Application Control rules (Windows)

Application Control options have many configurations for each customer that can be customized according to their needs.

The policy for Application Controlrules is a multi-socket policy. For information about multi-slot policies, see ePO - On-prem Product Guide. For example, instead of duplicating a default policy and adding more rules to it, create a new blank policy and add all custom rules to the policy. Then, apply the new policy in an extra slot with the default policy.

Follow these best practices when creating rules:

Item	Best practices
Rule groups	Create rule groups so that they have a one-to-one mapping to applications or software. This allows you to add your application-specific rules to a rule group.
Policies	Define policies so that they have a one-to-one mapping to groups in System Tree on the ePO - On-prem console. Create a policy for a group of similar systems. For example, a specific policy for Domain Controllers and another for Oracle Servers. This allows you to add rules specific to a group or department to a policy (and apply the policy to the group). Define granular policies rather than one large policy with many rules because you can apply multiple policies simultaneously to a system. Analyze the impact of each policy type. Some rule or policies are more flexible or restrictive than others.

Item

Best practices

Rule groups

Create rule groups so that they have a one-to-one mapping to applications or software. This allows you to add your application-specific rules to a rule group.

Policies

Define policies so that they have a one-to-one mapping to groups in System Tree on the ePO - On-prem console.

Create a policy for a group of similar systems. For example, a specific policy for Domain Controllers and another for Oracle Servers. This allows you to add rules specific to a group or department to a policy (and apply the policy to the group).
Define granular policies rather than one large policy with many rules because you can apply multiple policies simultaneously to a system.
Analyze the impact of each policy type. Some rule or policies are more flexible or restrictive than others.

Review and understand the relative degree of restriction each rule mechanism or method offers.

Updater method	Restriction level	Reason
Update mode	Low	Make emergency changes to systems.
Users	Low	Allow Technical Support users to remotely log on to fix or administer systems that are geographically distant.
Certificates	Medium	Allow your signed applications to update a system. This method provides more flexibility than a hashed installer.
Updater Processes	High	Update existing allow listed applications based on a program that can make changes. This is a commonly used updating method.
Executable Files	High	Allow or block execution of programs based on name or hash. Allow — Scripts created dynamically, such as by end of day or closing process on a kiosk for back-office reporting. Block — Ban installed programs that should not run, such as iTunes. Or, reduce the risk exposure for a server by banning specific files, such as executables (net.exe or msconfig.exe). Note This method is typically used for execution control and not for making changes to a system.
Installers	High	Allow a non-allow listed standalone executable identified by its hash to install applications on a protected system. This method is useful to distribute software based on approved applications.
Directories	High	Allow print drivers, in-house applications, or startup scripts placed on a remote share to run. Although this method is easier to manage than hashes or certificates, it is not as secure.