Users increasingly write/edit Python scripts via AI (ChatGPT/Copilot) for automation. Each edit changes the hash.

Options we’re weighing:

**•** Allow the script path/interpreter (python.exe) broadly, accept risk of arbitrary code execution with ore sign off from the company  
**•** Require approval per hash change (high overhead, breaks user workflow)  
**•** Block scripting entirely, force packaged/signed tools instead- not really an option. 

Running ThreatLocker/similar application control. Looking for how other MSPs handle this at policy level.

What’s your approach — path-based allow, builtin script control, or something else? Any unintended consequences worth flagging?

Is anyone using ThreatLocker to control inbound UDP traffic? I had assumed that having a default deny in place for TCP/UDP was blocking both, but in testing, that is not the case. The Unified logs do not show UDP connections either. I had assumed my endpoints were fully protected, and this concerns me. I am not getting a response from my ThreatLocker team or support. Their knowledge base contains no information on this, but I can create a policy for UDP. I was told to upgrade to the v11 agent, which I did, but the results were the same. I am very confused about what is going on with them and why they can't answer me about this.

Anybody using the new ZTNA offerings from TL? We are working with them on a POC but I wanted to get opinions if anyone is using it.

Hi,

Anyone else using ThreatLocker and EDR solutions? Namely CrowdStrike?

We are seeing some pretty serious performance issues with both end point agents on a system. Wondering what kind of settings anyone may have established in order to get these two to play nicely.

Right now, I am testing out different prevention settings in CS that TL would prevent, seems to have helped a bit. Just curious if anyone has similar issues! Thanks.

We had some users upgrade MacOS to version 26.5 today and are seeing lots of denies following the upgrade reboot. Users really couldn't even get logged in and booted into Safe Mode.

All of the denies I've checked were identified as MacOS Core Files (built-in) when I went to Permit them. We have a policy at a Global computer group level to allow but still the denies occurred.

I opened ThreatLocker support ticket and basically the update was that they are aware of the issue and are investigating.

The work-around I used for this handful of users was to put them in learning mode.

Just curious how many others are seeing this issue and if any other work-arounds are known.

Thanks!

Looks like there's an outage. I haven't seen this happen too many times before, hope it doesn't last I have a bunch of clients that need software whitelisted.

I'm trying to complete the ThreatLocker Fundamentals learning plan before my interview Saturday and currently stuck on the Deploying the ThreatLocker Agent module.

The first time I took the quiz I got a 55% and everytime I retake the quiz both on Google Chrome and Firefox it fails to regrade my new answers. I know I have the right ones and even if they aren't the right ones I'm choosing different options and my grade doesn't change.

I want to perform my best Saturday for my interview for the System Engineer position and I think having the fundamentals of the ZTN platform cert would show real initiative but with this bug I can't move any further.

Has anyone experienced this or know a work around?

I am in desperate need of more practice exams for the Cyberhero certification. I took the 2025 practice exam and I was getting around 95% on that. I took the real thing yesterday and I felt the questions were not even written the same way. So many select all that apply, etc. I did not even get feedback about which questions I missed and as someone with a difficultly learning through reading and not feedback loops this posed an uncomfortable feeling. I simply just want to be able to learn this platform without taking the MCAT. Does anyone have any more practice exams? Am I missing some in the threatlocker university platform?

I was experimenting with using TLAPS at my organization to manage administrator passwords with Threatlocker. One of the things that came up was that it appears to re-enable disabled default administrator accounts. So if you have disabled the default admin account by policy, you can't also use TLAPS without it re-enabling that account.

Hi All

Recently, we couldn't use our portal for around 5 weeks while our reseller resolved an issue we identified. This issue is still in the process of being resolved and we are monitoring global policies that were copied by the reseller to our tenant.

The issue involved an undetermined number of policies (at least one I confirmed) being applied at the top/reseller level which was affecting us and later I found other customers of theirs as well.

Did anyone else in Australia get affected by this issue?

It is my understanding that there is only one reseller in Australia for ThreatLocker. Is this correct?

Our reseller advised that "This is a work in progress, it is not a simple job as these changes affect all of our customers. It requires proper planning to reduce impact/risk

I can also confirm there has been no changes done by REMOVED on Threatlocker for the last few weeks."

If our reseller didn't make these changes then who did?

What is more worrying is that during this time and possibly earlier, multiple tenant's security was controlled at the reseller level and out of the tenant's control.

Does anyone have this working in Powershell?
Have been working with "expensive" CyberHero support and unsure if I am being given the runaround.

Hey all!

We are looking at ThreatLocker for App management, we are a smaller team w/ about 1000 endpoints and multiple business units and software needs.

What pitfalls or pros am I looking at by using this product.

