Overview

Availability

Release Version: 12.0.0

Platform: Windows

Access Level: Administrator / Operator users only

Location: BrowseControl → App Control

Note: Existing BrowseControl application blocking settings are now located under BrowseControl → Manage → App Blocker. Application Allowlisting is managed exclusively through the App Control menu.

---

App Control Dashboard

Managing Application Policies by Group

1. Enable or disable App Control
2. Choose the level of application tracking
3. Configure allowlisting behavior
4. Manage allowed and blocked application lists

Note: The Blocked List view is shared with BrowseControl → Manage → App Blocker.

Enabling Application Allowlisting

Application Allowlisting is disabled by default.

When enabled, users can only run applications that have been explicitly allowed. All other applications will be blocked automatically.

Applications can be allowed based on:

• Application Name

• Publisher

• Application Path

• Digital Certificate

Important: Any application listed in the Blocked List will always take priority over allowed applications. Ensure all required business applications are added to the Allowed List before enabling allowlisting to avoid user disruption.

Application Configuration Options

These configuration options help balance security with usability:

Trusted Applications

• Disabled by default

• Allows all digitally signed user applications to run

• Any application with a valid digital signature is automatically trusted

System Account Applications

• Enabled by default

• Allows applications created or run by system accounts

• Ensures essential system-level processes can operate normally

Note: Some trusted user applications (such as antivirus software) may spawn system-level processes that require this option to remain enabled.

Child Applications

• Enabled by default

• Allows secondary or child processes launched by already allowed applications

• Prevents dependent processes from being blocked unintentionally

Important: Application allowlisting applies only to User Account applications. System, Network, and Local Service accounts are excluded to prevent misconfiguration and accidental lockouts.

Allowlisting Configuration Methods

Administrators can add applications using several methods.

By Application Name

Applications can be added:

• From the Available Applications list (automatically collected from client endpoint activity)

• Manually by entering the executable name or browsing for it

Multiple Versions: If multiple versions of an application are installed (for example, camtasia.exe), allowlisting is enforced by executable name, not version. To control specific versions, use the Application Path method.

By Publisher

Allows all applications digitally signed by a specified publisher to run. This is useful for organizations that rely on trusted vendors.

To locate the publisher in Windows:

1. Right-click the application executable or shortcut

2. Select Properties

3. Open the Digital Signatures tab

4. View the signer details

By Application Path

Allows applications based on their file location.

Examples:

• Specific file: C:\Program Files\ExampleApp\app.exe

• Entire folder: C:\Program Files\ExampleApp\

This method provides precise control and supports trusted folders using wildcards.

By Certificate

Allows any application signed with a specific digital certificate, regardless of name or path.

To locate a certificate:

1. Right-click the application executable

2. Select Properties

3. Open the Digital Signatures tab

4. View the certificate details and copy the Issued by value

Note: Only digitally signed applications support certificate-based allowlisting.

Applications Showing as "N/A"

Some applications may display N/A for Publisher or Certificate. This typically indicates:

• Unsigned applications

• Self-signed or untrusted certificates

• Missing or corrupted certificate data

• Certain Microsoft Store or packaged apps

• Permission or access limitations

These applications can still be allowed, but administrators will see a warning advising caution.

End User Experience

When a blocked application is launched, users will see a customizable warning message.

Users can:

• View previously blocked applications

• Copy application details to the clipboard for IT review

• Suppress repeat notifications for the remainder of the day

This helps reduce disruption while providing transparency and a clear path for application approval.

Managing Applications

Manage by Application

Provides a complete list of all discovered applications across the environment.

Administrators can:

• Allow or block applications

• Review last accessed timestamps

• Filter and manage custom applications

This view is ideal for ongoing maintenance and auditing of application policies.

Important Considerations

1. Ensure all required business applications are allowlisted before enabling enforcement
   
2. Maintain allowlists regularly to avoid user disruption
   
3. Test policies with limited groups before broad deployment