I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID. They are not hybrid joined or fully Entra joined, and Microsoft Defender for Endpoint is deployed throughout the environment. Users do not have local administrator rights, but they can still install some applications in their own context, especially under AppData, without elevation. I currently use Defender Advanced Hunting and a scheduled custom detection rule that correlates registry, file-system, and process telemetry. The problem is that some installations are missed, while updates, repairs, and version changes can look like new installations because they create files, folders, or registry entries. Ideally, I want new software installations to generate alerts while ordinary updates, repairs, and patches do not. How are others handling this? Are Defender XDR and KQL, Intune, AppLocker, WDAC, or another approach effective for detecting user-context installations and portable applications?
5 Answers
If you already use an endpoint-management or RMM platform, check whether it supports notifications for newly detected software. That can provide a simpler inventory signal, but it may not catch portable executables that do not create normal application inventory records, so it should be supplemented with process auditing or application control.
The strongest approach is prevention rather than trying to identify every installation after the fact. AppLocker or WDAC can restrict executable content in locations such as AppData and user-writable Temp folders, while allowing approved software. This blocks many portable or user-context applications before they become an inventory problem. Defender telemetry can then be used to investigate the smaller number of events that get through.
For detection, process-creation auditing with command-line logging is useful, particularly Windows event 4688. Sysmon process events can provide similar or additional detail if it is already deployed. This helps catch installers launched from user-writable paths, including portable executables that never register themselves in Add/Remove Programs.
An Intune Detection and Remediation script can periodically inspect the registry, event logs, installed AppX packages, and selected file locations. The script can report its findings back through Intune, after which the results can feed ticketing or automation workflows. This is more suitable for scheduled inventory and reconciliation than for immediate prevention.
Establishing a known-good baseline is important. Compare changes against approved software and maintain separate logic for first-time discoveries versus changes to an existing product. Combining that baseline with Defender process and file telemetry should reduce false positives from upgrades and repairs, although portable applications still require monitoring of user-writable directories.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures