Prevent Users Disabling, Bypassing or Exempting Application Control
Application control is a security feature that only lets approved software run on a computer, blocking everything else. This control requires that ordinary users cannot turn off (disable), get around (bypass), or be excused from (be exempted from) application control. Only two narrow categories of account are allowed those abilities: local administrator accounts (the privileged accounts that manage a single computer) and break glass accounts (special emergency accounts kept locked away and used only when normal access is impossible). Everyone else, including standard staff, must be unable to weaken the protection in any way.
Plain language
Think of application control as a bouncer that only lets known, approved programs run on your computers. This control says regular staff are not allowed to send the bouncer home, sneak past them, or be put on a special "let me run anything" list. The only people who can override the bouncer are two kinds of trusted account: local administrator accounts, which exist to manage and fix individual machines, and break glass accounts, which are emergency accounts that stay sealed until something goes badly wrong and normal logins do not work. If everyday users could disable or bypass this protection, someone could trick them (or they could choose) to run harmful software, opening the door to malware and data theft.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Official control statement
All users, except for local administrator accounts and break glass accounts, cannot disable, bypass or be exempted from application control.
Why it matters
If standard users could disable, bypass or be exempted from application control, malicious or unapproved software could run freely, leading to malware infection and data breaches.
Operational notes
Keep local administrator and break glass accounts to a minimum, review who holds them regularly, log every override, and re-test that standard users still cannot weaken application control after updates.
Implementation tips
- IT administrators configure the application control product (for example Microsoft AppLocker or Windows Defender Application Control) so that its enforcement and policy settings can only be changed by local administrator accounts, and confirm standard user accounts have no rights to modify, stop or uninstall it.
- System owners create and tightly restrict a small number of break glass accounts for emergency use only, store their credentials in a sealed vault or safe, and document the exact circumstances under which they may be used to override application control.
- IT teams remove any blanket 'allow all' or per-user exemption rules from the application control policy so that no standard user can be individually excused from the rules; exemptions, where unavoidable, are tied to applications rather than to ordinary user accounts.
- Security staff harden the operating system so users cannot bypass application control through known tricks such as running code from writable folders, using script interpreters, or trusted built-in tools, and keep the product's blocklist updated to close these gaps.
- IT teams enable logging and alerting on every change to application control settings and on every use of a local administrator or break glass account, then route those alerts to the security team for prompt review.
Audit / evidence tips
- AskWhich account types are technically able to disable, bypass or exempt application control on standard workstations?Look atThe application control policy and the operating system permissions that govern who can change or stop itGoodOnly local administrator accounts and break glass accounts can do so; standard users have no such ability
- AskHow do you prevent standard users from being individually exempted from application control?Look atThe policy ruleset for per-user exemptions or 'allow all' entriesGoodNo per-user exemptions exist for ordinary accounts; any exemptions are application-based and justified
- AskHow are break glass accounts controlled and used?Look atThe break glass account register, vault storage records, and usage logGoodA small number of sealed emergency accounts exist, are stored securely, and every use is logged and reviewed
- AskHow do you stop users bypassing application control through writable folders, scripts or built-in tools?Look atThe operating system hardening configuration and the application control blocklistGoodCommon bypass paths are blocked and the configuration is reviewed and kept current
- AskHow do you know if someone tries to turn off or get around application control?Look atChange logs and security alerts for application control settings and privileged account useGoodChanges and attempts trigger alerts that are reviewed promptly, with evidence only administrators made authorised changes
Cross-framework mappings
How ISM-0846 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| Annex A 8.18 | Annex A 8.18 requires that utilities capable of overriding system and application controls are restricted and tightly controlled, which c... | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-AC-ML2.2 | E8-AC-ML2.2 requires application control coverage across locations (with defined exclusions for user profiles and temporary folders) | |
handshakeSupports(4)expand_less | ||
| E8-AC-ML1.1 | E8-AC-ML1.1 requires application control to be implemented on workstations | |
| E8-AC-ML1.2 | E8-AC-ML1.2 requires enforcement of application control within user profiles and temporary folders to prevent users and malware running c... | |
| E8-AC-ML1.3 | E8-AC-ML1.3 requires restricting execution to an organisation-approved set through application control | |
| E8-AH-ML2.8 | E8-AH-ML2.8 requires enforcement that prevents PDF software from creating child processes | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.