I manage more than 100 Windows 11 endpoints that are joined to a local domain and registered with Entra ID, but they are not hybrid joined or fully Entra joined. Microsoft Defender for Endpoint is deployed throughout the environment. Users do not have local administrator rights, although many applications can still install in the user context, especially beneath AppData, without elevation.
At the moment I use Defender Advanced Hunting and a scheduled custom detection rule that correlates registry, file-system, and process telemetry. The approach is not completely reliable: some applications are missed, while updates, repairs, and version changes can create new files, folders, or registry entries and trigger false positives.
The goal is straightforward: alert when genuinely new software is installed, but do not alert for updates, repairs, or patches to software that is already present. How are others handling this in similar environments? Are you using Defender XDR and KQL, Intune scripts, AppLocker, WDAC, software inventory tools, or another approach? I'm especially interested in detecting applications installed in the user context without administrator rights.
4 Answers
A scheduled Intune detection and remediation script can check several sources, including relevant registry locations, event logs, installed AppX packages, and other inventory data. The script can report the results centrally through Intune or an API, where they can trigger a ticket or workflow. Establishing a baseline first is important so normal updates and repairs can be compared against known software.
For detection, enable process creation auditing with command-line logging, especially event 4688. Sysmon process-creation telemetry is another useful option if it is already deployed. This catches MSI-based installations and many executable installers, although portable applications remain harder because they may not register as installed software.
Some endpoint-management products can notify you when new software appears. For example, an RMM platform can monitor software inventory and generate an alert. That works best when combined with a baseline and a separate control such as AppLocker or WDAC, since inventory alone may miss user-context or portable applications.
The strongest approach is to prevent unauthorized execution instead of trying to identify every installation afterward. AppLocker or WDAC policies can restrict executables and scripts in user-writable locations such as AppData and temporary folders. Pair that with allowlisting and send policy or execution events to your logging platform for investigation. This also helps with portable executables that never appear in Add/Remove Programs.
That combination makes sense: use prevention for unmanaged executables, then use inventory and process telemetry to identify anything that gets through.