Centralized AppLocker Management via the RMM

Hello everyone,

I would like to see a feature that allows AppLocker to be managed centrally via the RMM.

The goal is to improve application control and execution control on Windows systems.

Many customers already use antivirus software or EDR solutions, such as Bitdefender, ESET, Sophos, or other options. Nevertheless, there remains a risk that unknown or unwanted programs could be launched from locations such as the Downloads folder, AppData, Temp, the Desktop, or user profiles.

In my view, this is exactly where AppLocker would be a very useful additional layer of protection. The goal is not to replace existing antivirus software, but to fundamentally improve control over the execution of unauthorized applications and to provide additional protection against typical entry points for malware or ransomware.

The RMM should be able to centrally manage, deploy, and monitor AppLocker policies.

Currently, while AppLocker can be used via built-in Windows tools, management can be quite time-consuming depending on the environment. Especially for smaller customers without Microsoft 365, Intune, or complex security platforms, it would be a major benefit if the RMM could take on this task.

Many customers have traditional Windows environments with Windows 11 clients, Windows servers, and third-party antivirus software. For exactly these types of environments, a centralized AppLocker workflow via the RMM would be very helpful.

In my view, a centralized audit and block mode would be useful.

In audit mode, nothing would be blocked yet. However, the RMM would detect and report which applications would later be blocked in block mode. This would allow you to thoroughly analyze the environment first without directly disrupting operations.

In block mode, unauthorized applications would be actively prevented from running.

A streamlined workflow would be important:

• Manage AppLocker rules centrally in the RMM

• Distribute rules to individual devices, groups, or all systems

• Use audit mode for the testing phase

• Block mode for production protection

• Pilot deployment for individual devices or customer groups

• Display blocked or suspicious launches in the RMM

• Optionally generate a ticket or alert

• Centrally approve legitimate applications

• Roll out the updated whitelist to all applicable systems

• Emergency rollback back to audit mode

If an unknown or unapproved application is launched, the RMM should display the relevant information, for example:

• Device

• User

• Time

• File name

• File path

• Publisher / Manufacturer

• Hash value

• Rule Type

• Action: Detected only in audit mode or actually blocked in block mode

The technician should then be able to decide whether the application is legitimate and should be approved.

It’s important to me that applications aren’t blindly approved automatically. That would be problematic for security reasons. However, the RMM could very well provide recommendations, facilitate the review process, and automate distribution once approval is granted.

In my view, AppLocker would be particularly interesting because it is a built-in Windows feature and can be used independently of the antivirus software in use.

Many customers do not use Microsoft Defender as their primary antivirus protection, but rather third-party solutions such as Bitdefender, ESET, Sophos, or other AV/EDR products. This is precisely why an AppLocker-based feature would be very valuable, as it does not necessarily require Microsoft Defender, Microsoft 365, or Intune.

The existing antivirus protection would continue to handle malware detection, behavioral analysis, and traditional endpoint security. AppLocker would additionally prevent unauthorized programs from running at all.

That would be a powerful combination:

Antivirus/EDR detects threats.
AppLocker further reduces the attack surface by preventing unknown or unwanted programs from launching in the first place.

If a customer uses Microsoft Defender, additional Defender features such as Attack Surface Reduction Rules or Controlled Folder Access could also be integrated or monitored.

However, in my view, this should be optional. The core of the functionality should be AppLocker, so that it also works even when...