I use Automatic Program Control in NIS 2009 (Windows XP SP2).
For five of the many programs that NIS has automatically created rules for, I want to receive a popup alert every time a rule is detected (generally meaning that the program accessed the internet). So I changed the action tabs from Allow to Monitor throughout for each of these five programs. As expected, on the main program list this causes the dropdown next to the program to change from Auto to Custom.
I do indeed get the popup notification from NIS when one of these programs accesses the net. But strangely (to me, anyway), after the first such notification for a given program, NIS adds more rules below the originals that are duplicates except that they say Allow on the Action tabs (instead of Monitor). At the same time, in the main program listing the dropdown reverts from Custom back to Auto.
So I end up with everything saying Auto again in the main program list, and a bunch of duplicate *no-monitor* versions of the rules for each of the programs I want to monitor.
Despite these perplexing automatic changes, NIS *does* continue to provide me with the desired alerts for the programs in question. I assume this is because the rules I tagged "monitor" are higher in the list and thus take precedence over the no-monitor duplicates that appeared.
So what could be the reason for the behavior I described? It happens every time. Redundancy rules?