Identified files are then collected into one or more file groups, custom or predefined -- for example, 16-bit, Accessories, Boot files, Logon files, Windows Common, or a trust-but-watch lists. File groups can be further subdivided. You could have, say, a collective group called Adobe that covers all Adobe files and subgroups for each of Adobe's various products, such as Adobe Reader and Adobe AIR. Lumension's Database Explorer lets the administrator view the various file groups and add identified files screen image.
Users, computers, and groups can be imported from the local Windows SAM (Security Accounts Manager) database, Active Directory, or Novell's eDirectory (Lumension and SignaCert are the only products in this review to integrate with eDirectory), and then linked to one or more file groups, along with whether that particular file group can be authorized (allowed to run) or unauthorized (prevent execution). Any file or file group not explicitly marked as Authorized is considered unauthorized. Like Bit9's Parity, Lumension can send an alert if a particular unauthorized executable becomes popular with too many users too fast. Called "Spread Check" in Lumension, this feature is designed to contain malware outbreaks.
Dialog messages are customizable. Users and administrators can quickly deny all unauthorized applications, modules (Visual Basic), and scripts (JavaScript and VBScript only) in an emergency. Each managed computer checks in for a new policy at every boot-up, and if the user is offline and unable to connect to the network, an admin can provide a new set of permissions (execute or not execute) that can be manually imported.
Lumension has some of the strongest reporting in this review. Each log transaction is detailed and stored locally on the client until transmitted to the central database, which runs Microsoft SQL Server 2005 or 2008, 32-bit or 64-bit, or Express. Administrators can use regular SQL query tools and reports to extract events or export them to syslog.
While the Report menu option shows system status information, such as when the client's policy was last updated or which server the client got its policy from, queries are both numerous and extremely flexible in Lumension's Log Explorer. Log Explorer shows whitelisting events and provides a good number of "query templates" that are useful in pulling needed information out of the log file. Each built-in query can easily be edited by clicking and choosing various fields of data, as well as dates, conditions, schedules, and formats (XML, CSV, HTLM). Plus, you can right-click any event and turn it into a blacklisted or whitelisted file belonging to one or more file groups screen image.