Prevent installation of Evernote on Domain Systems

Question

Hi All,
I have came across an interesting thing, we have a Server 2012 R2 domain controller and all the client machines are joined to our domain, users only have Domain users privileges on the subjected systems.
With above privileges users can install Evernote application on their systems, while they cannot install any other application on their system. It has puzzled me that how come a Domain user can install application like this. Although we can apply App Block
policy to restrict this application but still I would like to prevent installation of Evernote without App block policy.
I need suggestions from the experts on this.
Thanks
Zulqarnain Ali | MCTS, MCSA | Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Answer 1

The only reliable way to achieve this is to implement an application whitelisting technology. Application whitelisting assumes a set of rules where systems administrator explicitly define software (by using various rule qualifiers) that is allowed
to run on computers. All software that is not listed there is permanently blocked.
Microsoft has one built-in technology that implements whitelisting -- Software Restriction Policies (SRP) and its successor -- Applocker.
More details:
https://technet.microsoft.com/en-us/library/hh831534.aspx
https://technet.microsoft.com/en-us/library/bb457006.aspx
https://technet.microsoft.com/en-us/library/hh994606.aspx
and blog post series from my weblog:
http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=84
http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=85
http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=86
http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=87
http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=88
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.