---
title: "Essential Eight user application hardening guide | CCP"
description: "What user application hardening is, what Maturity Level 1, 2 and 3 ask of browsers, Office, PDF software and PowerShell, and how to roll it out safely."
url: "https://ccp.com.au/essential-eight/user-application-hardening/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight user application hardening

## Switch off the features attackers use in everyday apps.

User application hardening switches off risky features in web browsers, Office and PDF software, and stops staff changing those settings back.

At a glance

Control

04 of 08 · Prevent attacks

Stops

Browser and document-based attacks

Typical tools

Intune, Microsoft Defender attack surface reduction rules

Effort

Medium

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What is user application hardening?

### Where it stops an attack.

1.  The attack A malicious web ad or document tries to launch another program or inject code.
3.  Stopped here Browsers block web ads and Java, and Office and PDF software can’t start other programs.
5.  The result The page or file has nothing to work with.

## Application hardening maturity levels

### What changes at each level.

What changes ML1 ML2 ML3

Web browsers No Java or web ads from the internetAdds ASD and vendor hardening guidance No change

Microsoft Office Not required Can’t start programs, create executables, inject code or run OLE packages. Hardened to guidance No change

PDF software Not required Can’t start programs. Hardened to guidance No change

Settings users can’t change Browser security settingsAdds Office and PDF settings No change

Legacy components Internet Explorer 11 off No change Adds .NET Framework 3.5 and PowerShell 2.0 off

PowerShell Not required Not required Constrained Language Mode

Logging Not required PowerShell and command-line events logged centrally. Internet-facing server logs analysedAdds analysis of workstation and internal server logs

Each level includes everything in the one before. A plain-English summary, not the requirement text. [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

[Check where you are with the free self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## How to harden browsers, Office and PDF software

### Protection first, disruption last.

1.  01

    #### Baseline your browsers

    One or two approved browsers, managed centrally, with ads and legacy plugins blocked.

2.  02

    #### Turn on attack surface reduction rules

    Microsoft Defender rules stop Office and PDF apps launching other programs. Audit first, then block.

3.  03

    #### Remove legacy components

    Internet Explorer 11, PowerShell 2.0 and old .NET Framework versions come out.

4.  04

    #### Lock and log

    Settings enforced by policy, with PowerShell and process events sent to a central log.

[Related service: Cyber security services](https://ccp.com.au/services/cybersecurity/)

## Common application hardening mistakes

### Where rollouts go wrong.

-   #### Unmanaged browsers

    A browser staff installed themselves ignores every setting.

-   #### Untested ASR rules

    Some rules affect add-ins and line-of-business tools. Audit mode first.

-   #### Forgetting PDF software

    Office locked down, an old PDF reader left wide open.

## Application hardening questions

### What clients ask before we start.

### What are attack surface reduction (ASR) rules?

Microsoft Defender settings that block risky behaviour, such as Office starting other programs or running obfuscated scripts. Several map directly to Maturity Level 2.

### Do we still need to remove Internet Explorer?

Yes. It’s unsupported, but its components remain on many Windows systems. Maturity Level 1 requires it to be disabled or removed.

### Will hardening affect our line-of-business software?

Occasionally. That’s why we test in audit mode and make narrow exceptions rather than weaken settings for everyone.