On a ePO - SaaS console, when a program is configured as an authorized installer, it gets attributes of authorized executable and updater. It can execute and update software on the endpoint.
An authorized installer is allowed based on its SHA-1 or SHA-256 which is specified while configuring the policy. Regardless of the source of the installer, if the SHA-1 or SHA-256 matches, the installer is allowed to run. But, if the reputation of the installer is malicious, its execution is blocked. The reputation of the installer is determined based on the SHA-1 value of an executable file. Reputation sources, such as Trellix GTI don't support SHA-256 reputation-based workflows. For example, if you add the installer for the Microsoft Office 2010 suite as an installer and if the SHA-1 or SHA-256 matches, the installer can install the Microsoft Office suite on the protected endpoints.
Control installation and uninstallation
You can manage the installation and uninstallation of software packages using the Package Control feature.
This feature allows or denies installation, uninstallation, upgrade, and repair actions for software packages. It also prevents any unauthorized installation and uninstallation.
Package Control is identified as pkg-ctrl in the features list and it supports all types of installers on the Windows platform. By default, this feature is enabled and it allows or blocks the installation based on the reputation information and defined rules.
If the reputation information is available, this feature allows or blocks installation of software packages based on these conditions.
Installer type
Description
Condition
Microsoft Installers (MSI)
This installer type includes multiple variants such as
.msp,.mst, and.msm.If the reputation of the certificate (that has signed the installer file) is trusted, installation of software packages is allowed.
EXE-based installer
This installer includes MSI files embedded with the installer.
If the installer file is configured as an updater, the reputation of the installer file is trusted, or if the reputation of any associated certificate is trusted, installation of software packages is allowed.
Non-MSI-based installers
This installer does not include an MSI file embedded with it.
Package Control considers these conditions to allow or block installation:
It considers the reputation of the installer file or the reputation of the certificate. The reputation must be trusted.
It uses a heuristics-based identification for the installer file.
It considers whether the installer file is included or excluded from the list of generic launcher processes, such as
explorer.exeandsvchost.exe.
If the reputation information isn't available, installation is allowed or blocked based on the defined rules such as updater by name or path, users, directories, certificate as an updater, SHA-1 or SHA-256 as an updater.
When this feature is disabled, software installation and uninstallation are blocked.
Package Control includes these subfeatures.
Subfeature | Description |
|---|---|
Allow Uninstallation | It controls the uninstallation of software packages. When this feature is enabled, software uninstallation, upgrade, and repair actions are allowed. By default, this feature is enabled and identified as pkg-ctrl-allow-uninstall in the features list. |
Bypass Package Control | This feature controls bypassing from the Package Control feature. When this feature is enabled, Package Control feature is bypassed and software installation and uninstallation is allowed. By default, this feature is disabled and identified as pkg-ctrl-bypass in the features list. |
By default, the Package Control and Allow Uninstallation features are enabled. You can uninstall any software from the system. But, if the reputation of the uninstall file is malicious (Known Malicious, Most Likely Malicious, or Might be Malicious), software uninstallation isn't allowed regardless of the Package Control configuration. If the reputation of the installer file or MSI file is malicious, software installation isn't allowed regardless of the Package Control configuration. Use this default configuration for desktop and System Center Configuration Manager (SCCM)-managed environments. This configuration allows change, repair, remove, or upgrade operations for software that are useful in these scenarios.
Explicit software upgrades.
Software upgrades through Windows update mechanisms.
Software upgrades of existing software while installing new software packages in chained installations.
Rollback if there is a power failure or if you restart your system during installation. This is called a suspended installation. The installer tracks the installation that is in progress. When resumed, you can roll back the suspended installation or continue the suspended installation.
If needed, you can also change the default configuration to:
Disable the Allow Uninstallation feature — Prevents you from uninstalling software from the system. Use this configuration for fixed-function devices and server environments for all actions except upgrades. For upgrading software in server environments, you must switch to the default configuration because it blocks change, repair, remove, or upgrade operations for software.
Enable the Bypass Package Control feature — Allows software installation and uninstallation on the system except when the file has malicious reputation.
Disable the Package Control feature — Prevents software installation and uninstallation on the system.
Place the system in Update mode — this configuration allows software installation and uninstallation on the system except when the file has malicious reputation.