Hi,
Auto containment is blocking the process conhost.exe when being executed through a PS script. I’ve got 37 instances this week where it’s been blocked. No matter how i put a rule in it blocks the process.
Is it possible to get this unblocked please? If so how can I unblock it.
Many Thanks
Alex
Hi @monster-it ,
You can view first the local CCS containment events to check how it was flagged and categorized by CCS (Please see the last image on help guide) Then make the necessary rule setting. You can adjust its hierarchy under containment rules by dragging the set rule to the top then saving the changes after.
Thank you.
