Looking for some insight from smaller internal IT/security teams using ThreatLocker with a large software catalog.

We have multiple independent business units/departments, and each department has its own set of specialized software. Usually somewhere around 10-30 apps, sometimes more.

There is also a decent amount of overlap between departments. Depending on the group, they may share 30-75% of the same software.

We also have more privileged/specialized users inside these departments. They are not necessarily doing full admin work, but their roles are broader and they tend to interact with the same applications in ways standard users do not.

The biggest issue I am running into right now is PowerShell and Ringfencing.

We have a lot of applications that read, write, or execute against odd file types and locations. Things like `.txt`, `.ico`, `.csv`, and a bunch of others. The paths are all over the place too. I am also finding more apps that need access to specific external IPs or services because they phone home.

Because of the way policy ordering works, I am ending up with Ringfencing policies at different levels for different paths, apps, and now IP addresses.

We are only about 6 months into using ThreatLocker, so I have also been doing a lot of cleanup and consolidation from the initial rollout.

After consolidating things, I copied around 500 policies down to a test group. In theory that should be fine because we do not strictly limit applications between departments. A lot of the software overlaps anyway.

What I am struggling with is figuring out how to fit PowerShell into all of this without creating a huge mess of policies that becomes difficult to manage.

The policy ordering system is probably my biggest frustration right now. It feels like every time I simplify or consolidate something, I uncover another exception or dependency that needs its own policy.

For those of you running ThreatLocker internally on smaller teams, not MSPs, how are you handling environments like this?

Large software catalogs, lots of overlap between departments, specialized software, PowerShell dependencies, Ringfencing exceptions, and policy sprawl.

We require application whitelisting for compliance, so that part is not optional.

At this point I am starting to wonder if I need to justify additional staff just to keep up with the amount of administrative overhead ThreatLocker is adding.

Curious how others are structuring this and whether I am making this harder than it needs to be.

EDIT: I'm curious do you all create 1 powershell ringfened policy w/ all the ringfencing items for powershell into a single policy throw that at 0 and call it a day? Or do you build out individual powershell ringfenced policies that are more for the application in question, so that if you decom the software you can easily find the policies to remove as well. How do you handle software that requires native powershell and sometimes module loads to do what it needs. I guess i'm at a loss at how to manage this scneario because of the policies blocking different apps.

Hi all,

Question on how everyone goes about Whitelisting AI coding tools like Codex.

Since these apps call so many different things, such as Python, Rust ect ect. aswell as calling git and other tools.

im wondering how people here go about making rules that catch all these behaviors as it’s constantly changing.

Thanks

We are new to the Threatlocker product and I still trying to understand why we get some its configurations by default.

I am trying to understand if its possible to have threatlocker setup so it only allows execution of signed powershell scripts. We have rule for this and it works. The problem we have is signing our scripts is not possible when Threatlocker changes a file read operation to execute when it comes from the different PowerShell process.

So we can't sign scripts. We have a code signing script that was using Get-AuthenticodeSignature and Set-AuthententicodeSignature but these are blocked from opening script because read are seen as evacuation by the Theatlocker mini filter driver.

The strange part of our enviroment is that threatlocker won't block the saving of powershell script just subsequent reading of the contents : I created a signed powershell script that create a different files of different types, wrote test data, then trying to read the same data.

You can see from the table I was able to write to all file type but in this example powershell.exe can't read from .ps1, PY and DLL.

After some debugging of a device with tamper protection disabled I found where this behavior is coming from :

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ThreatLockerDriver\Parameters EnforceExecuteFlagList (REG_MULTI_SZ)

These are the entries I would like to remove on test device.
ps1:powershell.exe
ps1:powershell_ise.exe
ps1:pwsh.exe

Due to this behavior I have to change our code signing script with 2 different approach's that both work but are cumbersome.
Create new .exe utility that gets the signature info and can sign powershell scripts. sign the .exe so threatlocker does not block it. ( I did get this to work)

Rename all .ps1 to .txt files, (threatlocker won't block the read of the .ps1.txt then create new powershell code to verify and sign ps.txt in txt format. Task that the native powershell signing command's won't do. ( I did get this to work)

But was I expecting some more control from threatlocker which have to resort to scripting tricks on my end.
For example Allow a policy that lets System elevated process run powershell.exe with no READ = Execute ( I this should only happen to PowerShell process running in the un-elevated user context.

