Application Filtering

ISL AlwaysOn supports application control filtering on Windows. This lets you define exactly which applications an operator is allowed to control during a session on a remote computer, instead of granting control over the entire desktop.

Alongside application filtering, you can also define which keyboard combinations are allowed during the session, and register applications that the operator can start directly from the ISL Light toolbar.

All settings are configured as registry values on the remote computer where ISL AlwaysOn is installed.

Note: These settings are applied on the remote computer and cannot be changed by the operator during a session. 

Registry location

All settings are stored as string values under the ISL AlwaysOn registry key on the remote computer:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ISL Online\ISL AlwaysOn

The following values are available:

• filter_apps – defines which applications and desktops the operator is allowed to control.
• filter_keys – defines which keyboard combinations are allowed during the session.
• applications – defines applications the operator can start from the ISL Light toolbar.

Each value is a string (REG_SZ) containing a JSON rule set.

Note: Registry values cannot contain line breaks, so the JSON must be minified (written as a single line) before it is saved. 

Paths in all values support:

• Windows environment variables, for example %WINDIR% or %ProgramFiles(x86)%
• 64-bit paths via %WINDIR%\sysnative
• WOW64 file system redirection, which is disabled by default and can be enabled per entry

Registering remote applications (applications)

The applications value defines applications that the operator can start on the remote computer directly from the ISL Light toolbar. When it is set, a Remote Applications entry appears under Tools in the session toolbar. Below is an example configuration, where Notepad, Command Prompt and Registry Editor are added to the Remote Applications entry.

[
  {
    "id": "notepad",
    "text": "Open notepad",
    "path": "%WINDIR%\\sysnative\\notepad.exe"
  },
  {
    "id": "regedit",
    "text": "Open regedit",
    "path": "%WINDIR%\\regedit.exe",
    "paths": [
      "%WINDIR%\\regedit.exe",
      "%WINDIR%\\sysnative\\regedt32.exe",
      "%WINDIR%\\sysWow64\\regedit.exe"
    ],
    "raise_existing": 1,
    "elevate": 1
  },
  {
    "id": "cmd",
    "text": "Open cmd",
    "path": "%WINDIR%\\sysnative\\cmd.exe",
    "paths": [ "%WINDIR%\\System32\\cmd.exe" ],
    "enable_wow64": 1,
    "raise_existing": 1
  }
]

The following keys are used:

• id – a unique identifier for the entry.
• text – the label shown to the operator in the Remote Applications menu.
• path – the path to the executable to start.
• paths – additional paths to try if path is not found.
• raise_existing – set to 1 to bring an already running instance to the front instead of starting a new one.
• elevate – set to 1 to start the application with elevated privileges.
• enable_wow64 – set to 1 to enable WOW64 file system redirection for this entry.

Note: If the applications value is missing or contains invalid JSON, the Remote Applications entry does not appear in the toolbar. If the menu is missing, check that the value is present and that the JSON is valid.

Note: Applications you register here also need to be allowed in filter_apps if the operator should be able to control them after they open.

Restricting application control (filter_apps)

The filter_apps value defines the applications and desktops the operator may control. Anything not matched by the rule set cannot be controlled, and clicking on those windows does nothing.

The example below allows control of Registry Editor, the ISL AlwaysOn window itself, and the Windows logon and screensaver desktops:

[
  {
    "or": [
      { "check": "desktop", "value": "Winlogon" },
      { "check": "desktop", "value": "Screensaver" },
      { "check": "path", "value": "%WINDIR%\\regedit.exe", "wow64": 0 },
      { "check": "path", "value": "%WINDIR%\\SysWow64\\regedit.exe" },
      { "check": "path", "value": "%ProgramFiles(x86)%\\ISL Online\\ISL AlwaysOn\\ISLAlwaysOn.exe" },
    ]
  },
  { "return": "allow" }
]

The following keys are used:

• check – what to match against: desktop, path, text or class.
• value – the value to match, which can be a desktop name, an executable path, window text or a window class.

Note: Include the path to ISLAlwaysOn.exe in your rule set if you want the operator to be able to interact with the ISL AlwaysOn window itself during the session.

Allowing key combinations (filter_keys)

When application filtering is active, keyboard combinations are blocked unless they are defined in filter_keys. Each entry describes one combination.

The example below allows Alt+Tab, using the left and right Alt keys and the numeric keypad Tab key, to switch to the next allowed application:

[
  { "info": "tab + left alt",     "key": 65289, "switch": 1, "down": [65513] },
  { "info": "tab + right alt",    "key": 65289, "switch": 1, "down": [65514] },
  { "info": "kp_tab + left alt",  "key": 65417, "switch": 1, "down": [65513] },
  { "info": "kp_tab + right alt", "key": 65417, "switch": 1, "down": [65514] }
]

The following keys are used:

• info – a free-text label for the entry. It is used for readability only and has no effect.
• key – the key code of the key being pressed.
• down – the key codes of the modifier keys that must be held down.
• switch – set to 1 to switch to the next allowed application when the key is released.

Note: Define Alt+Tab in filter_keys if you want the operator to be able to switch between allowed applications. Without it, switching between windows is unreliable, and an operator can end up focused on a window they are not allowed to control with no way back.

Applying the settings

1. On the remote computer, open Registry Editor (regedit).
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ISL Online\ISL AlwaysOn.
3. Create or edit the string value you need: filter_apps, filter_keys or applications.
4. Paste in your minified JSON and click OK.
5. Restart the ISL AlwaysOn service, or restart the remote computer.
6. Connect to the remote computer and verify that only the intended applications can be controlled.

Note: On Windows 10 and newer, allowing the Winlogon desktop only lets you control the password entry screen. The screen shown before it, which has to be dismissed first, cannot be controlled. If the remote computer is locked during a session, you may not be able to reach the password field.