A user recently needed administrator credentials just to change their default PDF reader, which got me thinking about application allowlisting. The problem is that some applications change their executable names or install into new versioned folders after updates. A rule tied to one exact executable can then break whenever the software is upgraded. How do you handle this in practice? Do you use publisher-based rules, scripting and automation, deployment tools, dedicated application-control software, or maintain the allowlist manually?
5 Answers
Another approach is to deploy the application or configuration centrally so the user never sees an elevation prompt in the first place. For something like a default PDF reader, package the application and the required settings through your endpoint-management system instead of granting temporary admin access.
A managed software catalog works well for this. Package approved applications in Configuration Manager, Intune, or a similar portal, then let users install them without administrator rights. When a new version is approved, update the package and deploy it to machines that already have the application. This also gives IT a chance to review licensing and security before approving software.
Avoid rules based only on the filename when possible. Tools such as AppLocker can use the publisher’s code-signing certificate, product name, and version, so an update can remain approved even if the executable name or path changes. It’s also worth testing updates with a small pilot group before deploying them broadly.
For tighter control, dedicated application-control products can manage allowlisting based on publisher signatures, hashes, paths, and behavior rather than just a single executable name. They take some effort to tune, but they’re useful in environments where everything should be blocked unless explicitly approved.
Some organizations use blocklists instead of allowlists because maintaining every approved application can become a full-time job. That’s easier to operate, but it provides less control, so it depends on your security requirements and how standardized the environment is.
That approach is simpler, but it still needs monitoring. Otherwise users can install unapproved tools that aren’t on the blocklist yet.