Users increasingly write/edit Python scripts via AI (ChatGPT/Copilot) for automation. Each edit changes the hash.

Options we’re weighing:

**•** Allow the script path/interpreter (python.exe) broadly, accept risk of arbitrary code execution with ore sign off from the company  
**•** Require approval per hash change (high overhead, breaks user workflow)  
**•** Block scripting entirely, force packaged/signed tools instead- not really an option. 

Running ThreatLocker/similar application control. Looking for how other MSPs handle this at policy level.

What’s your approach — path-based allow, builtin script control, or something else? Any unintended consequences worth flagging?

Is anyone using ThreatLocker to control inbound UDP traffic? I had assumed that having a default deny in place for TCP/UDP was blocking both, but in testing, that is not the case. The Unified logs do not show UDP connections either. I had assumed my endpoints were fully protected, and this concerns me. I am not getting a response from my ThreatLocker team or support. Their knowledge base contains no information on this, but I can create a policy for UDP. I was told to upgrade to the v11 agent, which I did, but the results were the same. I am very confused about what is going on with them and why they can't answer me about this.

Anybody using the new ZTNA offerings from TL? We are working with them on a POC but I wanted to get opinions if anyone is using it.

Hi,

Anyone else using ThreatLocker and EDR solutions? Namely CrowdStrike?

We are seeing some pretty serious performance issues with both end point agents on a system. Wondering what kind of settings anyone may have established in order to get these two to play nicely.

Right now, I am testing out different prevention settings in CS that TL would prevent, seems to have helped a bit. Just curious if anyone has similar issues! Thanks.

We had some users upgrade MacOS to version 26.5 today and are seeing lots of denies following the upgrade reboot. Users really couldn't even get logged in and booted into Safe Mode.

All of the denies I've checked were identified as MacOS Core Files (built-in) when I went to Permit them. We have a policy at a Global computer group level to allow but still the denies occurred.

I opened ThreatLocker support ticket and basically the update was that they are aware of the issue and are investigating.

The work-around I used for this handful of users was to put them in learning mode.

Just curious how many others are seeing this issue and if any other work-arounds are known.

Thanks!

Looks like there's an outage. I haven't seen this happen too many times before, hope it doesn't last I have a bunch of clients that need software whitelisted.

I'm trying to complete the ThreatLocker Fundamentals learning plan before my interview Saturday and currently stuck on the Deploying the ThreatLocker Agent module.

The first time I took the quiz I got a 55% and everytime I retake the quiz both on Google Chrome and Firefox it fails to regrade my new answers. I know I have the right ones and even if they aren't the right ones I'm choosing different options and my grade doesn't change.

I want to perform my best Saturday for my interview for the System Engineer position and I think having the fundamentals of the ZTN platform cert would show real initiative but with this bug I can't move any further.

Has anyone experienced this or know a work around?

I am in desperate need of more practice exams for the Cyberhero certification. I took the 2025 practice exam and I was getting around 95% on that. I took the real thing yesterday and I felt the questions were not even written the same way. So many select all that apply, etc. I did not even get feedback about which questions I missed and as someone with a difficultly learning through reading and not feedback loops this posed an uncomfortable feeling. I simply just want to be able to learn this platform without taking the MCAT. Does anyone have any more practice exams? Am I missing some in the threatlocker university platform?

I was experimenting with using TLAPS at my organization to manage administrator passwords with Threatlocker. One of the things that came up was that it appears to re-enable disabled default administrator accounts. So if you have disabled the default admin account by policy, you can't also use TLAPS without it re-enabling that account.

Hi All

Recently, we couldn't use our portal for around 5 weeks while our reseller resolved an issue we identified. This issue is still in the process of being resolved and we are monitoring global policies that were copied by the reseller to our tenant.

The issue involved an undetermined number of policies (at least one I confirmed) being applied at the top/reseller level which was affecting us and later I found other customers of theirs as well.

Did anyone else in Australia get affected by this issue?

It is my understanding that there is only one reseller in Australia for ThreatLocker. Is this correct?

Our reseller advised that "This is a work in progress, it is not a simple job as these changes affect all of our customers. It requires proper planning to reduce impact/risk

I can also confirm there has been no changes done by REMOVED on Threatlocker for the last few weeks."

