Application Control

During operation of the Application Control component, Kaspersky Endpoint Security controls launches of applications on the user computers. This helps reduce the risk of computer infection by restricting access to applications. Application launching is regulated by application control rules.

To use the component, a license that includes the corresponding function is required.

This feature is not supported in the KESL container.

Application Control can operate in two modes:

• Denylist. In this mode Kaspersky Endpoint Security allows all users to launch any applications that are not specified in the application control rules. This is the default operation mode of the Application Control task.
• Allowlist. In this mode Kaspersky Endpoint Security prevents all users from launching any applications that are not specified in the application control rules.

Thus, if the application control rules are created to the fullest extent possible, Kaspersky Endpoint Security prohibits the launching of all new applications that are not verified by the administrator of the organization's local network, but ensures the performance of the operating system and verified applications that users need to perform their job duties.

For each Application Control operation mode, separate rules can be created and an action can be specified: apply rules or test rules. Kaspersky Endpoint Security performs this action when it detects an attempt to start an application.

The Application Control settings are described in the following table.

Application Control settings

Setting	Description
Enable Application Control	The check box enables the Application Control component. This check box is cleared by default.
Action on application startup attempt	The action that Kaspersky Endpoint Security performs upon detecting an attempt to start an application that matches the configured rules: Apply rules (default value). If you select this option, Kaspersky Endpoint Security applies the Application Control rules and performs the action specified in the rules. Test rules. If you select this option, Kaspersky Endpoint Security tests the rules and generates an event about detection of the applications that match the rules.
Application Control mode	Application Control task operation mode: Allowlist. If you select this option, Kaspersky Endpoint Security prevents all users from launching any applications except those specified in the application control rules. Denylist (default value). If you select this option, Kaspersky Endpoint Security allows all users to launch any applications except those specified in the application control rules.
Application Control rules	This group of settings contains the Configure button. Clicking this button opens the Application Control rules window.

Page top