Search and filter every CtrlOne feature in one place - restrictions, browser controls, admin-console tools, restore module, and the auto-scheduler.
The full endpoint management suite - live PC details and processes, screen-time, security posture, remote support, maintenance, services, asset management, commands, Active Directory, browser control, schedules, snapshots, live preview, wallpaper push and full activity / event logs.
A complete hardware and OS inventory for each device - make, model, serial, CPU, RAM, disk layout, BIOS, network adapters, Windows edition and build, agent version and last check-in - so operators can identify and audit every endpoint at a glance.
See the real-time list of running processes on a device with owner, CPU and memory usage, and remotely end a rogue or hung process without disturbing the user at the keyboard.
Track daily active-usage and per-application time on each PC, with trends over time - ideal for spotting idle machines, enforcing focus policies and giving end users a daily usage report card.
A consolidated endpoint security posture view - Microsoft Defender / third-party AV and EDR health, real-time protection status, BitLocker encryption state, firewall profiles and pending security actions - all in one panel.
Remote housekeeping tools: disk cleanup, temp-file purge, disk-health (SMART) and low-space early warnings, restore-point creation and general tune-up actions to keep fleets healthy without a site visit.
View and control Windows services on the device - start, stop, and change start-up type - with the agent handling TrustedInstaller-owned services safely so operators can fix service-related issues remotely.
First-party remote control with no third-party relay - view and take control of the desktop, chat with the user, and transfer files, with every session logged for audit. Built into CtrlOne, not a bolt-on.
Operator-entered procurement and lifecycle records the agent can't auto-collect - purchase date, vendor, cost, warranty expiry, assigned user, location and asset tag - so each device carries its full lifecycle history.
Queue remote commands to a device - restart, shutdown, lock, apply policy, run maintenance and more - with delivery tracking so operators know exactly which actions reached the endpoint.
Surface each device's domain and Active Directory context - domain membership, organisational unit, logged-on domain user and group data - to line up CtrlOne management with your existing directory.
A first-party desktop console (WebView2) that runs on the managed PC itself, letting on-site admins view status and apply policy locally - including offline via the local agent bridge - without opening the cloud console.
Live, per-device browser actions - set the homepage, push allow/block URL lists, force SafeSearch, enable kiosk mode, apply DNS filtering and wipe browsing data - applied to Chrome, Edge and Firefox on demand.
Fleet-wide and per-device security enforcement - roll out and verify security restriction bundles across many endpoints from a single page, with per-device scoping so each toggle lands on the right machine.
Time-based restriction windows that auto-apply and auto-restore - block camera, internet, recorders or any policy on a daily or recurring schedule, with a full activity trail of every automatic transition.
On-demand and scheduled screen captures from the endpoint, stored per device and tenant-scoped, so operators can visually verify what was on screen at a point in time for support or compliance.
A near-real-time stream of the device's screen so operators can watch what's happening live - useful for support triage, monitoring shared kiosks and confirming a user's issue without taking control.
Push a desktop wallpaper or on-screen watermark to a device remotely - live to the signed-in user's session where possible - for branding, classroom identification or on-screen policy notices.
A per-user activity feed showing sign-ins, application launches, policy events and notable actions on the PC, giving operators a human-readable timeline of what happened on each endpoint.
An append-only history of the device's activity - policy applies, restores, blocks and agent events - mirrored durably on the endpoint and surfaced in the console so nothing is lost across reboots or log rotation.
Read the Windows Event Log entries collected from the device - system, application and security channels - so operators can diagnose crashes, errors and security events without remoting into the machine.
Day-one defaults that block the obvious holes - Registry Editor, Control Panel, Windows Update, shortcuts.
Prevents users from opening the Registry Editor or importing registry files, so low-level system settings cannot be changed.
Hides the legacy Display Control Panel applet AND the modern Settings → System → Display / Personalization pages.
Removes user access to Windows Update so they cannot pause, defer or trigger feature/quality updates. The update service itself keeps running.
Removes access to Control Panel and all of its applets. The modern Settings app is left unaffected.
Disables the Win key plus every Win+R/E/L/X/I/A/S/D/M/G/U shortcut combo, and remaps the physical Windows keys so they do nothing.
Removes the 'Shortcut' option from the right-click New menu so users cannot create new shortcuts on the desktop or in folders.
Blocks the Add/Remove Programs and Programs and Features applets so users cannot uninstall, change or repair installed software.
Disables the Command Prompt and batch-script execution. Users see a clear 'command prompt has been disabled by your administrator' message.
Prevents PowerShell - including the ISE editor and PowerShell 7 - from launching, and blocks PowerShell scripts from running.
Hides the Run command from the Start menu and disables the Win+R hotkey so users cannot launch arbitrary commands by name.
Locks the system clock so users cannot change the date, time or time zone from the taskbar, Control Panel or Settings. The clock stays visible.
Removes the Microsoft Store, blocks all store-delivered apps from running and stops background app updates from downloading.
Prevents users from starting, stopping or reconfiguring Windows services through any of the built-in tools, and hides the Administrative Tools shortcuts.
Stops the four core Bluetooth services AND disables every paired BT radio device via PnP - no pairing, file transfer or peripheral connections.
Stops the Windows Calculator from launching and closes it if it is already open.
Deep-system controls for hardened fleets: Group Policy, Task Manager, Defender, services, drivers and more.
Prevents users from opening Task Manager, so they cannot view processes, end tasks or change startup apps. The taskbar shortcut to it is greyed out as well.
Disables Win+L and the Start menu Lock entry so the user cannot manually lock the workstation. Auto-lock from screensaver or idle timeout still works.
Hides the 'This PC' icon from the desktop, the Explorer sidebar and the Start menu so users can't browse drives from the My Computer entry point.
