How to Whitelist the GateKeeper Client application in ThreatLocker.

Overview

ThreatLocker uses application allowlisting to control which applications are permitted to run. If the GateKeeper Client is blocked, a ThreatLocker administrator must create a Permit Policy before the application can execute.

This article explains how to permit the GateKeeper Client using ThreatLocker's Approval Center.

---

Method 1: Permit GateKeeper from the Approval Center (Recommended)

If GateKeeper has already been blocked by ThreatLocker:

1. Sign in to the ThreatLocker Portal.
2. Open Approval Center (or Unified Audit if no approval request exists).
3. Locate the blocked GateKeeper executable.
4. Select the request and click Permit Application.
5. When the Permit Application window opens:
   • Select New Install if GateKeeper is being approved for the first time.
   • Select Update Existing if GateKeeper already exists as an application.
6. Choose the desired permit method:
   • Custom – Creates a standard permit policy (recommended for most deployments).
   • Installation Mode – Temporarily places the requesting computer into Installation Mode while the software is installed.
   • Learning Mode – Temporarily places the requesting computer into Learning Mode to automatically learn the files executed during installation.
7. (Optional) Configure:
   • Ringfencing
   • Elevation
   • Policy Expiration
8. Select where the policy should apply:
   • Entire Organization
   • Computer Group
   • Individual Computer
9. Click Approve.

After the policy synchronizes to the endpoint, launch the GateKeeper Client again.

---

Method 2: Install GateKeeper Using Installation Mode

For new deployments, ThreatLocker recommends using Installation Mode.

1. Open the pending GateKeeper approval request.
2. Select Permit Application.
3. Choose Installation Mode.
4. Approve the request.
5. Install the GateKeeper Client.
6. Verify that GateKeeper launches successfully.

Installation Mode temporarily relaxes application control for that device while creating the appropriate permit policies.

---

Method 3: Install GateKeeper Using Learning Mode

Learning Mode is useful when multiple GateKeeper components will execute during installation.

1. Open the pending approval request.
2. Select Permit Application.
3. Choose Learning Mode.
4. Install and launch the GateKeeper Client.
5. Return the device to Secure Mode after installation.

Learning Mode automatically creates permit policies for the GateKeeper files that execute during the installation process.

Note: ThreatLocker recommends using Installation Mode whenever possible because Learning Mode can learn additional applications that are executed while the device is in Learning Mode.

---

If GateKeeper Is Still Being Blocked

If GateKeeper continues to be blocked after creating a Permit Policy:

1. Return to Unified Audit.
2. Review any newly blocked GateKeeper executables.
3. Create Permit Policies for any additional GateKeeper components that appear.

Common GateKeeper executables include:

• GateKeeper.Client.Windows.exe
• GateKeeper.Service.Windows.exe
• GateKeeper.Bootstrap.Windows.exe
• GateKeeper.CredentialProvider.Windows.exe
• GateKeeper.RemoteManagement.Windows.exe
• GateKeeper.Monitor.Windows.exe

Continue reviewing Unified Audit until no additional GateKeeper components are being blocked.

---

Summary

To whitelist the GateKeeper Client in ThreatLocker:

1. Open Approval Center or Unified Audit.
2. Select the blocked GateKeeper application.
3. Click Permit Application.
4. Choose New Install or Update Existing.
5. Select Custom, Installation Mode, or Learning Mode.
6. Apply the policy to the desired scope.
7. Click Approve.

Once the policy has synchronized, the GateKeeper Client should launch normally.

---

Optional: Test GateKeeper in the ThreatLocker Testing Environment

If you prefer not to place a production computer into Installation Mode or Learning Mode, ThreatLocker provides a Testing Environment.

The ThreatLocker Testing Environment uses a temporary, isolated Virtual Desktop Infrastructure (VDI) that allows administrators to safely install and evaluate unknown or newly requested applications without affecting their production environment.

When using the Testing Environment, administrators can:

• Test the GateKeeper Client in an isolated environment.
• Observe the application's behavior before approving it.
• Identify application dependencies automatically.
• Determine whether the application should be permitted in production.
• Avoid interrupting the end user's workflow or placing their workstation into Installation or Learning Mode.

This option is particularly useful when validating new software deployments or evaluating GateKeeper before creating a Permit Policy for your organization.

Note: The ThreatLocker Testing Environment requires access to the ThreatLocker Testing Environment feature. If it is not available in your portal, contact your ThreatLocker administrator or ThreatLocker representative for assistance.

---

References

• ThreatLocker Knowledge Base: Permitting Software from the Approval Center
• ThreatLocker Knowledge Base: The ThreatLocker Testing Environment

For any additional questions or concerns regarding faster 2FA, proximity settings, computer locking, password management, or compliance, please contact GateKeeper Enterprise support using the Support Ticket form on https://gkaccess.com/support/ or email [e-mail].