Page 1 of 1

SM - Blocking Network Connection via Process Monitor

Posted: Wed, 07 Aug 2019, 05:37
by tcsdi_support1
Hi Support,

We tried to use a Monitoring policy to kill the process like Network Connection and we put ncpa.cpl on the process name.

But when we open Network Connection nothing happens SM did not kill the process and also no alert on the "Monitor" Tab

Kindly see the picture below:

Image


Best Regards,
TCSDI

Re: SM - Blocking Network Connection via Process Monitor

Posted: Wed, 07 Aug 2019, 09:07
by Darth Panda
Hi tcsdi_support1,

What happen if you execute ncpa.cpl?

Re: SM - Blocking Network Connection via Process Monitor

Posted: Wed, 07 Aug 2019, 09:25
by tcsdi_support1
Hi Darth,

When we open or execute the ncpa.cpl it will automatically kill the process or "end process" which is not happening and also no alert on the SM - "Monitor" tab

We also include Viber.exe on the Monitoring Process, when we open Viber SM will kill/end process the Viber and it appeared on the Monitor tab

Re: SM - Blocking Network Connection via Process Monitor

Posted: Thu, 08 Aug 2019, 12:26
by Darth Panda
Hi tcsdi_support1,

I'm sorry, but I don't understand. When you execute ncpa.cpl, is the process killed?
If you set the alert to send an email, do you receive it correctly?

Re: SM - Blocking Network Connection via Process Monitor

Posted: Fri, 09 Aug 2019, 03:51
by tcsdi_support1
Hi Darth,


1.) I'm sorry, but I don't understand. When you execute ncpa.cpl, is the process killed?
= The ncpa.cpl process are not killed

2.) If you set the alert to send an email, do you receive it correctly?
= I already set the alert to send an email but, No email received. Also on the console "Monitor"

Re: SM - Blocking Network Connection via Process Monitor

Posted: Fri, 09 Aug 2019, 11:26
by Darth Panda
Hi tcsdi_support1,


I have been testing and the problem is that when you run ncpa.cpl the process that loads is explorer.exe, so a process monitor will not close the Network Connections window.

Re: SM - Blocking Network Connection via Process Monitor

Posted: Wed, 14 Aug 2019, 11:24
by tcsdi_support1
Hi Darth,

Thank you for your response.

Is there any possible way on how to kill the ncpa.cpl "Network Connections" window?

Looking forward to your reply.

Best Regards,
TCSDI

Re: SM - Blocking Network Connection via Process Monitor

Posted: Wed, 14 Aug 2019, 12:30
by Darth Panda
Hi,

Not from our side, ncpa.cpl it's not a process, it's a command that the operation system use it to open "Network Connection" windows with the process explorer.exe.

Maybe you can avoid that behaviour with a window's GPO policy..

Regards,

Darth