Understanding Application Control
A technical look at the agent processes, scanning behavior, policy deployment mechanics, kernel-level enforcement, and conflict resolution in Application Control.
Specifications of Agent Processes
Six background processes handle discovery, enforcement, and notification on each managed endpoint.
Application Discovery: Data Scanning and Collection
How the agent finds and inventories applications on each endpoint.
One-time scan and continuous monitoring
After agent installation, a one-time scan identifies and collects verified .exe files in the Program Files and Program Files (x86) directories, as well as running processes. Scan duration depends on the number of installed applications. Results appear in the web console once collected.
Once an application control policy is deployed, running applications are continuously monitored. Newly installed applications are detected only if a policy is already in place. The central server automatically removes applications that have been inactive for 90 days.
Policy Deployment: Agent-Server Synchronization
How policies flow from the server to each managed endpoint.
Deployment options and refresh cycles
When a policy is created, two deployment options are available:
- Deploy Immediately — pushes the policy to currently online agents. For large custom groups (over 200 machines), the policy is applied to 200 machines initially; the remainder follow in the next refresh cycle.
- Deploy — schedules the policy for the next 90-minute refresh cycle.
Policy modifications, deletions, group changes, and unmanaged application updates are all synchronized during refresh cycles. In environments with a Distribution Server, changes are replicated there first, then pushed to agents during the 90-minute cycle.
Application Access Request Workflow
When a user requests access to an unmanaged application, the request is sent to the server immediately for administrator approval. Once approved, the application becomes accessible to the user right away.
Policy Enforcement in the Agent
How the kernel-level driver evaluates and enforces policies on each endpoint.
Kernel-mode driver enforcement
Policies received by the agent are enforced by a kernel-mode driver named acp_driver. The driver intercepts every newly created process and permits only those authorized by the deployed policy. Enforcement applies to .exe and .msi applications. Audited and blocked application events are reported during the 90-minute refresh cycle.
Application Policy Conflict Precedence
When conflicting allowlist and blocklist policies apply to the same target group, blocklisted applications always take precedence over allowlisted ones. The full order of precedence, from highest to lowest priority:
- Blocklisting using File Hash rule
- Allowlisting using File Hash rule
- Blocklisting using Verified EXE rule
- Allowlisting using Verified EXE rule
- Blocklisting using Product Name rule
- Allowlisting using Product Name rule
- Blocklisting using Vendor rule
- Allowlisting using Vendor rule
- Blocklisting using Folder Path rule
- Allowlisting using Folder Path rule
When an endpoint belongs to multiple custom groups with different policies, those policies are merged into a single consolidated policy. If one group deploys Audit Mode and another deploys Strict Mode, the endpoint uses Strict Mode.
Just-In-Time Access Workflow
JIT policies provide time-bound access to specified applications. The acp_driver facilitates execution of those applications on deployed machines, and access is automatically terminated when the specified duration expires — no administrator action is required to revoke it.