Endpoint Central can spot a torrent client or an unknown remote tool the day it appears — and that power is only legitimate if staff knew the rules first. Policy first, conversation second, alerts third.
Every office has the story: the PC that 'became slow' and turned out to be mining something, streaming something, or sharing the office internet with a torrent client. Endpoint Central's prohibited software feature — shown in the video — lets you declare a list of unwanted applications; when an inventory scan finds one on a managed PC, you get an alert, and the software can be configured to be removed automatically. The technology is the easy half. This guide is about the other half: doing it in an order that keeps it fair, defensible and actually useful.
A defensible prohibited list names categories of risk, not personal dislikes: torrent and file-sharing clients (legal and bandwidth risk), unapproved remote-access tools (a straight road into the network for anyone who phishes one password), password and licence crackers, crypto miners, and software the office is not licensed for. Games and media players are a management conversation, not a security category — putting them on a 'prohibited' list enforced by IT spends credibility the list needs for the serious entries. When the list is short and every entry can be explained in one honest sentence, it survives being read aloud in front of the whole office.
Write the one page: what categories are prohibited on office machines, what happens when one is found (a conversation first, removal after), and who approved the policy. Circulate it, get it acknowledged the way your office acknowledges anything — a reply, a signature, a notice-board copy. This step is not bureaucracy. It is what separates managing company equipment, which every employer is entitled to do, from watching people, which this feature is not for. The inventory sees installed software on company machines — that boundary, stated plainly in the policy, is the proportionality line this whole feature must live inside.
For the first month, configure alerts without automatic removal, and read what the scans actually find. Expect surprises in both directions: less deliberate mischief than feared, and more accidental junk — bundled installers, a tool a technician installed for one job and never removed, trial software that outlived its trial. Take each find to its user as a question before a conclusion. Most will end with an uninstall and no drama, and the few deliberate ones will have been found with a fair process behind you. The alert-only month also calibrates the list: if one entry fires constantly for a legitimate tool half the office needs, the list was wrong, not the office.
After the trial month, automatic removal is reasonable for the clear-risk categories — the unknown remote tool, the miner, the cracker — where no legitimate work use exists. Keep alert-and-ask for anything grey. And keep an exceptions path: a named person who can approve a listed tool for a named machine for a stated reason, recorded like any other decision. Policies with no exception route get quietly routed around; policies with an honest one get used. Review the list quarterly with the same question as day one: can every entry still be explained in one sentence?
See every screen from this guide live in the video — hardware inventory, software inventory, the License Manager and the alerts, on a real Endpoint Central console.
▶️ Watch Full VideoThe console raises an alert identifying the software and the machine. Endpoint Central can also be configured to uninstall prohibited software automatically — but the fair rollout runs alert-only first, so finds get a conversation before enforcement.
Usually they belong in a usage policy conversation, not the security list. Reserve 'prohibited' for genuine risk categories — torrent clients, unapproved remote tools, crackers, miners, unlicensed software — so every entry stays explainable.
Yes — that is what makes it fair and legally defensible. A short written policy, circulated and acknowledged before enforcement, turns the feature into management of company equipment rather than surveillance of people.