Application Control powered by AppSense
Ivanti Application Control is the new name for AppSense Application Manager
What's new in Application Control?
Version 10.1 FR1
Console Rebrand and Renaming
The Application Manager Console has been updated to reflect the new company name of Ivanti - see here for more details. As well as the change of branding from AppSense to Ivanti, Application Manager is now known as Application Control as of this release.
The Application Control console, as well as components on the endpoint have been updated to reflect these changes.
You may still see the AppSense Application Manager name used in certain areas, such as the registry or services. This is to make the transition as least disruptive as possible for existing users of Application Control.
Having made significant changes to the design of the User Workspace Manager consoles in version 10, we have listened to feedback and added a splash of color back into the consoles by refreshing and updating some of the icons used in the Application Control console
Extended Audit Logging
Application Control Event Logging has been extended to include the following:
- New event for stopped and started services by a user
- Parent process name now included in 9000 events
- File owner now included in 9000 events
- Determining rule now included in events
For further information about Application Control Auditing, see Auditing.
Windows Operating System Condition
The Microsoft update model now uses build numbers to identify feature releases and service packs. When you are creating a computer operating system rule, the target build number can be specified and configured to match the specific build number entered or to use it as the maximum or minimum build release.
For more information, see Computer Conditions.
Extended Metadata with Digital Certificate checking
When verifying a file using metadata, administrators can compare the entire certificate to determine the authenticity of the file and whether the metadata can be trusted. The feature also includes real-time certificate verification that helps you diagnose any issues by selecting different combinations or verification settings. As you configure the settings, the certificate status is updated.
Self-Elevation has been extended to support all file types. Administrators can also specify that certain file extensions can be elevated only when open with certain applications. For example, you can specify that VBS files can be elevated only with wscript.exe.
For more information, see Self-Elevation.
Command Line Matching
Application Control can now apply rules based not just on the application being launched, but also any command line arguments. This is useful if full access to an application is not required but specific users need to launch certain files or run applications under certain conditions. Command line arguments can be added for File and Signature rule items.
This feature also includes two new advanced settings - Validate PowerShell scripts and Validate Java archives. When these settings are turned on, powershell.exe, powershell_ise.exe, and java(w).exe are blocked and PS1 and JAR files are subject to trusted ownership checking. Specific files can then be added to rules which do not require a trusted owner. Add powershell.exe or java(w).exe to a rule to allow them for specific users, while blocking them for all other users. For example, you may want to allow powershell.exe for your developers so they can launch any PowerShell script.
The System Controls feature of Application Control has been extended to include the protection of processes. Using this enhancement, a specified process - such as antivirus software - can be protected from termination by all users, including administrators.
For further information, see System Controls.
Enhanced Windows Store App Support
Further support has been added to the control of Windows Store Applications. Applications can be blocked or allowed based on the application's publisher. Using the publisher for sideloaded apps means multiple apps can be controlled. This makes it possible to configure a restriction for all Store Apps while allowing those sideloaded by an organization or IT department.
For further information, see Rule Items.
Policy Change Request per Rule
Administrators can enable the Policy Change Request feature on a per-rule basis. This allows the type of change request and the available request methods to be configured differently for different users or groups of users. Some aspects of the feature, such as specifying the email address and shared key, remain global.
For further information, see Policy Change Requests.
Was this article useful?
The topic was:
Not what I expected
Copyright © 2017, Ivanti. All rights reserved.