Blocking Unauthorized Software with Application Control

Application control (whitelisting) restricts which programs can run on computers to an approved list, preventing malware and unauthorized software. It's one of the most effective security controls but requires planning to avoid blocking legitimate software. Windows AppLocker (Windows 10/11 Enterprise): configure rules in Group Policy under Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker. Create rules based on publisher (digital signature), path, or file hash. Start with Audit Only mode to identify what would be blocked before enforcing. Microsoft Defender Application Control (WDAC): more robust than AppLocker, works across all Windows editions and enforces at the kernel level (harder to bypass). Create policy XML files defining allowed applications, sign them, and deploy via Intune or Group Policy. Start with a base policy that allows Windows and Office, then add approved applications. Application control requires ongoing maintenance — every new application or update may need policy adjustment. For SMBs, a simpler approach is disabling users' ability to install software (remove from local admin group) and using a software deployment tool for approved installs.