What is the MOST effective way to detect installation of unauthorized software packages by employees?

Communicating policy is a preventative measure that relies on employee compliance but does not actively detect unauthorized installations if an employee chooses to disregard the policy.

Regular scanning of hard drives, often through asset management or endpoint detection and response (EDR) tools, directly identifies installed software packages. This allows for comparison against an approved software list and flags any unauthorized installations, providing tangible evidence of policy violations.

Logging network activity might indicate use of unauthorized software if it communicates externally, but it doesn't directly detect the installation of standalone unauthorized applications or those used internally without network communication.

Maintaining current antivirus software primarily focuses on detecting and preventing malware, not necessarily identifying legitimate but unauthorized applications installed by users.