Several ControlUp community members discussed the challenge of identifying software manually installed by local administrators on developer laptops and other endpoints. This issue often complicates software inventory management and security auditing, as organizations need to distinguish between authorized baseline applications and additional, manually installed programs.
The core difficulty arises from the fact that ControlUp’s data collection primarily tracks which applications are installed via its installed_apps index, but does not inherently record the installer’s identity or differentiate between default baseline software and manual admin installs. Without this attribution, it becomes tricky to pinpoint deviations from standard configurations. One suggested approach is to define a list of default or approved baseline applications and then use queries to highlight deviations from that list, effectively flagging manually installed or unauthorized software.
A community member also recommended leveraging existing ControlUp content, specifically the Shadow IT prompt found in the prompt library under the security category. This prompt is designed to assist in identifying applications outside the known or approved inventory, which aligns well with the problem of detecting non-baseline, admin-installed software. Experimenting with this prompt, in combination with custom baseline definitions, provides a practical investigation method using the ControlUp platform’s Canvas feature and alerting capabilities.
Overall, addressing this use case requires a combination of custom baseline software lists, regular monitoring via the installed_apps index, and making use of security-focused prompts like Shadow IT. While ControlUp does not automatically track the installer identity, these strategies enable administrators to gain better visibility into manual software installations and maintain tighter control over endpoint configurations.
Read the entire ‘Managing Manual Software Installs on Developer Laptops Using ControlUp’s Installed Apps Index and Shadow IT Prompt’ thread below:
Developer laptops and admin installs of software
We have multiple customers who are struggling to get grip on which software is being manually installed by local admins. I think this could be a great addition for the prompt library and ideal way to investigate with Canvas! I have been experimenting with this query, but not yet satisfied with the overall result. Any ideas are welcome, was thinking about giving the AI a list of default apps and report on deviations.
Ahh that’s really good usecase. But might require indeed you to give a list what is installed by default I don’t think we fully record who installs the app you can check the installed_apps index!
you could also try the shadow it prompt from the prompt library its under security
ah nice thanks! gonna experiment further with it.
Continue reading and comment on the thread ‘Managing Manual Software Installs on Developer Laptops Using ControlUp’s Installed Apps Index and Shadow IT Prompt’. Not a member? Join Here!
Categories: All Archives, ControlUp Scripts & Triggers