Prohibit Software

Adding prohibited software

The first step is to add a software that you wish to prohibit. Once added, during every inventory scan the agent checks for that software and updates the server of the same. If the post configurations are enabled, the configured implementations will take place. To add a software:

1. Navigate to Prohibit Software under the Inventory view. This will list the details of all the software that are already prohibited, if configured already.

Click Add Prohibited Software. This opens the dialog with software detected on managed Windows computers. Run an inventory scan to populate the list. For user-installed applications, run the scan while the relevant user is signed in. To create an execution policy before an application is deployed, use the Path Rule in Block Executable.

2. Select the software that you wish to prohibit and move them to Prohibited List.
   Note: When you add a Software Group, the Prohibited Software List shows the group's parent software entry, which represents the grouped versions. To review an application that belongs to a group, search for the group's parent entry. Create Software Group.

3. After adding all the software, click Update. The software gets added to the prohibited list.

Removing prohibited software

To remove a prohibited software, select the software that you wish to remove from the prohibited list and click Remove Prohibited Software to eliminate the selected software from the prohibited software list.

Configuring the Auto-Uninstallation Policy

When a prohibit software is added, you can add some auto-uninstallation settings to automatically uninstall that software, when found on the targeted computers. The uninstallation will happen during the subsequent refresh-cycle. Follow the steps given below to configure the Auto-Uninstall Policy:

1. Select the Auto-Uninstall Policy tab.

2. Select Enable Automatic Uninstallation check box.

3. Specify the Maximum number of Software that can be uninstalled from a computer during the subsequent refresh cycle.
   
   Note: Increasing this number will cause high CPU usage during uninstallation. If the detected prohibited software count exceeds the limit (maximum number of  software to be uninstalled) in a computer, the exceeding numbers of software will be uninstalled during the subsequent startup.

4. Select Notify User before Uninstalling check box and specify any custom message in case you want to prompt to the user before the software uninstallation.
   
   Note: The user will be notified with an Alert message during logon and whenever the agent detects prohibited software. This functionality will be applicable only if the Notify User Settings is configured.

5. Specify the wait-window for the software uninstallation. Say if you want to remove the software three days after it has been detected, then mention 3 in the text box provided.

6. Click on Save to save changes.

   Auto-Uninstallation option is available by default for .msi applications and for .exe applications, silent switches are required for uninstallation.  The following steps will guide you through the Auto-Uninstallation of .exe based software applications.

1. Select the Prohibited SW tab and click on Not Configured linkunderUninstall commandagainst the.exeapplication that needs to be uninstalled..

2. The Add/Edit Uninstall Command window  pops up.

Choose Pre-fill Uninstall Command to use the command registered in Add/Remove Programs, then provide the application's silent switch. Choose I will specify myself to enter the complete uninstall command and silent arguments. Use Identify uninstallation switches or commands to locate the registered command. Test the complete silent command on one computer before applying the policy, and use the software vendor's supported silent arguments for the detected version.

3. Click Save to save the settings.

4. Verify the status in Auto Uninstallation Status Tab (This uninstallation will happen based on Auto-Uninstall Policy configured)

5. Under Auto Uninstallation Status select Detailed View to see the status and remarks.

Select the removal workflow by outcome: Use Auto-Uninstallation Policy to remove software after Prohibit Software detects it during an inventory refresh. Use Uninstalling EXE-based Applications for Computers for a direct software-deployment removal, Software Details for an inventory-initiated uninstall action, or Block Executable to control execution.

Reviewing software-removal activity

Use the following product views to trace a software-removal action:

• Open Inventory > Prohibit Software > Auto-Uninstall Policy and review policies that include the software.
• Open Software Deployment > Packages and review uninstall packages for the software.
• Open Reports > Configuration Reports > Configurations by Computer to review configurations deployed to the affected computer. Configurations by Computer.

Excluding Computers from Software Uninstallation

Under certain circumstances, a software that is prohibited will be required by a specific department to work on. For instance, when social media applications and software are predominantly restricted, some departments might require that to boost your work. Under such cases, you can configure an Exclusion to allow those specific users to access this software. You can create a custom group comprising specific computers or can add individual computers to the Exclude list. The following steps will help you exclude groups:

1. Navigate to Prohibit Software under Inventory view. This will list the details of all the software that are already prohibited.

2. Select the checkbox corresponding to the specified software and click the link under Exclusions column. This opens the Add Exclusions dialog.

3. Select whether to exclude custom groups or computers and select the groups/computers and move it to the Excluded list.

4. Click on Save to save changes.

Approving requests to use prohibited software

This feature is supported only for customers, who use Endpoint Central MSP version (10.0.192) or above.

1. From the agent tray icon, end-users can find the list of prohibited software in their network and choose to rise requests to use specific prohibited software based on their needs.

2. These requests can be handled from the product's web console -> Inventory -> Prohibit Software -> User Requests.

3. If you have integrated Endpoint Central MSP with ServiceDesk Plus(Version 9203 or above),

   • The requests to use prohibited software can be resolved only from ServiceDesk Plus console. Know how to resolve requests in ServiceDesk Plus here.

   • To associate the requests to use prohibited software to ServiceDesk Plus templates, from Endpoint Central MSP navigate to admin tab -> under integration settings, ServiceDesk Plus -> Select the "Send requests for using Prohibited Software as tickets to ServiceDesk Plus for approval" option and provide the ServiceDesk Plus template name.

4. Once the technician approves the request, users will be allowed to install and use the requested software.

Configuring Global Exclusion

Similar to excluding computers and custom groups for individual software, you can create a global exclusion list of computers. Computers that are added to the Global Exclusion list, either manually or via custom groups, applies to all the software. This means all these computers can have any of the software that have been marked as prohibited.

To configure global exclusion, click the Configure Global Exclusion button and select the required computers/custom group of computers and save.