Block/Blacklist software installation using SCCM

Question

Block/Blacklist software installation using SCCM

Answer 1

Hi,

Thank you for posting in Microsoft Q&A forum.

1,If you are also using Microsoft Defender for Endpoint, we can enable the option "Block Potentially Unwanted Applications at download and prior to installation" in Real-time Protection Settings to detect and block potentially unwanted applications there. For more detailed information, please refer to:

How to create and deploy antimalware policies for Endpoint Protection in Configuration Manager

Detect and block potentially unwanted applications

2,Per my experience, for SCCM itself, there is no built-in method to block or blacklist software installation function. How to achieve them depends on your real requirement, what the purpose of these lists are.

a,If we want the softwares in the blacklist to be removed autocratically, just deploy them with "Uninstall" for Action and "Required" for Purpose.

b,If we just want to get the non-compliant computers which have installed software in the blacklist, we could use the built-in reports to get them. Or we could use compliance baseline to detect, computers which have install unwanted software would be shown as non-compliant and we could get them by checking deployment status or reports or custom query.

Hope my answer could help you and look forward to your feedback. Thanks for your time. Have a nice day!

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

This is not a feature of ConfigMgr. You will need to look at other products to do this.