{"id":3130,"date":"2026-02-20T08:49:10","date_gmt":"2026-02-20T08:49:10","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/configuration\/create-configuration-profile\/"},"modified":"2026-02-20T08:55:06","modified_gmt":"2026-02-20T08:55:06","slug":"create-configuration-profile","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/configuration\/create-configuration-profile\/","title":{"rendered":"Create a Configuration Profile"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p>The <strong>Create Profile<\/strong> workflow lets IT administrators define a new configuration policy for any supported endpoint type. Profiles are modular, each profile is built around a single policy type (e.g., Firewall, BitLocker, Device Control), giving you precise, targeted control without bundling unrelated settings.<\/p>\n\n\n\n<p><strong>Typical Use Cases:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforce BitLocker encryption on all company laptops before they leave the office.<\/li>\n\n\n\n<li>Block USB storage devices on endpoints in the finance department.<\/li>\n\n\n\n<li>Push a standardized Windows Update maintenance window across all workstations.<\/li>\n\n\n\n<li>Deploy a PowerShell script to disable legacy protocols on new machines.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step-by-Step: Creating a Configuration Profile<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1 : Navigate to Create Profile<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Log in to the <strong>Zecurit console<\/strong> at app.zecurit.com.<\/li>\n\n\n\n<li>In the left sidebar, click <strong>Manage<\/strong>.<\/li>\n\n\n\n<li>Under <strong>Configurations<\/strong>, click <strong>Create Profile<\/strong>.<\/li>\n\n\n\n<li>The Profile Creation screen will open, displaying all available profile types.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 : Select the Target Platform<\/h3>\n\n\n\n<p>At the top of the Profile Creation page, select the operating system platform for which you are creating the profile:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Windows<\/strong> \u2013 For Windows 10, Windows 11, and Windows Server endpoints.<\/li>\n\n\n\n<li><strong>MAC<\/strong> \u2013 For macOS devices managed by Zecurit.<\/li>\n\n\n\n<li><strong>Linux<\/strong> \u2013 For Linux distributions enrolled in your Zecurit console.<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Note:<\/strong> Some profile types (e.g., BitLocker, Windows Update Policy) are available only on Windows. Platform-specific options will display based on your selection.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3 : Select the Profile Type<\/h3>\n\n\n\n<p>Click on the tile corresponding to the type of configuration you want to create. The available profile types for Windows are:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Profile Type<\/th><th>Purpose<\/th><\/tr><\/thead><tbody><tr><td>BitLocker<\/td><td>Enforce disk encryption on endpoints<\/td><\/tr><tr><td>Device Control<\/td><td>Manage USB, Bluetooth, and peripheral access<\/td><\/tr><tr><td>Application Control<\/td><td>Allow or block specific applications<\/td><\/tr><tr><td>Power Management<\/td><td>Define power and sleep schedules<\/td><\/tr><tr><td>Deploy Script<\/td><td>Execute scripts on managed endpoints<\/td><\/tr><tr><td>Deploy Software<\/td><td>Automate software deployment<\/td><\/tr><tr><td>Firewall<\/td><td>Configure and enforce firewall rules<\/td><\/tr><tr><td>User Management<\/td><td>Manage local users and groups<\/td><\/tr><tr><td>Windows Update Policy<\/td><td>Control Windows Update behavior<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4 : Configure Profile Settings<\/h3>\n\n\n\n<p>After selecting a profile type, you will be taken to the configuration form for that policy. Fill in the required settings. Each profile type has its own configuration fields. For example:<\/p>\n\n\n\n<p><strong>Example: Creating a Firewall Profile<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Enter a <strong>Profile Name<\/strong> (e.g., &#8220;Corp-Firewall-Policy-v1&#8221;).<\/li>\n\n\n\n<li>Set the <strong>Firewall State<\/strong> to Enabled.<\/li>\n\n\n\n<li>Add <strong>Inbound Rules<\/strong> \u2013 specify allowed ports, protocols, and source IP ranges.<\/li>\n\n\n\n<li>Add <strong>Outbound Rules<\/strong> \u2013 define permitted outbound traffic.<\/li>\n\n\n\n<li>Set the action for unmatched traffic (Block or Allow).<\/li>\n\n\n\n<li>Add a description for internal documentation purposes.<\/li>\n<\/ol>\n\n\n\n<p><strong>Example: Creating a BitLocker Profile<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Enter a <strong>Profile Name<\/strong> (e.g., &#8220;Finance-BitLocker-Enforcement&#8221;).<\/li>\n\n\n\n<li>Select encryption method (e.g., AES 256-bit).<\/li>\n\n\n\n<li>Define the recovery key storage option (Active Directory, local, or Zecurit escrow).<\/li>\n\n\n\n<li>Set startup authentication requirements (PIN, USB key, or TPM-only).