An IT department is struggling with 'configuration drift', where servers that were initially secure have gradually become vulnerable due to manual changes and the addition of unauthorized services. According to CIS Control 4 (Configuration Management), which also interacts with CIS Control 2, what is the best automated approach to ensure that only authorized software is running and systems remain in a known-good state?