An access violation occurs when a restricted user or process tries to start, stop, or access restricted components of your computer.

When an access point violation occurs:

• Information is recorded in the log file, if you selected the Report option for the rule that detected the violation.
• The event is recorded in the local event log and to SNMP, if you configured Alert Properties to do so.
• The event is reported to Alert Manager and ePolicy Orchestrator, if those products are configured to do so.
• A Block and Report action for a rule determine what happens when a rule detects a violation.
• On the standalone client system, a red frame surrounds the system tray icon and remains visible for 30 minutes, unless you reset it.
  Note: To reset the icon, open the Access Protection Log File from the system tray icon. Opening the log file by any other method does not reset the icon to its normal state.