I cant Block Anydesk from EndPoint Secure Application Blacklists

Dear, I have been trying to block the AnyDesk application from the Application Blacklists module in every possible way and I have not been able to. I wanted to ask here if there is a way to block this application from Application Blacklists.

Thanks

Hi,

Blocking AnyDesk or any other application from running on endpoints typically involves using endpoint security solutions that support application control or blacklisting capabilities.

Access Management Console: Log in to the management console of your endpoint security solution with administrative privileges.

Locate the option to add applications to a blacklist or blocklist.
Add AnyDesk to this list by specifying its executable file path or using its unique identifier (if supported by the endpoint security software).

Blocking AnyDesk using Sangfor Endpoint Secure can be a bit tricky, but here are some steps you can follow to ensure it’s properly blocked:

1. Application Control: Ensure that the application control feature is enabled. You can create a policy specifically to block AnyDesk by selecting it from the application database.
2. Port Blocking: AnyDesk uses several ports, including TCP 80, TCP 443, and TCP 6568. Blocking these ports can help prevent AnyDesk from establishing connections.
3. NGAF Configuration: If you’re using Sangfor NGAF, you can configure a rule to block AnyDesk. This involves specifying the AnyDesk application in the NGAF settings and setting it to block.
4. Endpoint Secure Integration: Make sure that Endpoint Secure is properly integrated with NGAF or IAG. This allows the endpoint to send information about running applications to NGAF, where you can create containment policies to block specific applications.

If these steps don’t resolve the issue, it might be helpful to check for any updates or patches for your Sangfor software, as there could be improvements or bug fixes related to application blocking.

Hi, as far as i know, this is possible only if you correlate sangfor es with ngaf and built an application control policy to block this specific application. This works only on clients that are connected to a network with ngaf  as firewall of course.

Hello,

you can reomve the Anydesk from the application blacklist policies.

go to Policies > App Control > Application Blacklist, search the policy thath include Anydesk inside it and then remove from the policy

hope this help

To block the AnyDesk application using the Application Blacklists module, you should ensure that the executable file (usually named AnyDesk.exe) and its related processes are identified and added to the blacklist. You might need to specify the application's signature or its unique identifiers if the module supports these options. If standard methods fail, consider using advanced options such as blocking the application's network access or using third-party endpoint protection tools to enforce the block.

Hi,

If you are using Sangfor NGAF, you may follow these steps

- Configure a Rule in Sangfor NGAF:
      - Specify the AnyDesk application in the rule.
      - Set the rule action to “block” for AnyDesk1.
- Block Ports:
      - AnyDesk uses these specific ports for communication.
         - TCP 80
         - TCP 443
         - TCP 6568 (unique port)
         - UDP ports 50001-50003 (for multicasting on the local network)

Hi,

You can block ports used by anydesk or block the application name on application blacklists.

To block the AnyDesk application using the Application Blacklists module, you can try adding the exact path of the executable file to the blacklist. The default path for AnyDesk is usually `C:\Program Files\AnyDesk\AnyDesk.exe`. However, if you're still having trouble, try adding the following settings: * Add a new rule with the "Pattern" set to `anydesk.exe` and the "Path" set to `C:\Program Files\AnyDesk\*` (note the wildcard at the end). * Alternatively, you can also specify the full path `C:\Program Files\AnyDesk\AnyDesk.exe` in the "Path" field. Make sure to save the changes after adding the rule and restart the VMware vCenter Server services for the changes to take effect.

To effectively block the AnyDesk application using the Application Blacklists module, ensure that you are correctly identifying the application executable or process name associated with AnyDesk. Typically, you need to specify the exact name or path of the executable file used by AnyDesk in the blacklist configuration. If AnyDesk continues to evade detection or blocking, consider checking if it's using a different executable name or if it's installed in a non-standard directory. Adjust your blacklist rules accordingly to cover all potential variations of AnyDesk's executable names or paths. Additionally, ensure that your firewall or endpoint security solution is updated with the latest application definitions to accurately detect and block AnyDesk.