Device Control
Last updated
Device control lets you see the USB and peripheral devices connected to your hosts and decide which are allowed. It is managed under Manage → Device & Application Control. Per-host devices also appear on the Devices tab of an endpoint.
The agent reports the peripherals it sees on each host — USB storage, input devices and other connected hardware — so you have an inventory of what is plugged in across the fleet.
For any reported device you can approve it (leave it usable) or block it. When you block a device, the agent enforces the block on the host by disabling the device:
Linux — the agent revokes the device through USB authorization (the kernel's per-device authorization control), which de-authorizes the device so it cannot be used.
Windows — the agent disables the device using Disable-PnpDevice, taking it offline at the OS level.
macOS: device inventory is reported, but on-host block enforcement is not available on macOS. Treat macOS device control as visibility only.
Enforcement requires the agent to be running with elevated privileges (root on Linux, Admin on Windows). A per-user install cannot disable devices.
Blocking a device disables it on the host; re-approving allows it to be used again.
Last updated