Behavior Monitoring

Behavior monitoring constantly monitors endpoints for unusual modifications to the operating system or on installed software.

Administrators (or users) can create exception lists that allow certain programs to start despite violating a monitored change, or completely block certain programs.

In addition, programs with a valid digital signature or have been certified are always allowed to start. Use Core Protection Module - Enable Certified Safe Software Service.

The Behavior Monitoring capabilities of Core Protection Module now support 64-bit versions of the following platforms:

  • Windows™ Server 2012
  • Windows 8
  • Windows Server 2008
  • Windows 7
  • Windows Vista with SP1 (or later)
  • Windows 10
Note: To ensure that this feature does not interfere with critical applications, CPM leaves this feature disabled on server platforms. To enable this feature on a server computer, enable Core Protection Module - Enable Unauthorized Change Prevention Service.