ASD Essentials IT.PRO-07.2 Restrict Administrative and Management Tools to Approved Sets and Authorised Locations
What it says
Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLets only approved admin and management tools run, and only from authorised places such as a dedicated admin computer or protected folder.
Admin and management tools are the programs IT staff use to set up and fix systems, such as remote access apps, management consoles and scripting tools. The organisation decides which ones are approved. To meet this, approved tools run only from authorised places, such as a dedicated admin computer or a protected folder. Any other admin tool is blocked on every managed device, and so is an approved tool run from anywhere else.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
Why it matters
Intruders use admin tools, their own or ones already built in, to explore the network, spread between systems and switch off security software. Without these limits, they can launch them from any folder or device and blend in with normal admin work.
How to implement
The infrastructure lead and security team should list the admin and management tools in use, then define an approved toolset.
Record each tool's version, who may use it and where it may run, and have system owners formally approve it.
Endpoint and server engineers should add software-blocking (application control) rules on every managed device, allowing approved tools by publisher or file fingerprint (hash).
Block all other admin tools, including remote access and network discovery tools attackers favour.
Platform engineers should install approved tools in protected folders only approved users can change, and allow them to run only there.
Block launches from folders users can write to, such as downloads, and from USB drives and unapproved network shares.
The admin access lead should name the systems allowed to run admin tools, such as secure admin workstations and jump servers (servers admins connect through).
Remove or block admin tools on every other system, including everyday user devices.
The application control owner should enforce each rule set so no one can bypass it.
Even local administrator and emergency access accounts must not run tools outside the approved set or locations.
Keep it running
The toolset owner sends new tools, versions and locations through change approval and updates the rules. Switch tested rules from audit mode (logging only) to blocking. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices. On user devices, the approved set is usually just IT's device management and remote support tools. Treat blocked launches as possible intrusions or admin workarounds.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the approved toolset and a list of admin tools actually in use.
Look at
Whether a toolset is defined at all, and whether tools found in use are missing from it.
Good evidence
An approved toolset covers every ASD domain, and every admin tool in use is on it.
- Check 2 of 5What an auditor asks for
Ask for
Request application control policies, coverage by ASD domain, and a test with common attacker tools.
Look at
Whether devices run audit only or lack the rules, or renamed or similar unapproved tools still run.
Good evidence
Rules block on every managed device, and tools outside the approved set cannot run.
- Check 3 of 5What an auditor asks for
Ask for
Request the folder rules and permissions, and a test launch from a user-writable folder.
Look at
Whether approved tools still run from downloads or USB drives, or unapproved users can change tool folders.
Good evidence
Approved tools run only from protected folders that only approved users can change.
- Check 4 of 5What an auditor asks for
Ask for
Ask which systems may run admin tools, and request a test on an everyday user device.
Look at
Whether admins can run admin tools from everyday user devices or other unauthorised systems.
Good evidence
Admin tools run only on authorised systems, such as jump servers, even for admins.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the application control exemption list and who can change or disable the rules.
Look at
Whether users are exempt or can switch off the rules, or local admin or emergency accounts escape them.
Good evidence
No one can bypass the rules, and local admin and emergency accounts stay within them.
ASD indicators of good practice (8)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1No approved administrative toolset is defined.
- NE-2No restrictions are placed on the location administrative tooling can be executed from.
- NE-3No controls prevent unapproved administrative tools, including tools commonly used in post-compromise activity, from executing on managed assets.
Partially effective(3)
- PE-1An approved toolset is defined but not consistently enforced across all assets.
- PE-2Administrative tooling is configured to execute from known locations, but privileged users can still run tooling from unapproved locations.
- PE-3Some unapproved administrative tools are blocked but enforcement gaps exist.
Fully effective(2)
- FE-1A defined and enforced approved toolset exists for administrative and management activities, and execution is limited to authorised, known locations.
- FE-2Administrative and management tooling outside the approved set is blocked from execution, including from unauthorised locations.
Mappings
Closest match in ISO/IEC 27001: A.8.18, Use of Privileged Utility Programs, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.18.
IT.PRO-07.2 requires administrative and management tooling to be limited to approved software sets and run only from authorised, known locations. Such tooling largely corresponds to the utility programs capable of overriding system and application controls in Annex A 8.18, and IT.PRO-07.2 is a specific way of restricting them. Annex A 8.18 is broader, requiring tight control over how and by whom these utilities are used, not only which tools are approved and where they run from.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-AC-ML1.3.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; E8-AC-ML1.3 restricts execution of executables, libraries, scripts, installers and similar file types to an organisation-approved set, which covers such tooling but not where it runs from.
This control partially overlaps E8-RA-ML3.2.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; E8-RA-ML3.2 requires Secure Admin Workstations to be used for administrative activities, so the two overlap on controlling where administration happens.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-0846.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; ISM-0846 stops users disabling, bypassing or being exempted from application control, except via local administrator or break glass accounts, keeping such restrictions in force.
This control partially overlaps ISM-1392.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; ISM-1392 requires that, where application control uses path rules, only approved users can modify approved files and write to approved folders, protecting those locations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.