Frequently Asked Questions

What is application allowlisting?

The process of creating a list of applications and allowing only those to run is called as application allowlist. Application Control Plus enables allowlist creation on the basis of policies like vendor, product name, file hash and executables with valid digital signatures. IT admins can easily manage the lists created as applications will automatically get added to them, as and when they are discovered, if they comply with the policies set.

What are the best practices to be followed during allowisting?

Here are the best practices to be followed while creating application allowists.

What is application blocklisting?

The process of creating a list of applications and prohibiting only those from running is called as application blocklisting. Application Control Plus enables blocklist creation on the basis of policies like vendor, product name, file hash and executables with valid digital signatures. IT admins can easily manage the lists created as applications will automatically get added to them, as and when they are discovered, if they comply with the policies set.

What is an unmanaged application?

Unmanaged applications are those that exist in a network without being a part of any of the allowlists or blocklists created. This essentially means that these applications are unmonitored, as they have no policies associated to them. They will run based on the mode of flexibility chosen, i.e they will run when in audit mode and will be prohibited in strict mode. Please note that it is ideal to minimize the number of unmanaged applications to ensure maximum security.Learn more.

What are application groups?

All the applications that are clustered together to build either a allowlist or a blocklist, will be considered as an application group. These groups will be automatically built based on the rules you set for each of them.

What are custom groups?

Users who require similar groups of applications can be clustered together to form Custom Groups. This grouping process can be based on roles, departments or any other criteria of your preference.

What are the system requirements for the Central server?

Any of the Windows computers in your network with the requirements mentioned here can be hosted as your Central server.

How is Application Control Plus licensed?

Application Control Plus offers same pricing plan for workstations and servers, with one free and one enterprise edition. For more details on the pricing, refer to our online store.

What are the best practices to follow during application control?

Application control requirements and approaches vary from enterprise to enterprise. Refer Application Control Best Practices to understand the recommended routine.

Is application allowlisting the better approach to application control?

Refer Application allowlisting vs blocklisting to understand which is better.

What is the significance of the flexibility modes available in Application Control Plus?

The two flexibility modes available are audit mode and strict mode. It is recommended to initially deploy policies in the audit mode, where unmanaged applications will be allowed to run along with the allowlisted ones. Once the admin has a clear picture of the applications their users actually require, they can move all of them to a allowlist and shift to the strict mode. In the strict mode none of the unmanaged applications will be allowed to run. Note: By default blocklisted applications will not run in any of the modes.

When should I choose rules based on vendors for building my allowlist/blocklist?

This rule can be chosen when the application control requirements of the enterprise is not that stringent. All software vendors with valid certificates will be displayed to the admin. From this, only applications that belong to the vendors the admin chooses will be added to the allowlist/blocklist. This lets admins create lists based on broad parameters, hence minimizing admin queries based on inability to access essential applications.

When should I choose rules based on product names for building my allowlist/blocklist?

If you want to allowlist/blocklist only certain products from the same vendor, this type of policy can be opted for instead of the vendor rule.

When should I choose rules based on executables for building my allowlist/blocklist?

Applications are made of multiple executable files, with vendors assigning a digital certificate to each executable to vouch for its authenticity. Application Control Plus displays these verified executable files to you, from which you can select the EXE files to be allowisted/blocklisted. This policy is critical when it comes to maintaining a secure network, as a file will not be allowed to execute if its digital certificate has been tampered with. Even EXEs added to applications in the form of updates will not be allowed to run if they aren't allowlisted.

When should I choose rules based on file hash for building my allowlist/blocklist?

This is the most secure policy, as it's based on the hash value of the executable file. All EXEs of the running processes, including those that don't have a valid digital certificate, will be displayed. You can choose all the files that you wish to allowlist/blocklist; after that, even the smallest change to the file, such as a revision of the file's version, will change its hash value, meaning the file will be removed from the list. This policy is perfect if you want to run only extremely specific executables.

When should I choose to manually add files to build my allowlist/blocklist?

