Bans
Block a license, a machine, an address or an account so that it cannot come back, even with a new key.
Open it now:Bans
How a ban matches
A sign-in is refused when any one of its identities matches an active ban of the same application: the license key, the hardware ID of the machine, or the IP address. This is deliberate. A ban on a key also covers the machine it ran on, so the same person with a fresh key on the same PC is refused too. A ban also records the machine's hardware fingerprint, so the same machine is recognised even if its hardware ID value changes.
- Bans never cross applications. A ban in one application does nothing in another.
- A ban with an end date stops matching when it ends. Bans made in the dashboard have no end date; bans made by an alert rule can have one.
- A ban takes effect on the next sign-in attempt. A session already open keeps running until you end it in Monitor.
Add a ban
Press Add ban on this page, or New then Ban in the top bar. Paste one of the following. Atlas detects which it is and shows the type in the field; the button reads Deep ban.
| You paste | What is banned |
|---|---|
| A license key | The key, the hardware ID and IP address it last used, and every other license and account in the application that shares that hardware ID or IP address. |
| A hardware ID | That machine. It cannot sign in under any license. |
| An IP address | Every client coming from that address. |
| A username | The account, and every hardware ID and IP address it has signed in from, including its trusted devices. Each becomes its own ban row. |
| An email address | The matching account, with the same reach as a username. |
The reason is optional. It is stored with the ban and shown in the list and in the inspector. A username or email that matches no account returns No account with that username or No account with that email.
A single key can also be banned from its row on Users. Ban there bans the key with the hardware ID and IP address it last used. Cascade ban also bans every other license and account that shares that hardware ID or IP address.
Read the list
The strip at the top counts active bans by what they target: Total, Account, License, HWID and IP. Click one to filter, click again to clear. A ban that carries a license key counts as a license ban, even when it came from an account cascade.
| Column | Shows |
|---|---|
| Account | Username and email. Appears only when a listed ban has one. |
| License, HWID, IP | The identities the ban covers. Hover a cell to copy it. |
| Reason, Location | Why, and where the address was when the ban was made. |
| Device, Hash | The machine's name and the first characters of the build it ran. Appear only when a listed ban has them. |
| Issued by | The person who made it, or Security Engine for bans made by an alert rule or a cascade. |
| Expiry | Permanent, or the end date. |
| Banned | How long ago. Hover for the exact time. |
| Control | Values |
|---|---|
| Target filter | All, Account, License, HWID, IP |
| Type | Manual (made by a person), System, Cascade, Auto (made by an alert rule) |
| Status | All, Active, Expired |
| Sort | Created or Ban type, newest or oldest first |
| Search | Matches the key, username, email, hardware ID, IP address and reason |
Click a row for the ban inspector: the target, the reason and time, the log entry that triggered it when there is one, and other bans on the same hardware or address. When a new ban arrives while you read, a N new pill appears instead of the list moving. Tick rows and press Copy CSV to copy them for a spreadsheet. Keyboard: / search, j and k move, x selects, Enter opens, ? lists them.
Lift a ban
Press Unban on a row. The row disappears and an Undo button stays for 6 seconds; after that the ban is removed. To lift several, tick them and press Revoke, then confirm. Lift bans here rather than in the database so the audit trail records who did it.
A ban that has run out keeps its row under Status: Expired until you remove it, but no longer blocks anyone. A cascade or account ban is many rows; lifting one row lifts only that identity, so remove each row you want gone.
Where bans come from
- You, from this page, from a key's row on Users, or from Monitor: Kill and ban license ends the session and cascade-bans the license.
- An alert rule. A rule such as Unauthorized App Binary bans the license, hardware and address when its event fires, with the rule's name in the reason. See Alert rules.
- Not the SDK on its own. A detection inside the customer's program ends that program but never bans anyone. To ban on a detection, add an alert rule for the Client detection event; see Runtime protection.
What the customer sees
A banned customer gets one of three messages, which you can reword under Settings, Messages: Temporarily banned, Permanently banned and Hardware ID banned. Both can show the reason as {REASON} and the kind of ban as {BAN_TYPE}.