| Event Id | 865 |
| Source | Software Restriction Policy |
| Description | Access to C:\Program Files\Messenger\msmsgs.exe has been restricted by your Administrator by the default software restriction policy level. This event is logged when a user starts a program that is disallowed by the default security level. |
| Event Information | Cause: code is not the only threat—many non-malicious software applications also cause problems. Any software not known and supported by an organization can conflict with other applications or change crucial configuration information. Software restriction policies were designed to help organizations control not just hostile code, but any unknown code—malicious or otherwise. Resolution: information for troubleshooting problems with software restriction policies.Default Settings for a Software Restriction Policy.The default settings for a software restriction policy include the following: • Default Security Level: Unrestricted • Enforcement options: . Apply to Files: All software files except libraries (such as DLLs) • Apply to Users: All users • Additional Rules: none • Designated File Types: See Table 11. Default Designated File Types in the Appendix below. • Trusted Publishers: • Select Trusted Publishers: End Users • Publisher Certificate Revocation Checking: Not selected • Timestamp Certificate Revocation Checking: Not selected Error Message: When a program is disallowed due to a software restriction policy, an error code is received by the launching program. If the launching program returns the system message for this error code, you will see the following message: "Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator," |
| Reference Links | event id:865 source Software Restriction Policy |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.