Shadowing Related Training & Support Archives

Several ControlUp community members discussed the challenge of identifying software manually installed by local administrators on developer laptops and other endpoints. This issue often complicates software inventory management and security auditing, as organizations need to distinguish between authorized baseline applications and additional, manually installed programs. The core difficulty arises from the fact that ControlUp’s data collection primarily tracks which applications are installed via its installed_apps index, but does not inherently record the installer’s identity or differentiate between default baseline software and manual admin installs. Without this attribution, it becomes tricky to pinpoint deviations from standard configurations. One suggested approach is to define a list of default or approved baseline applications and then use queries to highlight deviations from that list, effectively flagging manually installed or unauthorized software. A community member also recommended leveraging existing ControlUp content, specifically the Shadow IT prompt found in the prompt library under the security category. This prompt is designed to assist in identifying applications outside the known or approved inventory, which aligns well with the problem of detecting non-baseline, admin-installed software. Experimenting with this prompt, in combination with custom baseline definitions, provides a practical investigation method using the ControlUp platform’s Canvas feature and alerting capabilities. Overall, addressing this use case requires a combination of custom baseline software lists, regular monitoring via the installed_apps index, and making use of security-focused prompts like Shadow IT. While ControlUp does not automatically track the installer identity, these strategies enable administrators to gain better visibility into manual software installations and maintain tighter control over endpoint configurations.

Read the entire article here...

---