Application control with EAMP
App Control for Business (WDAC), from audit to enforce.
Only software you trust gets to run. That stops ransomware and the abuse of built-in Windows tools (LOLBins) at the source. The technology is already there, in Windows itself; the art is introducing it without breaking anything.
Sound familiar?
- App Control has been in audit mode for months, because nobody dares take the step to enforce.
- Every software update needs a policy change, and that doesn’t scale.
- One big merged policy has become impossible to oversee or maintain.
- Auditors or regulators ask for application allow-listing, but there is no plan.
What you get
- A policy architecture that survives software updates
- A phased plan from audit to enforce
- Signed policies, driver and LOLBin blocklists, and managed installer
- Optional: EAMP to keep day-to-day management simple
- App Control for Business
- EAMP
- MSIX
- App Attach
- Azure Artifact Signing
- Microsoft Intune
Application control with EAMP
How we approach it
Inventory
Which software runs, who signed it, and how does it get onto the device?
Design
Base and supplemental policies side by side, at publisher level where possible, so updates keep working.
Simulate
Audit mode and simulation: see in advance what would be blocked, and why.
Enforce
Signed policies moved to enforce in phases, with a guided way back if needed.
Frequently asked questions
What is the difference between App Control for Business and WDAC?
They are the same: Microsoft renamed Windows Defender Application Control (WDAC) to App Control for Business. It is built into Windows and controls which code may run, down to the kernel.
Won’t updates keep breaking the policy?
Not if the policies are set up well. With rules at publisher level and separate supplemental policies per application, updates from the same vendor keep working without changing the policy.
Isn’t AppLocker enough?
AppLocker is older, easier to bypass and no longer being developed by Microsoft. App Control for Business is the recommended successor and also protects drivers and scripts.
Do we need EAMP to introduce App Control?
No. We introduce App Control with standard Microsoft tooling and Intune. EAMP is an option if you want to simplify management: compose, simulate, sign and deploy policies from one portal.
What about signed policies?
Signed policies can’t simply be removed, not even by an administrator with local rights. That makes them strong, but calls for a careful process, especially to change or remove them safely later.
Start with a 20-minute intake.
We discuss your situation and tell you honestly whether and how we can help, even if the answer is ‘you don’t need this’. You’ll hear from us within two business days.