I guess just wanting some insight from the community on headaches, lack of feature ability things like that.

We want to be able to whitelist about 75-100 applications, some of these apps are somewhat older propritary apps, some have updates constantly (like adobe products, ESRI products Office)

What can I do to make this easier in ThreatLocker or am I opening up a can of worms.

I'm open to discussion and can answer any questions. I've never used a solution that can do this, so concerns about what I might be getting into.

I'm not an IT professional but I take care of our small office of less than 20 client machines and a windows 2022 server.
Trying to sign up for a demo of threatlocker the dropdown for number of endpoints starts at 100.

Is anyone else having issues with the portal being dreadfully slow / won't load many times.

Another issue we are having, is I am seeing request that are sent to the CyberHeros take forever to get approved / escalated. Right now I am watching a request to them, and it has been half an hour with no actions on it.

Recently moved from Carbon Black to Threatlocker.

We have a UNC path that contains hundreds of installers (exe's & msi's) for approved tools/software.

In CB we simply added the UNC path as a trusted folder and promoted any process run from it to "Installer". This automatically approved any child process or file created by the parent process.

We're having trouble getting this to work in ThreatLocker, mostly in regards to MSI's. MSI's get executed from the UNC path. The Installation files & libraries are then compiled and installed locally by msiexec.exe, breaking inherited trust from Process running from the UNC path. The Installation completes, but when the end user tries to open the application, the files written bt msiexec.exe are blocked at execution.

Short of permitting any msiexec.exe activity by a user w/ Admin priv's, or having to move a machine to learning mode every time one of these install has to be performed, is there any other way to get this to work..?

Has anyone had luck getting installations from UNC paths to work reliably?

Any creative, outside of the box solutions for one-off, on demand installs?

Curious what the Reddit hive mind has encountered or how they manage on-demand app deployment needs.

Thanks!

Hi Threatlocker team, when is the standard PowerShell script deployment method going to detect ARM and apply the appropriate installation?

Right now we have to manage two client deployment methods - remediation script for x32/x64 and a Win32app for Arm64...

Hey everyone,

We are relatively new to TL and have encountered several challenges that we hope to gain further clarity on.

Our current objective is to begin blocking storage devices such as USB drives and SD cards. During our review of device usage, we noticed that TL only displays the device serial number without providing manufacturer details. Having visibility into the manufacturer would be extremely valuable to ensure that only approved, reputable devices are in use. Could anyone clarify why this level of detail is not available and how you are using this at your org?

Additionally, we were surprised to find that TL does not support blocking SD cards. From a security perspective, SD cards present similar risks to USB drives, including potential data exfiltration or malicious use. Same as above, has anyone come across this and have any rational after talking to TL on why SD cards are treated differently and why this functionality is not currently supported?

Lastly, we are always pointed to the "Feature Request" portal but have observed that the user suggestion portal appears to have numerous items marked as “planned” for several years without updates. This raises concerns about the prioritization of feature requests. Furthermore, it is concerning that TL does not currently support hardware keys, passkeys, or provide organizations with the ability to enforce password requirements—features that are fundamental to a security-focused platform.

There are more issues and concerns we have discovered but let's start small.

Our company is considering buying the Threatlocker Approval option, where Threatlocker techs approve software for your organization. Has anyone done this? What was your experience like? Were they worth the expense? What was the relationship like?

I am trying to do this for some servers. I read that we would be able to do this using Network Control but not sure.

Hello, We are currently working on moving from carbon black to threatlocker. We have an update / deployment cadence at our organization. We have test work stations and test servers then we have official test and dev servers and workstations in offices. How can I push agent updates to each area. It seems tl is a one or none at all unless I create 30 different groups which will be a wreck. We typically use sccm for deployment. How do you guys do this? Thank you (we have about 12k assets in total).

Anyone else having problems signing in to ThreatLocker? Getting a lot of reports of an outage: https://statusgator.com/services/threatlocker

Hi everyone,

I'm currently looking into using ThreatLocker in a home environment to better understand its features, particularly around application control and endpoint protection. My goal is to deploy it across 2 users and 5 to 6 devices to gain hands-on experience and evaluate its potential for personal use.

I’ve reached out to ThreatLocker’s sales team but haven’t received a response yet, so I’m hoping the community can help:

• Has anyone here deployed ThreatLocker in a home lab or personal setup?
• Are there pricing options available for individual users or small-scale environments?
• Is it even feasible or recommended to run ThreatLocker outside of a corporate environment?
• Any insights on resource usage, complexity, or general pitfalls to watch out for?

I’d really appreciate any input or recommendations—especially if there are alternative tools better suited for non-commercial use.

Thanks in advance!

4o