I set the Sandbox to Auto,

I have very inexperienced people on this machine, and I think the “ask” prompt might confuse them. As long as it’s working, with the least user interaction, that’s all I care about.

Where is this border that you are supposed to see when a suspicious file is detected? I understand that it is hard to see?

Jack