Deny Paths (Windows)

This page is hidden and needs sign-off before publishing.

Deny paths stop the Windows forwarder collecting from locations you specify. They are set in the registry, as a REG_MULTI_SZ value holding .NET-style regular expressions.

What is and is not suppressed

This is the part to understand before using it, because the behavior is deliberately asymmetric and it is what makes deny paths safer than they sound.

Suppressed: backscans, file creates, file modifies, and file renames in a denied path.

Not suppressed: image load, meaning execution. If a file in a denied path runs, the forwarder reports it as usual.

So a deny path stops Stairwell inventorying a location, and does not blind you to something executing from it. That distinction is why this is a reasonable tool for a sync folder full of user documents, and why it is still not a place to hide something you would want to know ran.

Compare this with the alternatives before choosing. Exclusions work on paths and filenames from the console rather than the registry. Intake filters drop files after they arrive but before they are stored. Deny paths are the lowest-level of the three, act on the endpoint itself, and are the right choice when the content must not leave the machine at all.

Set the registry value before the service starts

The forwarder reads this at service start. Add the entry before installing, or restart the service after adding it, or nothing will happen and nothing will tell you why.

The recommended sequence is therefore to create the entry first, export it, and push it to endpoints ahead of the installer.

1. Open the registry at Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Stairwell\Inception. Create the key if it does not exist.
2. Create a new Multi-String Value named DenyPaths, type REG_MULTI_SZ.
3. Edit it and add one .NET-format regular expression per line.

An example that covers any drive letter and any username:

^.:\\Users\\[^\\]*\\Box

regex101.com helps here, with the .NET flavour selected on the left. A pattern written for a different flavour will frequently compile and match the wrong thing rather than fail.

Push it to a fleet

1. Right-click the Inception key and choose Export.
2. Open the exported .reg file in a text editor.
3. Delete every property except DenyPaths, then save.
4. Double-click the file to import it, and confirm.
5. Verify by opening the DenyPaths value in the registry on a target machine.

Step 3 is the one to be careful with. The export carries every property of the key, and importing it wholesale on another machine overwrites that machine's other forwarder settings with the values from yours. If you created the key by hand, DenyPaths may be the only property present, which is why the step is easy to skip on the machine you tested on and costly on the fleet.

What should I read next?

• Exclusions, the console-managed equivalent, and the right default.
• Intake Filters, for dropping files after collection rather than before.
• What Gets Collected, for the file types this applies to in the first place.