Protocols (Regular Profile) : Managing Audit, Shadowing and Alerts for Protocols : Auditing, Shadowing and Alerts Management Tasks : Undefining audit and shadowing rules
  
Undefining audit and shadowing rules
If you deploy DeviceLock policies using DeviceLock Group Policy Manager or DeviceLock Service Settings Editor, in some situations you may want to prevent audit and shadowing rules defined for a particular protocol or protocols from being applied to a specific group of client computers. To do so, you need to return the previously defined rules to the unconfigured state. All undefined DeviceLock Service settings are ignored by client computers.
To undefine audit and shadowing rules
1. If using DeviceLock Service Settings Editor, do the following:
a) Open DeviceLock Service Settings Editor.
b) In the console tree, right-click DeviceLock Settings or DeviceLock Service, and then click Load Service Settings to open the DeviceLock Service settings file.
c) In the console tree, expand DeviceLock Service.
If using DeviceLock Group Policy Manager, do the following:
a) Open Group Policy Object Editor.
b) In the console tree, expand Computer Configuration, and then expand DeviceLock.
2. Expand Protocols.
3. Under Protocols, select Auditing, Shadowing & Alerts.
When you select Auditing, Shadowing & Alerts in the console tree, in the details pane you can view protocols for which you can define audit and shadowing rules.
4. In the details pane, right-click the protocol whose rules you want to undefine, and then click Undefine.
You can use the following steps to undefine rules for multiple protocols at a time:
a) In the details pane, click protocols while holding down the SHIFT or CTRL key.
b) Right-click the selection, and then click Undefine.