Configuring Device Control task settings

To configure the Device Control task via the Kaspersky Security Center policy:

1. Go to the Device Control settings in the policy that you want to configure.
   1. In the Kaspersky Security Center Administration Console tree, expand the Managed devices node.
   2. Select the administration group for which you want to configure the task.
   3. Select the Policies tab.
   4. Double-click the policy name you want to configure.
   5. In the Properties: <Policy name> window that opens, select the Local activity control section.
   6. Under Device Control, click Settings.

      The Device Control window opens.

2. On the General tab, configure the following task settings:
   • In the Task mode block, select one of the following task modes:
     • Active.
       

       By default, Kaspersky Embedded Systems Security for Windows blocks all external devices on the controlled list, except for trusted ones.

       If an external device you consider untrusted is connected to the protected device before the Device Control task starts in Active mode, the device is not blocked by the application. We recommend that you disconnect the untrusted device manually or restart the protected device. Otherwise, the Default Deny principle will not apply to the connected external device.

     • Statistics only.
       

       Kaspersky Embedded Systems Security for Windows does not block controlled external devices from connecting. It only adds information about the connection and registration of external devices on the protected device, and about the Device Control allow rules triggered by the connected external devices, to the task log.

       This mode is set by default.

   • Select or clear the Allow the use of all external devices if the Device Control task is not running check box.
     

     The check box allows or blocks the use of external devices when the Device Control task is not running.

     If the check box is selected and Device Control task is not running, Kaspersky Embedded Systems Security for Windows allows using any external devices on a protected device.

     If the check box is cleared, the application blocks the use of untrusted external devices on a protected device in the following cases: the Device Control task is not running or the Kaspersky Security Service is turned off.

     By default, the check box is cleared.

   • Select or clear the Block Bluetooth devices check box.
     

     This check box enables or disables blocking of Bluetooth devices from connecting to the protected device.

     If the check box is selected and Device Control is running in Active mode, Kaspersky Embedded Systems Security for Windows blocks Bluetooth devices from connecting to the protected device unless the paths to instances of these Bluetooth devices fall within the scope of Device Control allow rules.

     If the check box is selected and Device Control is running in Statistics only mode, Kaspersky Embedded Systems Security for Windows does not block Bluetooth devices from connecting to the protected device. It only adds information about the connection and registration of Bluetooth devices on the protected device, and about the Device Control allow rules they trigger, to the task log.

     If the check box is cleared, Kaspersky Embedded Systems Security for Windows does not block Bluetooth devices from connecting to the protected device in any Device Control mode. Neither is information about their connections recorded in the Device Control task log.

     By default, the check box is cleared.

   • Select or clear the Block USB keyboards check box.
     

     This check box enables or disables blocking of USB keyboards from connecting to the protected device.

     If the check box is selected and Device Control is running in Active mode, Kaspersky Embedded Systems Security for Windows blocks USB keyboards from connecting to the protected device unless the paths to instances of these USB keyboards fall within the scope of Device Control allow rules.

     If the check box is selected and Device Control is running in Statistics only mode, Kaspersky Embedded Systems Security for Windows does not block USB keyboards from connecting to the protected device. It only adds information about the connection and registration of USB keyboards on the protected device, and about the Device Control rules they trigger, to the task log.

     If the check box is cleared, Kaspersky Embedded Systems Security for Windows does not block USB keyboards from connecting to the protected device in any Device Control mode. Neither is information about their connections recorded in the Device Control task log.

     By default, the check box is cleared.

   • Select or clear the Block USB mouses check box.
     

     This check box enables or disables blocking of USB mice from connecting to the protected device.

     If the check box is selected and Device Control is running in Active mode, Kaspersky Embedded Systems Security for Windows blocks USB mice from connecting to the protected device unless the paths to instances of these USB mice fall within the scope of Device Control allow rules.

     If the check box is selected and Device Control is running in Statistics only mode, Kaspersky Embedded Systems Security for Windows does not block USB mice from connecting to the protected device. It only adds information about the connection and registration of USB mice on the protected device, and about the Device Control allow rules they trigger, to the task log.

     If the check box is cleared, Kaspersky Embedded Systems Security for Windows does not block USB mice from connecting to the protected device in any Device Control mode. Neither is information about their connections recorded in the Device Control task log.

     By default, the check box is cleared.

   • Select or clear the Block SD card readers connected via USB or PCI bus check box.

     This check box enables or disables blocking of the following from connecting to the protected device.

     • External and internal USB SD card readers
     • Removable drives connected to internal PCI SD card readers

     If the check box is selected and Device Control is running in Active mode, Kaspersky Embedded Systems Security for Windows blocks the devices listed above from connecting to the protected device unless the paths to instances of the devices fall within the scope of Device Control allow rules.

     If the check box is selected and Device Control is running in Statistics only mode, Kaspersky Embedded Systems Security for Windows does not block the devices listed above from connecting to the protected device. It only adds information about their connections to the protected device, and about the Device Control allow rules they trigger, to the task log.

     If the check box is cleared, Kaspersky Embedded Systems Security for Windows does not block devices listed above from connecting to the protected device in any Device Control mode. Neither is information about their connections recorded in the Device Control task log.

     By default, the check box is cleared.

3. Click the Rules list button to edit the list of Device Control rules.
4. If required, configure the task run schedule on the Task management tab.
5. Click OK in the Device Control window.

Kaspersky Embedded Systems Security for Windows immediately applies the new settings to the running task. Information about the date and time when the settings were modified, and the values of task settings before and after modification, are saved in the system audit log.

Page top