How to Configure Prohibited Software

How to Configure Prohibited Software

Overview

Why detecting an unwanted app isn't the same as removing it

Blocking an application by name stops it from launching, but it doesn't clean up what's already installed across the fleet. A vendor tool that was fine two years ago, a media player a user installed for a one-off task, a utility that's since been flagged as high-risk-these don't need a launch-time block, they need to be found wherever they're sitting and taken off the endpoint, ideally without a technician touching each machine by hand.

Prohibited Software is built for that inventory-driven cleanup: define a software title (and, optionally, exactly how to uninstall it), and the platform matches that definition against what's actually installed across endpoints, uninstalls it automatically when the auto-uninstall policy is enabled, and gives you a per-endpoint record of whether the removal succeeded. A global exclusion list keeps specific endpoints-a demo machine, a vendor's own laptop-out of enforcement without touching the underlying definition.

This guide walks the full workflow end to end: opening the Prohibited Software module, defining a prohibited software entry with its uninstall command, enabling the auto-uninstall policy, monitoring uninstall status per endpoint, excluding specific assets from enforcement, and confirming the removal actually reached a live endpoint.

• Define by software title, matched against real installs: pick the exact package (with its version) from what's already been inventoried, rather than typing a name and hoping it matches.
• Two uninstall command modes: use the default (Pre-fill) uninstall command the platform already knows for that package, or supply your own Custom command with the right silent switch.
• Auto-uninstall is a separate policy, not implicit: defining prohibited software doesn't remove it by itself-Auto-Uninstall Enabled is what turns detection into action.
• Notify before removing: an optional, editable notification message can be shown to the end user before their software is uninstalled.
• Exclude specific endpoints globally: a Global Exclusion list keeps named assets out of auto-uninstall enforcement across every prohibited software entry, not just one.
• See uninstall status per endpoint: Success/Failed status and the exact uninstall time are tracked per asset, not just at the definition level.

Prerequisites

Confirm these before creating a prohibited software entry. Selecting the wrong package/version, or leaving the auto-uninstall policy disabled, are the most common reasons a "blocked" application never actually gets removed.

1. Administrator access: your account holds a role permitted to manage the Device Control → Prohibited Software module.
2. Agent installed and reporting: the endpoint agent is installed, registered, and reporting healthy on every target device, and the software inventory for that device is up to date.
3. Exact software title and version confirmed: the Software field matches against inventoried packages (e.g. VLC media player (3.0.23)); confirm you're selecting the correct package rather than a similarly named plugin or sub-component.
4. Uninstall command decided: know whether the default (Pre-fill) uninstall command is sufficient, or whether you need a Custom command with a specific silent switch (e.g. /S).

Architecture: how a prohibited software definition becomes a removal

A prohibited software entry defines what's unwanted and how to remove it. The auto-uninstall policy decides whether that removal happens automatically and what the end user sees. Settings scope which endpoints are exempt from enforcement fleet-wide.

Step 1: Open Prohibited Software

Get oriented in Device Control before creating anything, so you know where the prohibited software list, the auto-uninstall policy, status, and settings each live.

Instructions

1. From the main console, go to Endpoints → Device Control.
2. Under Access and Applications, select the Prohibited Software card-"Reduces security risks by preventing the use of unapproved or high-risk applications."
3. Note the sections in the left sidebar: Prohibited Software (definitions), Auto-Uninstall Policy, Auto-Uninstall Status, and Settings.

Path: Console / Endpoints / Device Control / Prohibited Software

Result: You're in the Prohibited Software module with visibility into any existing entries before authoring a new one.

Step 2: Create a prohibited software entry

Define what's unwanted: a name for the entry, the exact software package and version, and how it should be uninstalled.

Instructions

1. Go to Prohibited Software → Create.
2. Enter a Name describing the entry's intent, e.g. Uninstall VLC.
3. In the Software field, search and select the exact inventoried package, e.g. VLC media player (3.0.23). Version auto-fills from the selection.
4. Under Uninstall Command, set Uninstall Command Type to Pre-fill (Use default uninstall command) or Custom (Provide custom uninstall command).
5. If using Custom, enter the Uninstall Command exactly, including any silent switch, e.g. "C:\Program Files\VideoLAN\VLC\uninstall.exe" /S.
6. Select Create.

Path: Console / Device Control / Prohibited Software / Create

Console: entry definition

Result: A prohibited software entry exists in the list alongside any others (e.g. an existing Uninstall VLC from linux entry targeting vlc (3.0.23-1)). It has no enforcement yet-that's controlled by the auto-uninstall policy in Step 3.

Step 3: Configure the Auto-Uninstall Policy

Turn detection into automatic action, and decide whether the end user is notified before their software is removed.

Instructions

1. Go to Auto-Uninstall Policy.
2. Toggle Auto-Uninstall Enabled on.
3. Optionally toggle Notify Before Uninstall on to warn the end user first.
4. Edit the Notification Message shown to the end user, e.g. "Prohibited software detected and will be uninstalled." (500-character limit).
5. Select Save.

Path: Console / Device Control / Prohibited Software / Auto-Uninstall Policy

Console: policy definition

Result: Every prohibited software entry is now eligible for automatic removal, and end users will see the notification message before it happens.

Step 4: Monitor Auto-Uninstall Status

Confirm removal actually reached an endpoint, rather than assuming the policy took effect.

Instructions

1. Go to Auto-Uninstall Status to see every uninstall attempt with Endpoint, Software Name, Version, Uninstall Status, and Uninstall Time.
2. Read the Uninstall Status column: SUCCESS confirms removal completed; FAILED means it did not.
3. Use the refresh control to pull the latest results after a policy change.

Path: Console / Device Control / Prohibited Software / Auto-Uninstall Status

Console: uninstall status

Result: A per-endpoint, timestamped audit trail of every uninstall attempt, successful or not.

Step 5: Exclude specific endpoints with Global Exclusion

Keep a named endpoint out of auto-uninstall enforcement entirely, without editing any individual prohibited software entry.

Instructions

1. Go to Settings.
2. Toggle Enable Global Exclusion on. This reveals the Excluded Assets field.
3. Search and select one or more endpoints to exclude, e.g. <ENDPOINT-HOSTNAME>.
4. Select Save.

Path: Console / Device Control / Prohibited Software / Settings

Console: global exclusion

Result: The selected endpoint(s) are exempt from auto-uninstall across every prohibited software entry, while enforcement continues normally everywhere else.

Step 6: Confirm end-to-end enforcement

Verify the whole chain-definition, policy, and endpoint agent-actually results in a removal.

Instructions

1. With Auto-Uninstall Enabled and Notify Before Uninstall on, wait for the agent on a matching endpoint to detect the prohibited software.
2. The end user sees a system notification (e.g. a Windows PowerShell toast: "EndpointOps – Software Uninstall-Prohibited software detected and will be uninstalled.").
3. Return to Auto-Uninstall Status and refresh; confirm a new row appears for that endpoint with Uninstall Status SUCCESS and the current timestamp.

Path: Console / Device Control / Prohibited Software / Auto-Uninstall Status

Result: Confirmed, evidence-backed removal-a real notification reached the endpoint and the status list reflects a successful uninstall, not just an assumption based on the policy being enabled.

Best practices for prohibited software

Troubleshooting: common issues and resolutions

Frequently asked questions