An ENS Access Protection rule that has a subrule with the Inclusion status set to Exclude includes an asterisk (*) automatically, which can block critical processes on the system.

For example, suppose you want to create a rule to block the process Test.exe from accessing the location C:\Test. You create a block rule for Test.exe with an Inclusion status of * for the File name or path. You create a subrule with a type of Files with a target of C:\Test, and the Inclusion status set to Exclude. This rule blocks Test.exe from accessing all locations on the system except C:\Test.