Endpoint Protection

Hi,

Can I configure a machine such that it is running in computer mode by default and the application control is to denis USB access.

However, if a authorized user to use USB device login to the machine, I grant permission for the user to use USB device?

How can this be done?

Cheers
Tan Yong Chen

You will have to deploy using User mode.Then apply application and deivce control policy on Limited user group.Then only when admin logs in it will alow usb as it will not have the policy to block it.
In Computer mode the policy is applied to the compter no matter which user logs in it won't diffrenciate between them.
Basically you will have to group your computers in type of users and then apply policy using it.Best way would be AD integration ion SEPM and import all the users from AD.

Hi, currently I have my clients installed as computer mode. Is there any way to change to user mode?
How does the user mode be pushed down to the machines? Based on user currently connected and push it down to the connected machine?

right click on the computer and say switch to user mode.

By this the computer mode will be turned to user mode.

Cheers
Pete

So to do a policy such that certain user is able to use USB device, all my deployment will need to be changed to user mode right?

Computer mode will need to be all replaced with user mode. Plus the policy that I created must be user based. Is that right?

To deploy, I need to recreate my client package and set it to user mode and existing machines joined, I just need to change to user mode. Am I right?

if thats the requirement , yes you may need to change to usre mode.

However computer mode and user mode co exist, if that ths case, the computer mode policy superceded the user mode policy.

You can have client package with the user mode preconfigured.

Hi pete,

Because the computer mode policy superceded the user mode policy, I dont think its possible for them to co exist.
My deployment was to let certain users to use USB device. Please correct me if I am wrong

Thanks

yes :-(
from admin guide...

You can set up clients as users or computers, depending on how you want the
policies to work. Clients that are set up as users are in user mode. Clients that are
set up as computers are in computer mode. Clients that are set up as users are
based on the name of the user who logs on to the network. Clients that are set up
as computers are based on the computer that logs on to the network. You set up
clients as users or computers by adding the users and computers to an existing
group. After a user or a computer is added to a group, it assumes the policies that
were assigned to the group.
The policies that are in force depend on the mode in which the client software
runs:
Mode Description
The client protects the computer with the same policies, regardless of which
user is logged on to the computer. The policy follows the group that the
computer is in. Computer mode is the default setting.
Computer
mode
The policies change, depending on which user is logged on to the client.
The policy follows the user.
User mode
If the client software runs in user mode, the client computer software gets the
policies from the group of which the user is a member. If the client software runs
in computer mode, the client gets the policies from the group of which the
computer is a member.
After you add a computer, it defaults to computer mode. Computer mode always
takes precedence over user mode. Users who log on to the computer are restricted
to the policy that is applied to the group to which the computer belongs.


You need to apply as per your policy..

For your device control policy.As you want to allow admins.
You will have to use User Mode.
If you have already installed the client select all right click and change them to USer mode. and group them according to your policy specification.

Hi,

Currently I have push down my client packages as computer mode.
Now, I need to change these to user modes. And assign policy to allow certain user to access USB.
How do I go about doing it?

Im quite loss at the moment.

hi,
change these computer to be user mode...
apply policy to the group ( user mode) and configure you want to achieve...
cheers
Pete

Lets say, there are 5 users, a,b,c,d,e and f.

How do I go about setting policys to let a,b,c to use USB drives and e,f to not use USB?

Sorry for asking this, but Im quite confused now.