How to configure application blacklists and whitelists - Elastic Desktop Service

You may need to block certain applications on cloud computers or allow only specific applications to run. Software control lets you configure blacklists and whitelists for this purpose.

Background information

Control rules

Software control identifies software by the following attributes:

Process name: Identifies the software.
Hash value: Identifies a specific version of the software.
Signature: Identifies the software's publisher.

Control rule	Blacklist	Whitelist
Match name and hash or signature	The software is blocked if its process name matches the one you provide, and its hash value or signature also matches.	The software is allowed if its process name matches the one you provide, and its hash value or signature also matches.
Match name or hash or signature	The software is blocked if its process name, hash value, or signature matches any of the values you provide.	The software is allowed if its process name, hash value, or signature matches any of the values you provide.

Important

Software provided by Alibaba Cloud and Microsoft, as well as software related to the Wuying Cloud Computer service, are allowed by default and cannot be blocked. Do not add these software to a blacklist.

Example scenarios

Scenario	Control rule	Match type	Required software attributes
Block all software from a specific publisher.	Blacklist	Match name or hash or signature	Signature: Enter the publisher's certificate information.
Block a specific software from a publisher.	Blacklist	Match name and hash or signature	Signature: Enter the publisher's certificate information. Process name: Enter the software's process name. Note To block multiple versions, add a separate entry for each version's hash value to the rule.
Block a specific version of software.	Blacklist	Match name or hash or signature	Hash: Enter the software's hash value.

Prerequisites

Software control requires:

The cloud computer image uses one of the following operating systems: Windows Server 2025, Windows Server 2022, Windows Server 2019, or Windows 11.
The cloud computer image version is 3.1.0 or later. To upgrade, restart the cloud computer.
The Wuying App Center version on the cloud computer must be 2.1.8 or later.

Step 1: Create a control rule

Log on to the EDS enterprise console.
In the left-side navigation pane, choose Security Center > App Control.
On the Software Blacklist/Whitelist page, click Create Control Rule.

In the Create Control Rule panel, configure the basic information for the rule.

Parameter	Description	Example
Rule name	A custom name for the rule. Up to 40 characters.	Disabled App List
Rule type	Whether to block or allow the identified software. Valid values: Whitelist Blacklist	Blacklist
Sub-process automatic inheritance policy	This feature is disabled by default. If enabled, first-level child processes inherit the parent's whitelist policy, even if only the parent process is explicitly added to the rule. Note This policy is available only for whitelist rules. This feature requires image version 2.10.0 or later. For more information, see Update an image.
Control rule	Defines how software attributes are matched for identification. Valid values: Match name and hash or signature Match name or hash or signature	Match name and hash or signature
Software list	The software to control.	AppName1, AppName2

(Optional) Use the provided tool to extract software attributes for the next step.
1. In the Software List section of the Create Control Rule panel, click Click to download to download the software attribute extraction tool. This tool is supported only on Windows.
2. Open the tool, click Browse in the upper-right corner, and select the directory containing the target software's executable.
3. Click Start Scanning in the lower-right corner.
4. In the scan results, click Copy next to Name (process name) and Hash (hash value) to copy their values.
  The scan results also display the software's Signature. You can use the Copy button to copy the signature.

In the Create Control Rule panel, click Create Application. In the Create Application dialog box, enter the software attributes and click OK.

Parameter	Description	Example
Software name	A custom name to identify the software. Up to 40 characters.	AppName
Process name	The process name of the software, from the software attribute extraction tool. Must end with `.exe` and be no longer than 50 characters.	appname.exe
Hash	The MD5 hash value of the software, from the extraction tool. Must be 40 characters or less.	8d6a08df5973e54a34695fd7aab5****
Signature	The signature of the software, from the extraction tool. Must be 80 characters or less.	SampleSignature

Important

After configuring the rule, click OK.

Step 2: Bind the rule to cloud computers

For a control rule to take effect, you must bind it to one or more cloud computers.

In the left-side navigation pane, choose Security Center > App Control.
On the Software Blacklist/Whitelist page, find the target rule and click Associated Resources in the Actions column.
In the Bind Cloud Computers panel, select one or more cloud computers to bind to the rule, and then click OK.

Next steps

Manage control rules

The control rules you create are displayed on the Software Blacklist/Whitelist page. You can manage rules in the following ways:

To edit a rule, click Modify in the Actions column for the target rule. In the Modify Rule panel, modify the settings and click OK.
To delete a rule, click Delete in the Actions column for the target rule, and then click OK in the confirmation dialog box.
To clone a rule, click Clone Rule in the Actions column for the target rule. In the Clone Rule dialog box, enter a Rule Name and click OK.
Note
Bound cloud computers are not included in the clone. Only the rule type, control rule logic, and software list are cloned.
To export a rule:
1. Click Modify in the Actions column for the target rule. In the Software List section of the Modify Rule panel, filter for and select the target software, and then click the export icon .
2. In the Export Software Control Rule Data dialog box, select the rules to export and click OK. In the pop-up notification, click View Export Records.
  Note
  If the pop-up window disappears, click the export history icon in the right-side panel of the console to view your export history and download files.
3. In the Export Records panel, wait for the Status to change to Export Succeeded, and then click Download in the Actions column.

View software blocking logs

View logs of software blocked by bound cloud computers.

In the left-side navigation pane, choose Security Center > App Control.
On the Software Blacklist/Whitelist page, click the Software Block Records tab.
On the Software Block Records page, view records including the software name, blocking time, and associated cloud computer.

FAQ

Do rules take effect immediately after binding?

Yes. After a rule is bound to a cloud computer, it is deployed immediately. Even applications that are already running will be terminated if they are on the blacklist.

Do updated group rules apply immediately?

Yes. When a control rule for a resource group is updated, the changes take effect immediately on all cloud computers within that group.