A company uses an enterprise desktop imaging solution to manage deployment of its desktop computers. Desktop computer users are only permitted to use software that is part of the baseline image…

Network access control enforces device compliance before granting network access but does not restrict which applications can execute on the endpoint once it is connected.

Configuration Manager is a software deployment and patch management platform that can push software but does not inherently block unauthorized applications from being installed or run.

Application whitelisting maintains an explicit list of approved executables and blocks any application not on that list from running, regardless of how it arrived on the system. This directly enforces the business rule that users may only use software included in the standard desktop image. It is a default-deny execution control that stops unauthorized, unvetted, or malicious software from launching even if it is successfully installed.

File integrity checks detect unauthorized modifications to existing files after the fact but do not prevent new, unauthorized software from being installed or executed.