Block unapproved app installations on Windows 11 using HexnodeSolved

Hello @yasmin_farooq ,

Hexnode does not currently provide a direct Windows policy that intercepts every application installation attempt and displays an admin approval prompt.

However, you can control what users are allowed to access by using one of the following approaches:

• App Allowlist: Configure an Allowlist policy with only the approved applications. This restricts users to the apps you explicitly allow, and unapproved applications will be blocked from being accessed.
• Kiosk Mode: If the device has a fixed-use scenario, Windows Kiosk Mode can be used to restrict the device to specific approved applications.
• Custom Scripts: If your organization has a Windows script that modifies local permissions or controls installer behavior, it can be deployed to devices using Hexnode’s Execute Custom Script action. The script itself would need to be created and validated for your Windows 11 environment.

Regards,
Simon Scott
Hexnode UEM

Can an EDR tool handle this instead? We use one already and were hoping it could block users from installing apps.

EDR tools are generally designed to detect and block malicious files, ransomware, suspicious behavior, unauthorized scripts, and known threats. They are not usually meant to act as an app installation approval system for legitimate software.

So, while an EDR may block malicious or risky installers, it will not typically stop every standard user from installing a normal legitimate application and route it for admin approval.

So for Windows 11 Pro, the best option in Hexnode would be App Allowlist?

Yes. If the goal is to ensure users cannot access unapproved apps without admin consent, configure an Allowlist policy in Hexnode UEM:

1. Create or edit the Windows policy.
2. Go to App Management.
3. Select Blocklist/Allowlist.
4. Choose Allowlist.
5. Add only the approved applications.
6. Associate the policy with the required Windows devices or device groups.

With this setup, only the applications in the allowlist remain accessible. Any unapproved application will be blocked from use. If you specifically need installer-level permission prompts, that would require a Windows-side configuration or custom script outside Hexnode’s built-in app management policy.