Configuring Global Settings and Exclusions Policies
Global Settings
Global Settings control whether Secure Download Manager is active, how the block notification appears to users, and whether email alerts are sent when a file is blocked.
Global Settings are collection-level settings and apply to the Computer side only. They don't support Scope or Item Level Targeting. Only one Global Settings instance is allowed per collection.
To open Global Settings:
- In the Local Group Policy Editor, navigate to Computer Configuration | PolicyPak | Secure Download Manager.
- In the Actions panel, click Specify Global Settings P....
- The Secure Download Manager General Settings dialog opens.
General Tab
The General tab contains three groups of settings.
Main Settings
| Setting | Description |
|---|---|
| Enable Secure Download Manager | Set to YES to activate the component. When set to NO, the component is installed but inactive — downloaded files execute normally. |
| Block notification should close in seconds | Number of seconds before the block notification auto-dismisses. Default: 60. Uncheck to require the user to close the notification manually. |
Notification Options
| Setting | Description |
|---|---|
| Show Management Notifications | Set to YES to display a notification dialog to the user when a file is blocked. Set to NO to block silently. |
Text Customization
You can replace the default notification text with messaging tailored to your organization. Check the checkbox next to each field you want to customize, then enter your text.
| Field | Description |
|---|---|
| Use a customized window title | Replaces the default title of the notification window. |
| Use a customized notification title | Replaces the headline inside the notification. |
| Use a customized message | Replaces the body text of the notification. |
Click Edit... to open the text editor for the message body.
Supported variables in custom text fields
Custom text fields support all standard process variables, plus the following Secure Download Manager-specific variables:
| Variable | Description |
|---|---|
%DOWNLOADED_FILE_NAME% | The name of the downloaded file that was blocked. |
%DOWNLOADED_FILE_SOURCE_URL% | The URL the file was downloaded from. |
%DOWNLOADED_FILE_ZONE_ID% | The Windows Security Zone ID assigned to the file at download time. |
Example message using variables:
The file "%DOWNLOADED_FILE_NAME%" was downloaded from %DOWNLOADED_FILE_SOURCE_URL%
and has been blocked by Group Policy (Zone ID: %DOWNLOADED_FILE_ZONE_ID%).
To request an exception, contact your IT helpdesk.
Including %DOWNLOADED_FILE_SOURCE_URL% in the notification message helps users understand
why a specific file was blocked and gives them the information they need when submitting a
helpdesk request.
Email Tab
The Email tab configures automatic alerts sent when a file execution is blocked. The alert contains extended information about the process and the blocked network activity.
| Setting | Description |
|---|---|
| Use of email | Select the delivery mode from the dropdown. Set to Not Configured to disable email alerts. |
| Send To | One or more recipient email addresses, separated by semicolons (;). |
| Open the message in Notepad instead | Opens the alert as a local text file in Notepad rather than sending it by email. Useful for testing or air-gapped environments. |
Click Save when finished.
Global Settings are included in the ADM report generated by PolicyPak. All configured values — including the enabled state, notification settings, and email configuration — appear in the report alongside other component settings.
Exclusions Policies
An Exclusions Policy is a rule that permits execution of a downloaded file that matches a specific source URL and/or file extension. Without a matching exclusion, Secure Download Manager blocks all files marked as downloaded from the internet.
You can apply Exclusions Policies per machine or per user, and they support Item Level Targeting.
To create an Exclusions Policy:
- In the Actions panel, click Add New Exclusions Policy.
- The Secure Download Manager Exclusions Policy Editor dialog opens.
Exclusions Policy Fields
Policy Name
Enter a descriptive name for this exclusion. Use names that identify the business reason,
for example Allow downloads from Azure DevOps or Allow Office document types.
State
| Value | Behavior |
|---|---|
| Enabled | The exclusion is active and evaluated against incoming download events. |
| Disabled | The exclusion is saved but not applied. Use this to suspend an exclusion without deleting it. |
Scope
Controls which processes this exclusion covers:
| Value | Behavior |
|---|---|
| User processes | The exclusion applies only to executions in the context of the logged-on user. |
| User and System processes | The exclusion applies to both user-initiated and system-initiated executions. Recommended for most environments. |
You can also switch this setting per machine or per user depending on how the policy is delivered (Computer Configuration vs. User Configuration).
User and System processes doesn't extend exclusions to downloads executed under the SYSTEM account. If you need to allow execution for a SYSTEM-initiated download, test that scenario separately rather than assuming this scope covers it.
Enable logging for this policy
Check this box to write a log entry each time this exclusion is matched. Recommended during initial rollout to confirm exclusions are working as expected.
URL Pattern
The URL pattern of the source file. You can use asterisks (*) as wildcards.
| Example | Matches |
|---|---|
*dev.azure.com/NetwrixCorporation/* | Any file from the Netwrix Azure DevOps organization |
https://internal.contoso.com/downloads/* | All files from that specific path |
*.contoso.com | All subdomains of contoso.com |
Leave this field empty to match any source URL (combined with a File Extensions filter).
File Extensions
One or more file extension patterns to allow. You can use asterisks as wildcards. Click Select... to choose from a list of common extensions.
| Example | Matches |
|---|---|
exe | Executable files |
*.DOC, *.XLS, *.DOCX | Microsoft Office document formats |
pdf | PDF files |
Leave this field empty to match any file type (combined with a URL Pattern filter).
Secure Download Manager blocks all files marked as downloaded from the internet by default. Exclusions let you define precise exceptions — allowing specific file types from trusted sources while keeping everything else locked down. For the strongest protection, always combine a URL Pattern with a File Extensions filter rather than leaving one field empty.
Comment
Optional free-text field for internal notes about the purpose of this exclusion.
Item Level Targeting
Click Item Level Targeting to apply this exclusion only when specific conditions are met — for example, only for members of a specific security group, only on machines in a certain IP range, or only on a particular OS version. This uses the same targeting engine as Group Policy Preferences.
Exclusions Policies are included in the ADM report generated by PolicyPak. All fields — including URL Pattern, File Extensions, and Item Level Targeting conditions — appear in the report.
Click OK to save the exclusion policy.
Applying and Testing
- Close the Group Policy editor and confirm the GPO is linked and enabled.
- On a test endpoint, run
gpupdate /forcefrom an elevated command prompt. - Open a supported browser and download a test executable from a non-excluded website.
- Attempt to run the file directly from the browser's download notification.
- Confirm the block notification appears (if Show Management Notifications is YES).
- Download a file from an excluded URL or with an excluded extension and confirm it executes normally.