{"id":3351,"date":"2026-08-13T04:09:27","date_gmt":"2026-08-13T04:09:27","guid":{"rendered":"https:\/\/zecurit.com\/help\/?post_type=docs&p=3351"},"modified":"2026-08-13T07:48:18","modified_gmt":"2026-08-13T07:48:18","slug":"creating-a-windows-policy","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/device-access-control\/creating-a-windows-policy\/","title":{"rendered":"Creating a Windows Policy"},"content":{"rendered":"\n

A Device Access Control policy is what actually enforces peripheral restrictions on real devices. It sets an action Allow, Block, or Not Configured for each USB and peripheral device type, and applies that setting to every endpoint the profile is assigned to.<\/p>\n\n\n\n

What is a Device Access Control Policy?<\/h2>\n\n\n\n

A Device Access Control policy is a profile setting that governs which USB and peripheral device types can be used on managed endpoints. Each device type such as Removable Storage Devices or Bluetooth Adapters is set to Allow, Block, or Not Configured. The same profile can combine strict settings for high-risk devices with permissive settings for everyday peripherals like mice and keyboards.<\/p>\n\n\n\n

The same device type can be treated differently across profiles. For example, one profile could block Removable Storage Devices organization-wide, while a separate, narrower profile allows it only for a specific IT support group.<\/p>\n\n\n\n

Create Policy<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
    \n
  1. Log in to the Zecurit portal<\/strong>.<\/li>\n\n\n\n
  2. Go to Endpoint Manager \u2192 Manage \u2192 Profiles<\/strong>. <\/li>\n\n\n\n
  3. Click Create Profile<\/strong>. <\/li>\n\n\n\n
  4. Select Device Access Control<\/strong> from the configuration list.<\/li>\n\n\n\n
  5. Configure an action (Allow, Block, or Not Configured<\/strong>) for each device type under High Risk Devices<\/strong>, Network & Communication<\/strong>, and Standard Peripherals<\/strong>. <\/li>\n\n\n\n
  6. Click Save<\/strong>, then click Publish<\/strong> to activate the profile. Or click Save as Draft<\/strong> to finish it later.<\/li>\n<\/ol>\n\n\n\n

    At least one device type must be set to Allow or Block for the policy to take effect. Device types left on Not Configured are not enforced by this profile.<\/p>\n\n\n\n

    Policy Details<\/h2>\n\n\n\n
    Field<\/strong><\/th>Required<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
    Profile Name<\/td>Yes<\/td>A descriptive name for the profile (e.g., “Standard Endpoint Security”). Shown in Inventory to identify which profile is applied to a device.<\/td><\/tr>
    Device Type Actions<\/td>Yes<\/td>The Allow \/ Block \/ Not Configured setting chosen for each device type listed under the profile’s categories.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    A single profile can set Block on some device types and Allow on others. There is no requirement to apply the same action across an entire category.<\/p>\n\n\n\n

    Device Categories and Actions<\/h2>\n\n\n\n

    Each device type uses one of three actions:<\/strong><\/p>\n\n\n\n

    Action<\/strong><\/th>Effect<\/strong><\/th>Best For<\/strong><\/th><\/tr><\/thead>
    Allow<\/td>The device is permitted and functions normally.<\/td>Everyday peripherals required for business use, such as mice, keyboards, and printers.<\/td><\/tr>
    Block<\/td>The device is denied; Windows prevents it from installing or being used.<\/td>High-risk device types where there is no legitimate business need, such as removable storage or optical media.<\/td><\/tr>
    Not Configured<\/td>No rule is applied by this profile; the device follows local settings or another assigned profile.<\/td>Device types intentionally left to a different, more specific profile or to local policy.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Device types are grouped into three categories to make large policies easier to review:<\/strong><\/p>\n\n\n\n

    Category<\/strong><\/th>Includes<\/strong><\/th><\/tr><\/thead>
    High Risk Devices<\/td>Removable Storage Devices, CD ROM, Windows Portal Devices, TapeDrivers, Apple Devices, Imaging Devices, Floppy Disks<\/td><\/tr>
    Network & Communication<\/td>Wireless Adapters, Bluetooth Adapters, Modems, Infrared Devices<\/td><\/tr>
    Standard Peripherals<\/td>Mice, Keyboards, Printers, Biometric Devices, Smart Card Readers, Serial Ports, Parallel Ports<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    A typical rollout pattern is to leave a new device type on Not Configured while confirming which endpoints actually use it, then move to Block once you’ve confirmed it has no legitimate business use in your environment.<\/p>\n\n\n\n

    Publishing vs. Saving as Draft<\/h2>\n\n\n\n
    Option<\/strong><\/th>Effect<\/strong><\/th><\/tr><\/thead>

    Save<\/td>    		Saves the profile configuration. You can publish it later.<\/td><\/tr>
    Publish<\/td>Activates the policy immediately; enforcement begins on all endpoints the profile is assigned to.<\/td><\/tr>
    Save as Draft<\/td>Stores the profile configuration without activating it, so it can be reviewed or completed later.<\/td><\/tr>
    Cancel<\/td>Discards changes and exits without saving.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Example Policies<\/h2>\n\n\n\n
    Profile Name<\/strong><\/th>Category Focus<\/strong><\/th>Action<\/strong><\/th>Notes<\/strong><\/th><\/tr><\/thead>
    Standard Endpoint Security<\/td>High Risk Devices<\/td>Block<\/td>Applied to all corporate laptops and desktops.<\/td><\/tr>
    Kiosk Lockdown<\/td>High Risk + Network & Communication<\/td>Block<\/td>Applied to shared\/kiosk device group only.<\/td><\/tr>
    IT Support Exception<\/td>High Risk Devices<\/td>Allow<\/td>Scoped to the IT support device group only.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Best Practices<\/h2>\n\n\n\n
      \n
    • Name profiles clearly enough that they’re identifiable later in Inventory without opening them.<\/li>\n\n\n\n
    • Set high-risk device types (removable storage, optical media, portable devices) to Block by default.<\/li>\n\n\n\n
    • Keep everyday peripherals mice, keyboards, printers, biometric devices on Allow.<\/li>\n\n\n\n
    • Use a separate, narrowly scoped profile for exceptions rather than loosening the base policy.<\/li>\n\n\n\n
    • Review published profiles periodically, since device usage and risk levels change over time.<\/li>\n<\/ul>\n\n\n\n

      Troubleshooting Tips<\/h2>\n\n\n\n
      Issue<\/strong><\/th>Resolution<\/strong><\/th><\/tr><\/thead>
      Publish button is disabled<\/td>Confirm a Profile Name is entered and at least one device type has an action set.<\/td><\/tr>
      Device blocked unexpectedly<\/td>Check whether another assigned profile also sets a policy for that device type; Block generally takes precedence over Allow.<\/td><\/tr>
      User reports device still works after Block<\/td>Confirm the profile was Published, not left as a draft, and that the device has synced with the endpoint.<\/td><\/tr>
      Draft profile not enforcing<\/td>Draft profiles are inactive by design; open the profile and click Publish to activate it.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      <\/h1>\n","protected":false},"featured_media":0,"parent":3334,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"_is_vendor_doc":"0","footnotes":""},"doc_tag":[],"class_list":["post-3351","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3351"}],"version-history":[{"count":17,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3351\/revisions"}],"predecessor-version":[{"id":3424,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3351\/revisions\/3424"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3334"}],"next":[{"title":"Creating a Linux Policy","link":"https:\/\/zecurit.com\/help\/endpoint-management\/device-access-control\/creating-a-linux-policy\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3383"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3351"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}