How the software works in an unmanaged environment

Application Control creates a allow list of all authorized executable files and blocks the execution of any program that isn't allowed. Change Control monitors and prevents changes to the file system and it write-protects and read-protects critical files from unauthorized tampering.

The allow list details authorized files and determines trusted or known files. In Enabled mode, only files that are present in the allow list are permitted to run. All files in the allow list are protected and can't be changed or deleted.

Application Control stores the allow list for each drive or volume at the following location:

Here is a list of the types of files included in the allow list.

Note

When the allow list is created for Windows, Application Control doesn't include system-specific files that are protected by the operating system. For example, pagefile.sys and hiberfil.sys.

When you execute a file, Application Control compares the checksum and path of the binary with the checksum and path stored in the allow list and permits the execution only if the checksum value and path match.