Device Control

Device control lets you see the USB and peripheral devices connected to your hosts and decide which are allowed. It is managed under Manage → Device & Application Control. Per-host devices also appear on the Devices tab of an endpoint.

Device inventory

The agent reports the peripherals it sees on each host — USB storage, input devices and other connected hardware — so you have an inventory of what is plugged in across the fleet.

Approve or block a device

For any reported device you can approve it (leave it usable) or block it. When you block a device, the agent enforces the block on the host by disabling the device:

• Linux — the agent revokes the device through USB authorization (the kernel's per-device authorization control), which de-authorizes the device so it cannot be used.

• Windows — the agent disables the device using Disable-PnpDevice, taking it offline at the OS level.

macOS: device inventory is reported, but on-host block enforcement is not available on macOS. Treat macOS device control as visibility only.

Notes

• Enforcement requires the agent to be running with elevated privileges (root on Linux, Admin on Windows). A per-user install cannot disable devices.

• Blocking a device disables it on the host; re-approving allows it to be used again.