<\/li>\n\n\n\n<li>Configure encryption scope (OS drive, fixed drives, removable drives).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5 : Save as Draft or Publish<\/h3>\n\n\n\n<p>Once your configuration settings are complete, you have two options:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Save as Draft<\/strong> \u2013 Saves the profile without distributing it. Use this when the profile is still being reviewed or requires approval before deployment. Draft profiles appear in the Profiles list with a &#8220;Draft&#8221; status badge.<\/li>\n\n\n\n<li><strong>Publish<\/strong> \u2013 Finalizes and makes the profile available for distribution to devices or groups. Published profiles are versioned, and each subsequent edit creates a new version number.<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Best Practice:<\/strong> Always save as Draft first and have a second administrator review the profile before publishing, especially for security-critical policies like Firewall or BitLocker.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6 : Verify in the Profiles List<\/h3>\n\n\n\n<p>After saving:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>Manage \u2192 Configurations \u2192 Profiles<\/strong>.<\/li>\n\n\n\n<li>Locate your newly created profile in the list.<\/li>\n\n\n\n<li>Verify the <strong>Platform<\/strong>, <strong>Version<\/strong>, <strong>Profile Status<\/strong> (Draft or Published), and <strong>Created Time<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Profile Versioning<\/h2>\n\n\n\n<p>Every time you edit and republish a profile, Zecurit increments the <strong>version number<\/strong>. The version number is visible in both the Profiles list and within individual device profile association details. This allows you to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Track the history of changes to a profile.<\/li>\n\n\n\n<li>Confirm which version of a profile is currently active on a given device.<\/li>\n\n\n\n<li>Roll back by republishing an older profile configuration if needed.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Use Case Examples<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Use Case 1 : New Employee Onboarding Security Baseline<\/h3>\n\n\n\n<p><strong>Scenario:<\/strong> A company wants to ensure all new Windows laptops are configured with encryption, USB restrictions, and a hardened firewall before the device reaches the employee&#8217;s desk.<\/p>\n\n\n\n<p><strong>Steps:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a <strong>BitLocker<\/strong> profile named &#8220;Onboarding-BitLocker&#8221; to enforce AES-256 encryption.<\/li>\n\n\n\n<li>Create a <strong>Device Control<\/strong> profile named &#8220;Onboarding-USB-Block&#8221; to block all removable storage.<\/li>\n\n\n\n<li>Create a <strong>Firewall<\/strong> profile named &#8220;Onboarding-Firewall&#8221; with only required ports open.<\/li>\n\n\n\n<li>Publish all three profiles.<\/li>\n\n\n\n<li>Associate all three profiles to the &#8220;New Devices&#8221; group (see the Association guide below).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Use Case 2 : Department-Specific Application Policy<\/h3>\n\n\n\n<p><strong>Scenario:<\/strong> The finance team should only be allowed to run approved financial software. All other applications should be blocked.<\/p>\n\n\n\n<p><strong>Steps:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create an <strong>Application Control<\/strong> profile named &#8220;Finance-AppControl&#8221;.<\/li>\n\n\n\n<li>Add whitelisted applications: Microsoft Excel, SAP Client, approved finance tools.<\/li>\n\n\n\n<li>Set the default action to &#8220;Block Unlisted Applications.&#8221;<\/li>\n\n\n\n<li>Publish the profile and associate it with the &#8220;Finance&#8221; device group.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Use Case 3 : Scheduled Script Execution for Compliance Audit<\/h3>\n\n\n\n<p><strong>Scenario:<\/strong> IT needs to run a PowerShell script every Monday morning to collect compliance data from all endpoints.<\/p>\n\n\n\n<p><strong>Steps:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a <strong>Deploy Script<\/strong> profile named &#8220;Weekly-Compliance-Audit&#8221;.<\/li>\n\n\n\n<li>Upload the PowerShell (.ps1) script.<\/li>\n\n\n\n<li>Set the execution schedule to &#8220;Weekly \u2013 Monday \u2013 8:00 AM.&#8221;<\/li>\n\n\n\n<li>Publish and associate with the &#8220;All Windows Devices&#8221; group.<\/li>\n<\/ol>\n\n\n\n<p><\/p>\n","protected":false},"featured_media":0,"parent":3016,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-3130","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3130"}],"version-history":[{"count":1,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3130\/revisions"}],"predecessor-version":[{"id":3132,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3130\/revisions\/3132"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3016"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3130"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}