Skip to main content

Configuring Global Settings and Exclusions Policies

Global Settings

Global Settings control whether Secure Download Manager is active, how the block notification appears to users, and whether email alerts are sent when a file is blocked.

note

Global Settings are collection-level settings and apply to the Computer side only. They don't support Scope or Item Level Targeting. Only one Global Settings instance is allowed per collection.

To open Global Settings:

  1. In the Local Group Policy Editor, navigate to Computer Configuration | PolicyPak | Secure Download Manager.
  2. In the Actions panel, click Specify Global Settings P....
  3. The Secure Download Manager General Settings dialog opens.

General Tab

The General tab contains three groups of settings.

Main Settings

SettingDescription
Enable Secure Download ManagerSet to YES to activate the component. When set to NO, the component is installed but inactive — downloaded files execute normally.
Block notification should close in secondsNumber of seconds before the block notification auto-dismisses. Default: 60. Uncheck to require the user to close the notification manually.

Notification Options

SettingDescription
Show Management NotificationsSet to YES to display a notification dialog to the user when a file is blocked. Set to NO to block silently.

Text Customization

You can replace the default notification text with messaging tailored to your organization. Check the checkbox next to each field you want to customize, then enter your text.

FieldDescription
Use a customized window titleReplaces the default title of the notification window.
Use a customized notification titleReplaces the headline inside the notification.
Use a customized messageReplaces the body text of the notification.

Click Edit... to open the text editor for the message body.

Supported variables in custom text fields

Custom text fields support all standard process variables, plus the following Secure Download Manager-specific variables:

VariableDescription
%DOWNLOADED_FILE_NAME%The name of the downloaded file that was blocked.
%DOWNLOADED_FILE_SOURCE_URL%The URL the file was downloaded from.
%DOWNLOADED_FILE_ZONE_ID%The Windows Security Zone ID assigned to the file at download time.

Example message using variables:

The file "%DOWNLOADED_FILE_NAME%" was downloaded from %DOWNLOADED_FILE_SOURCE_URL%
and has been blocked by Group Policy (Zone ID: %DOWNLOADED_FILE_ZONE_ID%).
To request an exception, contact your IT helpdesk.
tip

Including %DOWNLOADED_FILE_SOURCE_URL% in the notification message helps users understand why a specific file was blocked and gives them the information they need when submitting a helpdesk request.

Email Tab

The Email tab configures automatic alerts sent when a file execution is blocked. The alert contains extended information about the process and the blocked network activity.

SettingDescription
Use of emailSelect the delivery mode from the dropdown. Set to Not Configured to disable email alerts.
Send ToOne or more recipient email addresses, separated by semicolons (;).
Open the message in Notepad insteadOpens the alert as a local text file in Notepad rather than sending it by email. Useful for testing or air-gapped environments.

Click Save when finished.

note

Global Settings are included in the ADM report generated by PolicyPak. All configured values — including the enabled state, notification settings, and email configuration — appear in the report alongside other component settings.

Exclusions Policies

An Exclusions Policy is a rule that permits execution of a downloaded file that matches a specific source URL and/or file extension. Without a matching exclusion, Secure Download Manager blocks all files marked as downloaded from the internet.

You can apply Exclusions Policies per machine or per user, and they support Item Level Targeting.

To create an Exclusions Policy:

  1. In the Actions panel, click Add New Exclusions Policy.
  2. The Secure Download Manager Exclusions Policy Editor dialog opens.

Exclusions Policy Fields

Policy Name

Enter a descriptive name for this exclusion. Use names that identify the business reason, for example Allow downloads from Azure DevOps or Allow Office document types.

State

ValueBehavior
EnabledThe exclusion is active and evaluated against incoming download events.
DisabledThe exclusion is saved but not applied. Use this to suspend an exclusion without deleting it.

Scope

Controls which processes this exclusion covers:

ValueBehavior
User processesThe exclusion applies only to executions in the context of the logged-on user.
User and System processesThe exclusion applies to both user-initiated and system-initiated executions. Recommended for most environments.

You can also switch this setting per machine or per user depending on how the policy is delivered (Computer Configuration vs. User Configuration).

note

User and System processes doesn't extend exclusions to downloads executed under the SYSTEM account. If you need to allow execution for a SYSTEM-initiated download, test that scenario separately rather than assuming this scope covers it.

Enable logging for this policy

Check this box to write a log entry each time this exclusion is matched. Recommended during initial rollout to confirm exclusions are working as expected.

URL Pattern

The URL pattern of the source file. You can use asterisks (*) as wildcards.

ExampleMatches
*dev.azure.com/NetwrixCorporation/*Any file from the Netwrix Azure DevOps organization
https://internal.contoso.com/downloads/*All files from that specific path
*.contoso.comAll subdomains of contoso.com

Leave this field empty to match any source URL (combined with a File Extensions filter).

File Extensions

One or more file extension patterns to allow. You can use asterisks as wildcards. Click Select... to choose from a list of common extensions.

ExampleMatches
exeExecutable files
*.DOC, *.XLS, *.DOCXMicrosoft Office document formats
pdfPDF files

Leave this field empty to match any file type (combined with a URL Pattern filter).

note

Secure Download Manager blocks all files marked as downloaded from the internet by default. Exclusions let you define precise exceptions — allowing specific file types from trusted sources while keeping everything else locked down. For the strongest protection, always combine a URL Pattern with a File Extensions filter rather than leaving one field empty.

Comment

Optional free-text field for internal notes about the purpose of this exclusion.

Item Level Targeting

Click Item Level Targeting to apply this exclusion only when specific conditions are met — for example, only for members of a specific security group, only on machines in a certain IP range, or only on a particular OS version. This uses the same targeting engine as Group Policy Preferences.

note

Exclusions Policies are included in the ADM report generated by PolicyPak. All fields — including URL Pattern, File Extensions, and Item Level Targeting conditions — appear in the report.

Click OK to save the exclusion policy.

Applying and Testing

  1. Close the Group Policy editor and confirm the GPO is linked and enabled.
  2. On a test endpoint, run gpupdate /force from an elevated command prompt.
  3. Open a supported browser and download a test executable from a non-excluded website.
  4. Attempt to run the file directly from the browser's download notification.
  5. Confirm the block notification appears (if Show Management Notifications is YES).
  6. Download a file from an excluded URL or with an excluded extension and confirm it executes normally.