In case you want to add an application which hasn't been run yet to a allowlist/blocklist, you can opt to manually add the files.

What is Endpoint Privilege Management?

Endpoint Privilege Management is the process of allocating application-specific privileged access to users based on their requirements. You can easily adopt the principle of least privilege through out your network, without it affecting your productivity using this feature. It enables privileged access to applications without compromising the privileged credentials or any unnecessary privilege elevation. Please refer here for more information.

When should I enable application level privileged access to users?

Using the Endpoint Privilege Management feature, you can elevate application specific privileges of certain users, without compromising the privileged credentials or elevating their entire organizational level privileges.

What is the significance of the 'Run as ManageEngine' option that is displayed in the File menu of a few applications?

The 'Run as ManageEngine' option is displayed to users whose endpoints were added to Custom Groups that were associated with the Privileged Application List during policy deployment. By selecting this option, users can run said applications as administrators without entering any extra credentials, even while they remain as standard users with minimum privileges.

If the application is present in both a allowlist and a blocklist, will it be allowed or blocked?

If the same application is present in different allowlist and blocklist policies deployed to the same target group, here is the order of precedence that will be followed:

Blocklisting using Filehash Rule > Allowlisting using Filehash Rule > Blocklisting using Verified EXE Rule > Allowlisting using Verified EXE Rule > Blocklisting using Product Name Rule > Allowlisting using Product Name Rule > Blocklisting using Vendor Rule > Allowlisting using Vendor Rule

I created a allowlist with only 3 applications and deployed it in the strict mode to a target group. Despite this, users of the target group are still able to access other local Windows apps such as Photos, Paint, Windows Store etc. Why does it happen? How can I block these apps?

All Windows functionality that comes in-built with the Operating System are automatically allowlisted. Application Control Plus will be enhanced with the option to block these apps in the future.

I added an application to the Privileged Application List in the Privilege Management module, however it is not being elevated when run. Why is it so?

These are the suggested resolution techniques:

  • Only allowlisted applications can be elevated, even if present in the Privileged Application List otherwise. Check whether the application in question is allowlisted to the target user-device.
  • Ensure that you have checked 'Yes' for the Associate Privileged Application List option during policy deployment.
  • Only standard users can access applications with elevated privileges using the 'Run as Manageengine' option. Other administrators will have to use their credentials as usual, even if the Privileged Application List is associated with them. Lowering their privileges to standard user type can remedy this.
  • Modify the Privileged Application List by enabling elevation to "All allowlisted application", this might act as an intermediate fix. Also try testing elevation of other applications in the endpoint to assess the extent of the issue.
  • If nothing works, you can upload the agent logs from the "C:\Program Files (x86)\DesktopCentral_Agent(or UEMS_Agent)\logs" for us to analyze. Specifying if only a single application has the issue or if it is prevalent with all apps can help us fix it sooner.
A few applications that are installed in the endpoint are not shown in the list of Unmanaged Application(s), despite being excluded from all deployed allowlists and blocklists. Why is this?
  • If your Build version is 676 or below, applications will be displayed in the Unmanaged Application list only after they have been executed in the computers atleast once.
  • If your Build version is 677 or above, applications will be displayed in the Unmanaged Application list as soon as they are detected in the network i.e if they haven't been added to a allowlist or blocklist deployed prior to this. Unmanaged application data is usually collected from the computer only after at least one policy is deployed to it.
  • If applications are still missing from the Unmanaged Application list, kindly upload the server logs, agent logs and all the contents from the \appctrl\data folder of affected machines for us to analyze.
I've purchased the Security Add-on to Endpoint Central and there is a mismatch between the number of applications shown in the Inventory module and Application Control module. Why does this exist?

Endpoint Central and Application Control Plus, though seamlessly integrated, aim at giving different perspectives of the application data to its users.

