Application Control Policy Not Working

In addition to what Glenn mentioned regarding policy compliance, I'd like to inquire if you are trying to block ALL Proxy/VPN tools or only "Windscribe" as selected. 

The current configuration will only block the apps you've selected. Choosing the "Allow" option will instead only allow the selected apps and block all others. 

If Windescribe continues to run unblocked, I'd suggest sending in an application control request with the version of the app you are currently running, as this may mean our catalogue needs to be updated. 
See: support.sophos.com/.../filesubmission

Hi Qoosh,

I've tried both - blocking just Windscribe, and running that app alone for it to still work, and checking every item in that 'Proxy / VPN Tool' menu. In either case with the settings as above, neither appears to have any affect on the Windows 11 client.

I'll create a new policy to Allow only the intended app we use, and see if Windscribe is now blocked. Interestingly I've tried and seen the same with OpenVPN Connect, so if it still doesn't work then there could be a number of items inthe application catalogue that need updating.

Neither a Block or Allow Policy of any configuration seemed to have any affect on the clients I was testing with. Will log with Sophos.

Neither a Block or Allow Policy of any configuration seemed to have any affect on the clients I was testing with. Will log with Sophos.

Do you have any real-time scanning exclusions that could exempt the files? 

I don't believe so. It's not clear (to me, at least) how the Application Control policies operate, but there are no specific exclusions etc. for the apps we want to block. Any VPN software on the device seems to work no matter how I attempt to block it.

The realtime scanning exclusions apply to app control. Maybe check the global exclusions and in the threat protection policy applied to the endpoint  to see if maybe the paths of files are excluded there.