Application Control Policy Not Working

Thank you for reaching out to the community forum.

Can you confirm if the policy was received when you pushed it to the endpoint? For the sake of your testing, perform a manual update on the endpoint by pressing "Update now" and waiting until it succeeds. After that, open the "Endpoint Self Help tool" and go to the policy tab. Check the time stamp and see if the endpoint received a policy update.

It should show on the timings when the last endpoint gets an update from Central indicating that the policy you've pushed has been received on the device. 

In addition to what Glenn mentioned regarding policy compliance, I'd like to inquire if you are trying to block ALL Proxy/VPN tools or only "Windscribe" as selected. 

The current configuration will only block the apps you've selected. Choosing the "Allow" option will instead only allow the selected apps and block all others. 

If Windescribe continues to run unblocked, I'd suggest sending in an application control request with the version of the app you are currently running, as this may mean our catalogue needs to be updated. 
See: support.sophos.com/.../filesubmission

Hi Qoosh,

I've tried both - blocking just Windscribe, and running that app alone for it to still work, and checking every item in that 'Proxy / VPN Tool' menu. In either case with the settings as above, neither appears to have any affect on the Windows 11 client.

I'll create a new policy to Allow only the intended app we use, and see if Windscribe is now blocked. Interestingly I've tried and seen the same with OpenVPN Connect, so if it still doesn't work then there could be a number of items inthe application catalogue that need updating.

Neither a Block or Allow Policy of any configuration seemed to have any affect on the clients I was testing with. Will log with Sophos.

Do you have any real-time scanning exclusions that could exempt the files? 

I don't believe so. It's not clear (to me, at least) how the Application Control policies operate, but there are no specific exclusions etc. for the apps we want to block. Any VPN software on the device seems to work no matter how I attempt to block it.

The realtime scanning exclusions apply to app control. Maybe check the global exclusions and in the threat protection policy applied to the endpoint  to see if maybe the paths of files are excluded there. 

Hello,

Could you please confirm the core agent version of the endpoint, also could you please share if this is happening on 1-2 machines or all machines?

Hi, This is now resolved. Sophos have claimed that their inventory was out of date, and so after providing them with the latest exe's they have updated their definition list and assured me the issue has been resolved.

That's great, happy to hear that the issue is resolved.