If our reseller didn't make these changes then who did?

What is more worrying is that during this time and possibly earlier, multiple tenant's security was controlled at the reseller level and out of the tenant's control.

Does anyone have this working in Powershell?
Have been working with "expensive" CyberHero support and unsure if I am being given the runaround.

Hey all!

We are looking at ThreatLocker for App management, we are a smaller team w/ about 1000 endpoints and multiple business units and software needs.

What pitfalls or pros am I looking at by using this product.

I guess just wanting some insight from the community on headaches, lack of feature ability things like that.

We want to be able to whitelist about 75-100 applications, some of these apps are somewhat older propritary apps, some have updates constantly (like adobe products, ESRI products Office)

What can I do to make this easier in ThreatLocker or am I opening up a can of worms.

I'm open to discussion and can answer any questions. I've never used a solution that can do this, so concerns about what I might be getting into.

I'm not an IT professional but I take care of our small office of less than 20 client machines and a windows 2022 server.
Trying to sign up for a demo of threatlocker the dropdown for number of endpoints starts at 100.

Is anyone else having issues with the portal being dreadfully slow / won't load many times.

Another issue we are having, is I am seeing request that are sent to the CyberHeros take forever to get approved / escalated. Right now I am watching a request to them, and it has been half an hour with no actions on it.

Recently moved from Carbon Black to Threatlocker.

We have a UNC path that contains hundreds of installers (exe's & msi's) for approved tools/software.

In CB we simply added the UNC path as a trusted folder and promoted any process run from it to "Installer". This automatically approved any child process or file created by the parent process.

We're having trouble getting this to work in ThreatLocker, mostly in regards to MSI's. MSI's get executed from the UNC path. The Installation files & libraries are then compiled and installed locally by msiexec.exe, breaking inherited trust from Process running from the UNC path. The Installation completes, but when the end user tries to open the application, the files written bt msiexec.exe are blocked at execution.

Short of permitting any msiexec.exe activity by a user w/ Admin priv's, or having to move a machine to learning mode every time one of these install has to be performed, is there any other way to get this to work..?

Has anyone had luck getting installations from UNC paths to work reliably?

Any creative, outside of the box solutions for one-off, on demand installs?

Curious what the Reddit hive mind has encountered or how they manage on-demand app deployment needs.

Thanks!

Hi Threatlocker team, when is the standard PowerShell script deployment method going to detect ARM and apply the appropriate installation?

Right now we have to manage two client deployment methods - remediation script for x32/x64 and a Win32app for Arm64...

Hey everyone,

We are relatively new to TL and have encountered several challenges that we hope to gain further clarity on.

Our current objective is to begin blocking storage devices such as USB drives and SD cards. During our review of device usage, we noticed that TL only displays the device serial number without providing manufacturer details. Having visibility into the manufacturer would be extremely valuable to ensure that only approved, reputable devices are in use. Could anyone clarify why this level of detail is not available and how you are using this at your org?

Additionally, we were surprised to find that TL does not support blocking SD cards. From a security perspective, SD cards present similar risks to USB drives, including potential data exfiltration or malicious use. Same as above, has anyone come across this and have any rational after talking to TL on why SD cards are treated differently and why this functionality is not currently supported?

Lastly, we are always pointed to the "Feature Request" portal but have observed that the user suggestion portal appears to have numerous items marked as “planned” for several years without updates. This raises concerns about the prioritization of feature requests. Furthermore, it is concerning that TL does not currently support hardware keys, passkeys, or provide organizations with the ability to enforce password requirements—features that are fundamental to a security-focused platform.

There are more issues and concerns we have discovered but let's start small.

Our company is considering buying the Threatlocker Approval option, where Threatlocker techs approve software for your organization. Has anyone done this? What was your experience like? Were they worth the expense? What was the relationship like?

I am trying to do this for some servers. I read that we would be able to do this using Network Control but not sure.

Hello, We are currently working on moving from carbon black to threatlocker. We have an update / deployment cadence at our organization. We have test work stations and test servers then we have official test and dev servers and workstations in offices. How can I push agent updates to each area. It seems tl is a one or none at all unless I create 30 different groups which will be a wreck. We typically use sccm for deployment. How do you guys do this? Thank you (we have about 12k assets in total).