One staff PC with a torrent client or a game is never just one PC — it is a security hole and a time leak for the whole office. ManageEngine Endpoint Central has an Application Control module that blocks any application on every managed computer from a single console. This guide gives you the full flow, in the order that does not break anyone's work.
Let us be honest about what this tool is. Endpoint Central's Application Control discovers the applications installed on your managed PCs, lets you build allowlists and blocklists, and pushes them out as a policy. A kernel-level filter then checks every new program the moment it tries to start and stops the ones your policy forbids. Blocking itself takes two minutes. The real skill is the order: discover first, put the policy in writing, watch in audit mode, and only then enforce. Skip that order and the first thing you block will be the one app the accounts team needs on month-end day.
Application Control starts with agent-based discovery: the Endpoint Central agent scans every managed PC and lists what is actually installed, including software nobody in IT ever approved. Read that list before you block anything. Most admins find surprises — a screen-recorder here, a personal VPN there, three different PDF tools doing the same job.
This list is also your evidence. When someone later asks why an app was blocked, the discovery report shows it was running on office machines, on office time, before anyone touched a policy.
Decide the categories on paper first: games, torrent and peer-to-peer clients, personal VPNs, remote-access tools nobody approved, crypto miners, and anything with no business purpose. Write down who approves an exception and how fast — and tell the staff before the policy lands, not after the first angry phone call.
A written, announced policy turns blocking into a rule everyone knew about. A silent block turns it into a personal fight between IT and one surprised employee.
In the console, go to Application Control, then Application Groups, and choose Create Blocklist. Add applications using filters — Vendor, Product Name, Verified Executable, File Hash, Folder Path and Store Apps. Prefer vendor and verified-executable rules over a plain file-name rule: a name rule falls the moment someone renames the file, while the file's signed identity does not change.
One honest note: for a single quick block, Endpoint Central also keeps a simpler Block Executable option under Inventory, matched by path or hash. It is fine for one file on a few PCs. Application Groups are the proper route when the rule must live as a policy across the office.
Under Deployment, open Deploy Policy and associate your blocklist with a custom group of computers. Start with a small pilot group — your own department, or a few friendly users — even if the final target is the default All Computers group. Policies are attached per group, so the design office and the accounts office can carry different lists without any fighting.
While deploying, also set the custom notification message users will see when an app is blocked. A message that says which policy blocked it, and who to contact, saves you a dozen support calls.
Endpoint Central offers two enforcement modes. In Audit Mode, allowlisted and unmanaged applications still run, but every event is collected: you see exactly what would have been blocked, where, and by whom. Run the policy in Audit Mode for at least one full work cycle — including month-end, when the rarely used apps come out.
Work through the Unmanaged Apps view and the blocked-application access reports, and resolve every entry: add it to the allowlist, add it to the blocklist, or move it into an application group. The goal before enforcement is a short, understood unmanaged list — not a leap of faith.
In Strict Mode the policy is enforced: blocklisted apps cannot start, full stop. This is the mode the video demonstrates, and it works — a kernel-level driver filters every newly created process, so the rule holds even for an app that was installed long before the policy existed.
Now the part that keeps it humane: enable the option that lets users request access to unmanaged applications. An approved request can be granted as just-in-time access — temporary, time-bound permission that expires on its own and is written into the audit log. Blocking with a working request door gets compliance. Blocking with no door gets workarounds.
Blocking and uninstalling solve different problems. Uninstall when the software should not exist on office machines at all — unlicensed copies, known-bad tools. Block when the app is legitimate but wrong for some people or some hours: the design tool the sales team does not need, the game that is fine at home and not here. A blocked app stays installed and runs again the moment policy changes, which is exactly what you want for exceptions and role changes.
Remember the limit of both: uninstalling is a one-time event a determined user can undo by reinstalling, while a block policy re-applies itself at every agent check-in. For anything that truly matters, policy wins.
Every click shown live in the ManageEngine console — application groups, policy deployment and the audit-to-strict switch.
▶️ Watch Full VideoNo. A blocked application stays installed exactly as it was — it simply cannot start while the policy applies. Remove the app from the blocklist or remove the policy, and it runs again without reinstalling. That is why blocking is the right tool for role-based rules, and uninstalling is the right tool for software that should not exist on the machine at all.
No, and this is worth checking before you plan a rollout. Application Control is a licensed add-on module for Endpoint Central, and ManageEngine also sells it as a standalone product called Application Control Plus. Whether your console shows the Application Control menu depends on the licence you bought — if the menu is missing, it is a licensing question, not a broken install.
Yes. The rules match on identity — vendor, verified executable, file hash or path — not on an install record. If someone installs or copies in a blocklisted application later, Strict Mode stops it the moment it tries to run. In an allowlist setup the protection is even broader: anything that is not on the allowlist is treated as unmanaged and blocked in Strict Mode.