As the name suggests, the Inventory module works on giving a granular view of the networks software repository, displaying even different versions of the same applications as separate entities. Whereas, Application Control's application discovery tool is meant to give its users application data in the most succinct and concise form, enabling them to arrive at easy but informed decisions regarding security policy creation. Instead of showing different versions separately, Application Control simply displays it as a single product.

The objectives of the data represented also vary. The Inventory module is meant to provide SysAdmins with management related data, while the Application Control module presents data that acts as a foundation for security policies. This is why Application Control also tracks all running processes and executables, satisfying the users need to achieve both application and process level control. While Inventory on the other hand, is an organized collection of the installed software with attention to granular details.

These differences in data representation is why there can be a mismatch in the count displayed.

How does Application Control Plus differ from the Block Executable feature in the Inventory module of Endpoint Central?

Application Control Plus does an all-inclusive job when it comes to application allowlisting and blocklisting. Built-in with leading Endpoint Privilege Management capabilities, it ensures that it protects organizations from most application-related threats. Endpoint Central's Block Executable feature on the contrary is rudimentary and is aimed to help organizations with maintaining their levels of productivity.

Application Control Plus instantly discovers and displays all running applications and categorizes them based on their vendor, product name, folder path and digital certificates.Applications running specific to a group of users can also be filtered and viewed. Necessary apps can simply be selected and added into allowlists/blocklists from the list displayed. Endpoint Central's Block Executable feature has no options to filter and categorize applications, the IT administrator must manually enter the name of the application and executable that he wishes to block.

Allowlists and Blocklists can be created on both broad and granular levels by leveraging the predefined set of rules that Application Control Plus has to provide. Rules based on Vendor, Product Name and Folder Path can be opted for when organizations are just beginning with their control process, as they are flexible with the changes that occur during patching. The Verified Executable and File Hash rule can be chosen by experienced networks that prefer complete security. Endpoint Central's Block Executable feature, however, allows blocklisting based only on two rules, Path and Hash. With no added capabilities to manage patching changes, IT administrators will have to manually update these lists after every patching cycle.

How does the elevation of applications using the Endpoint Privilege Management feature work?

Allowisted applications that are added to the Privileged Application List, can be accessed with elevated privileges by the user-devices that are present in the custom groups associated with them. Even standard users can access applications as administrators using this feature, as it elevates the privileges specific to the application and not the user.

How to check if the Vendor/Product/EXE is verified or not?

After selecting the rule of your choice, navigate to the Filters tab on the right. You can check if the Vendors/Product/EXE is verified or not by using the Publisher Credibility filter.

What will happen if we add a Vendor to a blocklist and one of their Products to a allowlist?

Blocklists will always take precedence over allowlist. In this case, all Products from the Vendor will remain blocklisted, including the one added to the allowlist.

What will happen if we allowlist the Vendor (For eg. Microsoft Corporation) and blocklist one of their Products (For eg. skype)?

Blocklists will always take precedence over allowlist. In this case the blocklisted product will remain blocked despite their Vendor being allowlisted.

Is it sufficient to add an application to a allowlist/blocklist by selecting one rule or must all related rules be selected? For eg, to allowlist Chrome is it sufficient to just add Chrome from the Product rule or should chrome.exe also be added?

Adding a single rule that is satisfied by the application is sufficient.

Is adding only a Vendor rule (For eg. Google) to an application group enough to allowlist/blocklist all installed Products published by them?

Yes, by allowlisting a Vendor you will allowlist all Products from them.

When should I opt for the Folder Path rule while building my allowlist/blocklist?

This rule can be used to allowlist/blocklist all files from a particular folder or folder path.

What happens when blocklisted applications are deployed in strict mode?

It is not recommended to deploy a policy with just blocklisted application groups in strict mode. This would end up blocking all running apps other than a few critical Windows applications.

Will an application added to the Privileged Application List and associated to a Custom Group during policy deployment execute in the target machines, if they arent allowlisted to them?

No, they have to be allowlisted for them to executed.

What versions of Windows does Application Control Plus support?

Application Control Plus supports Windows 8, Windows 8.1 and Windows 10.