Strict Mode on day one is how application control projects die. Audit Mode is the same policy with the enforcement switched off and the recording switched on: everything runs, everything is logged, and you learn what your office actually uses before you forbid any of it. This is the phase that decides whether the rollout is boring — and boring is the goal.
No admin knows everything that runs in their office. There is the label utility installed in 2022 by someone who left, the converter the export team opens twice a month, the updater service with a frightening name that turns out to be legitimate. Audit Mode exists to surface all of it safely: deploy the policy, let the events collect, and hold the conversation about each application while nothing is broken yet. Here is how to run the watching phase like it matters — because the strict phase will be exactly as good as this one.
Deploy the policy in Audit Mode and the allowlisted and unmanaged applications all keep running, while the console collects the events: which apps started, on which PCs, under which users. ManageEngine's own guidance is to start here, analyse the unmanaged applications, resolve each one into a list, and only then switch the policy to Strict Mode.
Set staff expectations correctly when you announce it: nothing will be blocked during audit. People hear that, relax, and — this is the useful part — keep using their real tools, which is precisely the behaviour you need to observe.
A week of audit in the middle of the month shows you the daily tools and misses the ones that matter most: the month-end closing utility, the quarterly report generator, the tax tool that wakes up four times a year. If Strict Mode first meets those apps on deadline day, you will be granting emergency exceptions under pressure.
The honest minimum is one full month, covering a month-end. For seasonal businesses, note the seasonal tools from staff interviews and allowlist them deliberately instead of pretending the audit saw everything.
In the deployment view, open Unmanaged Apps for the group and give every entry a verdict: add to allowlist, add to blocklist, or move into an application group. Zero unmanaged is the documented ideal before strict enforcement, and it is achievable — the long tail is usually a handful of PCs with odd histories, not hundreds of mysteries.
For the genuinely unknown file on one PC, ask its user before judging. Half the scary names are boring tools with bad branding, and the other half are exactly what you suspected. Either way, the conversation is data — and it is free while nothing is blocked yet.
When the unmanaged list is clean, switch one pilot group to Strict Mode — IT itself, or one cooperative department — and run it for a week with the request door open. The pilot catches what audit cannot: the helper process an allowed app spawns, the plug-in that runs under a different name, the tool that audits as one app and executes as three.
Only then roll strict mode group by group. Each group's first week gets your attention while the blast radius of any surprise is one department, not the company.
Every click shown live in the ManageEngine console — application groups, policy deployment and the audit-to-strict switch.
▶️ Watch Full VideoNo. In Audit Mode every application runs, including unmanaged ones — the policy only records what happens. The value is the report: you see which applications a future Strict Mode would stop, on which machines and for which users, while there is still time to fix the lists calmly. Enforcement begins only when you switch the policy to Strict Mode.
At least one full business cycle — for most offices, one month that includes a month-end. Short audits miss the periodic tools: closing utilities, quarterly generators, compliance software. If your business has a strong seasonal peak, either audit through it or deliberately allowlist the seasonal tools from staff knowledge before going strict.
That every application seen during audit has been given a verdict — allowlisted, blocklisted, or placed in an application group. It is the clean starting line ManageEngine recommends before Strict Mode, because in strict enforcement an unmanaged application is blocked by default. A short list of unresolved apps is not a detail; each one is a future blocked-work incident with a name already attached.