ManageEngine Application Control Plus

Administrators can automatically create allowlists by setting application control rules that reflect their organization’s needs. This minimizes manual input while improving control over approved software. ManageEngine Application Control Plus scans all endpoints to discover installed applications and uses policies, such as trusted vendors, verified executables, and file hashes, to automatically build and update the allowlist.

The platform enables teams to block unapproved, malicious, or non-business apps, reducing cyberattack exposure and employee distraction, thereby curbing both risk and unproductivity. The platform supports policy-based blocklisting at both the application and executable levels, allowing organizations to block apps by vendor, product name, folder path, or file hash with granular precision.

Admins can fine-tune how strictly application control policies are enforced, offering a balanced approach between restriction and user freedom based on operational demands. ManageEngine Application Control Plus supports multiple enforcement modes, including Audit Mode and Strict Mode, enabling organizations of all sizes to choose the level of control that aligns with their security posture and maturity.

Organizations can assign application-specific privileges to users, limiting the elevation of rights to only what is necessary, effectively reducing the risk of privilege-based attacks. Admins can configure privilege elevation for specific or all allowlisted applications, with options for self-elevation, auto-elevation, and justification logging through customizable Privileged Application Lists.

Temporary application access and privileges can be granted for a defined time. These are automatically revoked, helping organizations maintain control without compromising workflow. JIT Access also prevents privilege creep by enabling time-bound access to unmanaged or blocked applications, even in strict enforcement environments.

Global policies can restrict both the type and number of child processes an application is permitted to spawn, helping to contain suspicious activity and mitigate lateral movement threats. Admins can configure which trusted applications are permitted to create child processes and optionally restrict those child processes from inheriting elevated privileges.