Every endpoint lets in only what you approved.
Choose which devices connect, which applications run and what browsers and cloud storage allow. When someone needs an exception, they ask from the block itself, and the answer expires on its own.
One agent for devices, applications and browsers.
Each control is written once in the console and applied by the same Tracemark agent. Every decision it makes on the device is recorded.
Device Control
Allow, limit or block USB storage, phones, Bluetooth, printers and other device classes, per endpoint group.
Trusted devices
Trust or deny a single drive by its serial number, including external USB hard disks.
Application Control
Allow-lists by publisher, product or hash, enforced through WDAC or AppLocker.
Blocklist
Name the applications that must never run, such as unapproved remote-access tools.
Just-in-time access
People request a blocked application from the block notice. You approve it for one machine and a set time.
Privilege elevation
Run a named application with administrator rights while the person stays a standard user.
Browser Control
Chrome, Edge and Brave settings, site lists and extensions, managed from one policy.
Cloud storage control
OneDrive held to your company tenant, consumer cloud services blocked in the browser and on the desktop.
Content on removable media
Files copied to a USB drive can be checked for sensitive data by the same detectors as Data Loss Prevention.
Trust one drive at a time.
A trusted list names individual devices by serial number. The company's own drives work. A drive of the same model bought at a shop does not.
- Pick from devices already seen. Every device plugged into a managed machine is listed with its serial, ready to trust or deny.
- Removable hard disks too. External USB disks are controlled like flash drives, and the system disk is always left alone.
- Deny lists win. A denied device stays blocked even where its class is allowed.
- Drives without a serial. These can be trusted by model, after you confirm that the entry covers every device of that model.
- File tracing. Copies, renames and deletes on removable media are recorded, with optional shadow copies.
Say yes for an hour.
When an application is blocked, the person can press Request access and give a reason. You approve it for one machine and a fixed time. When the time runs out, the block is back without anyone having to remember.
- The grant is filled in for you from what that machine actually ran: publisher and product for a signed application, its hash otherwise.
- From 15 minutes to 8 hours, then it expires on its own.
- Revoke at any time from the request itself.
- A denial carries a reason that the person is shown.
- Each machine reports whether the grant is in force.
Admin rights for one application.
Remove local admin rights without stopping the work that needed them. Nobody learns an admin password.
Named by policy
Rules name the application by publisher, hash or path. Nothing else can start elevated.
Started from the tray
People choose the application from the Tracemark tray menu. The service launches it elevated in their own session.
The account stays standard
The person never gains standing administrator rights, and no credential is handed out.
A reason when you want one
A rule can ask for a reason before each launch, and the reason is kept with the record.
Unsafe paths refused
A rule that points into a folder ordinary users can write to is rejected when it is saved.
Every launch recorded
Launches and refusals both appear in the elevation activity, so you can see who ran what with elevated rights.
Default-deny, one group at a time.
The lock-down wizard takes a single endpoint group from learning to enforcement. Nothing is blocked until you have seen what would be.
Learn
The agent records every application that runs on the group's machines.
Review
Tracemark proposes an allow-list of publishers. You approve it, and decide on unsigned files one by one.
Audit
The allow-list is applied in audit, so you see what strict mode would stop.
Enforce
Anything the allow-list does not name stops running. Windows and Program Files stay permitted, so the machine still boots.
Rolled out wave by wave.
Each machine reports the policy it actually applied, never only what it was sent. You see which machines are enforcing, which are still in audit and which need a newer agent.
- Inventory first. Application Control opens on what runs across the estate, before any rule is written.
- App groups. Collect publishers and products once and reuse them across policies.
- Four modes. Audit, block, learning and strict, each described in plain words in the console.
- Your own wording. The block notice and the request dialog say what you want them to say.
What is included.
Endpoint Control is a set of modules on one agent and one console. Turn on the ones you need.
Set a mode for each device class and assign the policy to endpoint groups. Content checks, schedules and temporary access cover what a plain allow or block cannot.
