Endpoint protection that lets only approved software run on locked-down machines

The capability you’re describing is application allowlisting (also called application control): only approved software can run; everything else is blocked by default.

For Windows machines, consider Microsoft App Control for Business (formerly WDAC), managed through Intune. It can allow approved apps and block unapproved ones; you can start in audit mode to see what would be blocked before enforcing it. (learn.microsoft.com)

If you want a dedicated, centrally managed allowlisting product, ThreatLocker is one option. (marketplace.microsoft.com)

If you tell me your OS and whether you manage devices with Intune, I can narrow down the best fit.

The term you're describing is application allowlisting, a form of application control. It blocks everything by default and runs only software someone has approved. It is a security control that allows only explicitly approved applications and scripts to run on a system and blocks everything else by default.

Commercial products often recommended for 2026:

• ThreatLocker Protect: a deny-by-default product aimed at SMBs, MSPs, and enterprises. Reviewers note its approach blocks threats before they execute rather than detecting them after the fact.
• Airlock Digital: an allowlisting specialist. One review says it is built around the ACSC Essential Eight, and it is recommended for very large deployments.
• VMware Carbon Black App Control (now under Broadcom): suited to enterprises locking down servers, kiosks, and regulated endpoints.
• Ivanti Application Control: Windows-focused, and it pairs allowlisting with privilege management.
• CyberArk Endpoint Privilege Manager and BeyondTrust Endpoint Privilege Management: combine application control with least-privilege controls.
• Microsoft WDAC/AppLocker: the free native option on Windows, though it requires more engineering effort. One 2026 guide calls it the free native option for Windows estates with engineering capacity.

Choosing: Dedicated allowlisting tools are strongest on fixed-function machines such as kiosks, POS terminals, and servers, where the software rarely changes. Allowlisting also takes ongoing work to maintain as software updates, so plan for that. Some vendors also offer blocklisting-based or hybrid modes if a full allowlist is too rigid. Note that allowlisting works best alongside other controls, because an approved application with a vulnerability is still an attack path.

If you tell me your OS mix, fleet size, and budget, I can narrow this to two or three options.

The security practice of ensuring that only approved software can run on a machine—while blocking everything else by default—is known as Application Allowlisting (often referred to as application whitelisting).

This approach is considered a "default-deny" security posture. Because it does not rely on identifying malicious files (like traditional antivirus), it is highly effective against unknown threats, zero-day exploits, and unauthorized software.

Common Solutions and Technologies

Depending on your environment, you can implement this using built-in operating system tools or third-party enterprise solutions.

1. Built-in OS Tools (Often Free)

• Windows AppLocker: A feature in Windows that allows administrators to create rules based on file paths, hashes, or publisher certificates to control which apps, scripts, and installers can run.
• Windows Defender Application Control (WDAC): A more robust, modern successor to AppLocker. It provides stronger, kernel-level enforcement and is generally recommended over AppLocker for high-security, locked-down environments.

2. Specialized Third-Party Solutions

For more complex environments, third-party tools provide easier management, better reporting, and advanced features like "learning modes" (which help identify what software is currently in use before you turn on the blocks):

• ThreatLocker: Known for its "Ringfencing" and zero-trust approach, which not only controls what runs but also limits how applications interact with sensitive data and system resources.
• VMware Carbon Black App Control: A long-standing, enterprise-grade solution often used in highly regulated or "fixed-function" environments (like kiosks, ATM servers, or industrial control systems).
• Airlock Digital: Provides flexible application control with a strong focus on ease of management and granular policy enforcement.

Implementation Best Practices

Successfully locking down a machine requires a structured approach to avoid breaking critical business processes:

1. Audit Mode (Learning Mode): Never start with "Deny All." Always enable the software in "Audit" or "Learning" mode first. This logs every application currently running without blocking anything, allowing you to build an accurate "allowlist" of legitimate business software.
2. Remove Local Admin Rights: Application control is significantly more effective when users do not have local administrator rights. If a user has admin rights, they may be able to bypass the security controls.
3. Define Trusted Publishers: Instead of managing individual file hashes (which change with every update), try to use publisher certificates. This allows you to "trust" all software signed by a specific vendor (e.g., Microsoft, Adobe), which drastically reduces the maintenance burden.
4. Maintain a Process for Exceptions: You will inevitably need to install new software or updates. Have a clear, automated, or streamlined process for IT to review and add new applications to the approved list.

Summary Recommendation

• If you are a smaller shop or purely Windows-based: Start by testing Windows Defender Application Control (WDAC).
• If you need easier management or cross-platform support: Look into dedicated solutions like ThreatLocker or Airlock Digital, which are specifically designed to reduce the administrative overhead of maintaining an allowlist.

You’re looking for application allowlisting (also called application control): a default-deny policy that permits only approved software to run.

• Microsoft App Control for Business (formerly WDAC) — built into Windows and designed to enforce explicit rules about what code can run. It can run in audit mode before you switch to enforcement. ⁸¹⁰
• ThreatLocker Protect — a commercial endpoint option focused on default-deny allowlisting, with additional controls over what approved apps can access. ¹³¹⁴
• Airlock Digital, Ivanti Application Control, and ManageEngine Application Control — other products to compare for centrally managed allowlisting and endpoint policy enforcement. ⁴¹³

For Windows-only machines, start by evaluating App Control for Business. For mixed environments or a managed commercial platform, compare the commercial products against your operating systems, deployment workflow, and support needs. In any case, pilot in audit/learning mode first, then enforce after validating approved apps and update processes. ¹⁰¹³