A Device Access Control policy controls access to USB and peripheral devices. For each device type, you can set the action to Allow, Block, or Not Configured. The selected settings are applied to all enrolled endpoints assigned to the profile.
What is a Device Access Control Policy?
A Device Access Control policy controls which USB and peripheral devices can be used on managed endpoints. Each device type, such as USB Storage Devices or Bluetooth Adapters, can be set to Allow, Block, or Not Configured. This lets you apply stricter controls to high-risk devices while allowing everyday peripherals, such as mice and keyboards.
The same device type can have different settings in different profiles. For example, one profile can Block USB Storage Devices for most users, while another profile can Allow them for a specific IT support group.
Create Policy
- Log in to the Zecurit portal.
- Go to Endpoint Manager → Manage → Profiles.
- Click Create Profile, then select Linux as the platform.
- Select Device Access Control from the configuration list.
- Set an action, such as Allow, Block, or Not Configured, for each device type under High Risk Devices, Network & Communication, and Standard Peripherals.
- Click Publish to activate the profile immediately, or Save as Draft to complete it later.
At least one device type must be set to Allow or Block for the profile to take effect. Device types set to Not Configured are not enforced by the profile.
Policy Details
| Field | Required | Description |
|---|---|---|
| Profile Name | Yes | A descriptive name for the profile (e.g., “Standard Linux Endpoint Security”). Shown in Inventory to identify which profile is applied to a device. |
| Platform | Yes | Must be set to Linux. Device categories and available actions are the same across platforms, but a profile only applies to endpoints matching its selected platform. |
| Device Type Actions | Yes | The Allow / Block / Not Configured setting chosen for each device type listed under the profile’s categories. |
A single profile can set Block on some device types and Allow on others. There is no requirement to apply the same action across an entire category.
Device Categories and Actions
Each device type uses one of three actions:
| Action | Effect | Best For |
|---|---|---|
| Allow | The device is permitted and functions normally. | Everyday peripherals required for business use, such as mice, keyboards, and printers. |
| Block | The device is denied; the endpoint prevents it from mounting or being used. | High-risk device types where there is no legitimate business need, such as USB storage or optical media. |
| Not Configured | No rule is applied by this profile; the device follows local settings or another assigned profile. | Device types intentionally left to a different, more specific profile or to local policy. |
Device types are grouped into three categories to make large policies easier to review:
| Category | Includes |
|---|---|
| High Risk Devices | USB Storage Devices, CD/DVD Drives, External Hard Drives, Mobile Devices (MTP/PTP), Imaging Devices |
| Network & Communication | Wireless Adapters, Bluetooth Adapters, Modems |
| Standard Peripherals | Mice, Keyboards, Printers, Smart Card Readers, Serial Ports |
A typical rollout pattern is to leave a new device type on Not Configured while confirming which endpoints actually use it, then move to Block once you’ve confirmed it has no legitimate business use in your environment.
Publishing vs. Saving as Draft
| Option | Effect |
|---|---|
| Publish | Activates the policy immediately; enforcement begins on all Linux endpoints the profile is assigned to. |
| Save as Draft | Stores the profile configuration without activating it, so it can be reviewed or completed later. |
| Cancel | Discards changes and exits without saving. |
Example Policies
| Profile Name | Category Focus | Action | Notes |
|---|---|---|---|
| Standard Linux Endpoint Security | High Risk Devices | Block | Applied to all Linux workstations and servers. |
| Linux Kiosk Lockdown | High Risk + Network & Communication | Block | Applied to shared/kiosk Linux device group only. |
| IT Support Exception | High Risk Devices | Allow | Scoped to the Linux IT support device group only. |
Best Practices
- Name profiles clearly enough that they’re identifiable later in Inventory without opening them.
- Set high-risk device types (USB storage, optical media, external drives) to Block by default.
- Keep everyday peripherals mice, keyboards, printers on Allow.
- Use a separate, narrowly scoped profile for exceptions rather than loosening the base policy.
- Review published profiles periodically, since device usage and risk levels change over time.
Troubleshooting Tips
| Issue | Resolution |
|---|---|
| Publish button is disabled | Confirm a Profile Name is entered, Platform is set to Linux, and at least one device type has an action set. |
| Device blocked unexpectedly | Check whether another assigned profile also sets a policy for that device type; Block generally takes precedence over Allow. |
| User reports device still works after Block | Confirm the profile was Published, not left as a draft, and that the device has synced with the endpoint. |
| Draft profile not enforcing | Draft profiles are inactive by design; open the profile and click Publish to activate it. |
| Policy created for Linux not applying to a device | Confirm the target device’s platform is Linux; a profile only applies to endpoints matching its selected platform. |