just clone the collection then join it to the TCPIP table and use a WHERE Alias.[IP Address] NOT LIKE '1.2%' This would only work if you use VPN or something where the IP would update and show that they are not at work.

Otherwise it sounds like you need the Endpoint Security Solution(ESS). If I recall you can block applications with that? That determines what is allowed based off 'N' factors such as Gateway, subnet, ip etc etc. If they meet enough factors and are in the 'WAN/NOT AT WORK' ACL, then you don't deny applications. Again I have only used this in the lab, but if I recall it can do what you want.