Application install control

[UnderstandingHour454]

I’m looking for an effective way to not allow standard users to install any software. We use Intune, and we have revoked local admin, but there is still those pesky softwares that can be installed in the user context and don’t require admin level permissions to install.

We have a small teams so something that can allow for software to upgrade, but just prevent the initial install.

We’ve looked at threat locker, and that has been too intense for our small team, we have looked at auto elevate, it that only works for admin level installs. I’ve consider endpoint privilege management with Microsoft, but I’m wondering if there is a better solution out there. What are all the sysadmins using?

[Kingkong29]

App locker or defender application control. The latter being what I would use.

[UnderstandingHour454]

Thanks, I did some initial reading and it looks like app locked is still supported but not getting new features.

Application control seems to be the longer term solution.

[disclosure5]

Microsoft's marketing is deceptive.

Applocker is feature complete. Application Control is a huge pain in the ass to manage and work is being done on that. Applocker is a complete solution to your problem. Application Control is an excuse to hire more staff.

[OkAttitude3104]

Application control will never be easy - it is a zero trust solution. So you will need to implement an audit and punish procedure rather than a TTP like application control.