- Per-class modes: allow, trusted only, read-only or block
- Bluetooth: audio and input kept, file transfer off
- Trusted and denied lists by serial or by model
- Copy checks: file types, copy limits, sensitive content, encrypted media
- Time schedules and a reason prompt before use
- Temporary access, including codes for laptops that are offline
- Device audit, file tracing and shadow copies
- Platforms: Windows, with removable storage control on macOS
Start from an inventory of what runs on every machine. Build allow-lists from that evidence, block what must never run, and move each group to default-deny when it is ready.
- Rules by publisher, product, file hash or path
- App groups reused across policies
- Modes: audit, block, learning and strict
- Blocklist for named applications
- Lock-down wizard for one group at a time
- Enforced through WDAC or AppLocker on Windows
A time-boxed exception for one machine keeps the policy intact for everyone else. Requests come from the people who were blocked, with their reason attached.
- Request access from the block notice
- Two kinds of grant: run the application, or run it elevated
- Durations from 15 minutes to 8 hours
- Automatic expiry and revoke from the request row
- Denials carry a reason the person is shown
- Applied state reported by each machine
Only the applications the policy names can start elevated, and only through the Tracemark service, in the person's own session.
- Rules by publisher, hash or path
- Launched from the Tracemark tray menu
- Optional reason before each launch
- User-writable paths refused when the rule is saved
- Elevation activity, refusals included
- Time-boxed elevation through just-in-time grants
Browser settings, site lists and extensions are written as the browsers' own enterprise policies. The Tracemark extension installs from your own server and adds a block page that explains why.
- Site block and allow lists
- Extensions allowed, blocked or force-installed
- Settings: incognito, developer tools, sync, saved passwords, file uploads
- Sign-in limited to your company's account domains
- Block page with a reason and a request link
- Preview of the exact policy values written
Keep company files in the company's cloud. OneDrive syncs only with your own Microsoft 365 tenant, and consumer services are blocked in the browser and on the desktop.
- OneDrive held to your tenant, personal sync off
- Consumer services: Google Drive, Dropbox, iCloud Drive, Box, MEGA, WeTransfer and more
- Your own services added by domain
- Shared file links can stay open while a service is blocked
- Exclusions by machine or group
- Accounts found: personal and other-tenant OneDrive on each machine
What is controlled, and how.
| Module | What it controls | How it is enforced | Where it runs |
|---|---|---|---|
| Device Control | USB storage, removable disks, phones, Bluetooth, printers and other classes | Device installation restrictions and removal of untrusted volumes | Windows; removable storage on macOS |
| Application Control | Which executables may run | WDAC or AppLocker policies | Windows |
| Just-in-time access | Time-boxed exceptions to an application block | A grant added to the machine's policy until it expires | Windows |
| Privilege elevation | Named applications that may run as administrator | Launched by the Tracemark service in the user's session | Windows |
| Browser Control | Settings, sites and extensions | Chromium enterprise policies and the Tracemark extension | Chrome, Edge, Brave |
| Cloud storage control | OneDrive tenants and consumer cloud services | OneDrive policy, browser policy and Application Control | Windows |
Questions.
Do we have to write an application allow-list by hand?
No. The lock-down wizard records what runs on a group's machines, proposes an allow-list of publishers from that evidence, and runs it in audit before anything is enforced.
What happens when someone needs a blocked application right now?
They press Request access on the block notice and give a reason. An administrator approves it for that one machine for 15 minutes up to 8 hours. The grant expires on its own and can be revoked earlier.
Does privilege elevation make the person a local administrator?
No. Only the applications named in the policy start elevated, launched by the Tracemark service. The account stays standard and no admin password is shared.
What if a USB drive reports no serial number?
Some drives report no usable serial. Those can be trusted or denied by model instead, and the console asks you to confirm that the entry covers every device of that model.
Can a laptop get device access while it is offline?
Yes. The person reads a challenge from the Tracemark tray, an administrator turns it into a short code in the console, and the laptop grants access for the agreed time without a connection.
Does Browser Control need the Tracemark extension?
Settings, site blocks and extension rules work through the browsers' own policies without it. The extension adds a block page that gives the reason and a link to request access.
Works well with
See it on your own machines.
We walk through device, application and browser policies on a test machine of your choice.