Block application downloads and installs from browsers on Windows devicesSolved

Hexnode does not currently provide a single Windows policy that blocks application downloads from all browsers or prevents every browser-downloaded installer from running based only on its download source.

For this requirement, there are a few approaches to consider:

1. App blocklist

Users can run applications normally except for the apps or rules that are explicitly blocked. This is useful when you only need to restrict a known set of unwanted applications.

2. App allowlist

Allowlist works as a default-deny model. Applications are blocked by default, and only explicitly allowed apps can run. This is the stricter option and is better suited for environments where only approved corporate apps and required system utilities should be accessible.

3. Browser-specific download restrictions

If you have browser-specific scripts or configuration commands to restrict downloads, they can be deployed to Windows devices using Hexnode’s Execute Custom Script action. This depends on the browser and the restriction method supported by that browser.

4. Media management policies

If the concern includes controlling access to removable drives or external storage, media management policies can be used to manage drive access on the device.

For a zero-trust style application control setup, app allowlisting is generally the better fit, but it requires careful planning because all required business apps and native system components must be allowed explicitly.

Regards,
Mary Romero

So if I use blocklist, users can still install anything unless I already know the app and block it, right? I’m trying to avoid unknown installers too, not just a few known apps.

Yes, that is the key difference.

With a blocklist, everything is allowed unless it matches a blocked app or rule. It is best for stopping specific known applications.

With an allowlist, everything is denied unless it is explicitly allowed. This is the recommended approach when you want to prevent unknown or unauthorized applications from running on Windows devices.

Before enforcing allowlist broadly, test it on a small group of devices. Make sure to include all required productivity apps, security tools, management agents, updaters, and Windows system utilities that users need. Otherwise, legitimate apps or system processes may be blocked.

Regards,
Mary Romero