Additional File Extensions (Windows)

This page is hidden and needs sign-off before publishing.

File extensions are normally set in the Stairwell console. On Windows, a registry entry can override that list instead.

The registry list replaces the default policy; it does not add to it. So to collect the defaults plus your additions, the registry value has to contain the entire default list as well as the new entries. Add only your extensions and you will silently stop collecting everything else, which is the single most expensive mistake available on this page. The default list is on What Gets Collected.

Consider whether you need the registry at all. The console applies to a whole environment or an asset group, survives a reinstall, and cannot be got wrong in this particular way. The registry route exists for the case where the setting must be in place before the forwarder ever starts.

Set the value before the service starts

The forwarder reads this at service start. Add it before installing, or restart the service afterwards, or nothing happens and nothing tells you why.

That timing is also the reason to use this route at all: extensions added here before installation are collected during the initial backscan. Added later, they apply going forward, and the machine's existing files of those types are never picked up unless you force another backscan. See Force or Skip a Backscan.

1. Open the registry at Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Stairwell\Inception. Create the key if it does not exist.
2. Right-click empty space, choose New, then Multi-String Value.
3. Name it AllowForwardList, type REG_MULTI_SZ.
4. Right-click it, choose Modify, and add one extension per line, each preceded by a dot.

Push it to a fleet

1. Right-click the Inception key and choose Export.
2. Open the exported .reg file in a text editor.
3. Delete every property except AllowForwardList, then save.
4. Double-click the file to import it, and confirm.
5. Verify by opening AllowForwardList in the registry on a target machine.

Step 3 matters more than it looks. The export carries every property of the key, so importing it unedited on another machine overwrites that machine's other forwarder settings with yours. If you created the key by hand, AllowForwardList may be the only property there, which is exactly why the step is easy to skip on the machine you tested and costly on the fleet.

What should I read next?

• What Gets Collected, for the default list you need to include.
• Deny Paths (Windows), the same registry mechanism in the opposite direction.
• Exclusions, for keeping content out from the console instead.