Application control
Application control is the use of execution policies to govern which software and code may run on a system.
An approved software catalog tells people what to install. Application control can enforce what is allowed to run, including code that arrived outside that catalog.
Rules may use file hashes, signing identities, or controlled file locations. A path rule needs particular care: if a user can put any file in an allowed folder, the folder may become a way to run unapproved code. ASD’s guidance requires protection against unauthorized changes to allowed paths and their contents.
Coverage also varies. Check executables, scripts, libraries, and drivers separately rather than assuming a policy covers all code. Microsoft documents controls extending beyond desktop apps to installers and scripting environments.
Check what the policy actually enforces
Audit and enforcement are different states. Microsoft’s deployment guidance uses audit events to refine an App Control policy before switching it to enforcement. A record of what would have been blocked is not a blocked execution.
Allowing a signed publisher also does not establish that every permitted use is safe. Approved tools can still be misused, particularly when they can interpret instructions or administer other systems. Application control belongs alongside access restrictions and monitoring.
The recruiting code-assessment article examines a request to run unfamiliar code. A believable recruiter does not make that code approved. The antivirus-exclusion article covers a different change: removing a defined scope from antivirus scanning. Neither a scanning exception nor a successful download establishes permission to execute.