Refuses incoming Remote Desktop connections to this PC and disables the matching Windows Firewall rule, so the machine cannot be reached over Remote Desktop.
Blocks access to System Properties so users cannot view the computer name, change the workgroup or open System Protection.
Locks down the Microsoft Management Console so administrative consoles such as Services, Device Manager and Group Policy refuse to open.
Removes the 'Run as administrator' verb from right-click menus so users cannot launch any program elevated, even with the local Admin password.
Prevents users from viewing or refreshing local Group Policy. Domain policy from your servers still applies normally.
Blocks Windows Installer packages from installing, repairing or removing software on this PC. Already-installed software keeps working; only new changes are blocked.
Disables the Windows clipboard so Ctrl+C / Ctrl+V / Ctrl+X copy nothing between apps. A background guardian also clears the clipboard on every paste attempt.
Suppresses the Delete key in Explorer and removes the right-click → Delete entry so users cannot remove files from the desktop, Documents or any folder.
Blocks the right-click → Personalize entry on the desktop and the Settings → Personalization page so users cannot change theme, colors or background.
Hides the right-click → Display Settings entry and blocks the Settings → System → Display page so users cannot change resolution, scaling or multi-monitor layout.
Disables the Ctrl+X hotkey and removes the right-click → Cut entry in Explorer so users cannot move files by cutting them out of a folder.
Disables the Ctrl+C hotkey and removes the right-click → Copy entry in Explorer so users cannot duplicate files to another location.
Disables the right-click context menu on the desktop, in Explorer, and on the taskbar so users cannot reach New / Properties / Send To / Open With.
Greys out the 'Properties' entry on right-click menus for files, folders and shortcuts so users cannot view or change permissions, attributes or compatibility settings.
Hides Devices and Printers from Control Panel and the Settings → Bluetooth & devices page so users cannot add, remove or reconfigure printers, scanners or paired devices.
Forces the Windows microphone privacy switch to OFF for ALL apps (Win32 + UWP) so no application - including Teams, Zoom or the browser - can record audio.
Forces the Windows camera privacy switch to OFF for ALL apps (Win32 + UWP) so no application - including Teams, Zoom or the browser - can capture video.
Turns off the Action Center and toast notifications for every app so users don't see banners, sounds or badge counts. App-internal in-window alerts still appear.
Prevents the Snipping Tool and the Win+Shift+S screenshot overlay from launching.
Prevents the Windows Photos app from launching. Image files opened from File Explorer fall back to whatever other viewer is associated.
Prevents the Sticky Notes app from launching. Notes already synced to the cloud remain available on the user's other devices.
Prevents the Windows Voice Recorder app from launching. Other apps can still record audio unless the microphone is also blocked.
Hides the Airplane Mode toggle from Settings (Network & Internet → Airplane mode) and from the Action Center quick-action flyout. Also forces the radios back on so a device already in airplane mode is brought back online.
Stops the Windows Mobile Hotspot Service, hides the Mobile hotspot Settings page and the Action Center quick-action, and blocks the Internet Connection Sharing / Mobile Hotspot UI.
Disables the Connected Devices Platform so Nearby Sharing and 'Continue on PC' cannot push files or URLs to other devices over Bluetooth / Wi-Fi-Direct.
Blocks 'Project to this PC' (the Miracast wireless-display receiver) and hides Settings → System → Projecting to this PC.
Turns off the built-in Windows VPN so the PC refuses to start new VPN connections and drops any active one, covering all of the standard VPN types.
Blocks Notepad so it fails to launch from the Start menu, the Run box or by opening a text file, while leaving all other apps working. Turning the feature off restores Notepad.
Disables the entire Windows audio stack at the service level.
Hides the 'Switch user' option on the lock screen and Start menu so a logged-in user cannot park their session and let another local account sign in alongside it.
Replaces the lock-screen image with solid black so on-screen content can't be photographed while the PC is locked.
Uses built-in Windows signing policies to stop unsigned programs and installers from running, without the brick-risk of full app allow-listing.
Automatically locks the PC after five minutes of inactivity and requires the password to resume.
Blocks drive formatting from the right-click menu and the command line so disks can't be wiped by accident or on purpose.
Lock down what users can do on the desktop - wallpaper, icons, themes, right-click and personalisation.
Locks every icon on the desktop in place - users can still click to launch but cannot drag, rename, delete or rearrange them. New shortcuts pinned by IT still appear normally.
Locks the current wallpaper as the only allowed image. The right-click → 'Set as desktop background' verb is greyed out and the Settings → Personalization → Background page is read-only.
Removes the Recycle Bin icon from the desktop. Deleted files still go to the Recycle Bin and can be recovered, but the desktop shortcut to it is gone.
Removes the Network icon from the desktop and the Explorer sidebar so users can't browse SMB shares or workgroup PCs through the GUI. UNC paths typed manually still resolve.
Locks the desktop folder so apps and users cannot save or delete files there. Existing desktop files remain untouched. Ideal for kiosk PCs.
Hides the Desktop folder from the Explorer sidebar and 'This PC' page, and unpins it from Quick Access / Home. The desktop itself is unaffected - only the shell-folder shortcut is removed.
Hides the Documents folder from the Explorer sidebar and 'This PC' page, and unpins it from Quick Access / Home. Files inside Documents are untouched and still reachable by typing the path.
Hides the Downloads folder from the Explorer sidebar and 'This PC' page, and unpins it from Quick Access / Home. Browsers still save downloads to the same folder - only the shell shortcut disappears.
Hides the Music folder from the Explorer sidebar and 'This PC' page, and unpins it from Quick Access / Home. Music files inside the folder remain on disk and still play when opened directly.
Hides the Pictures folder from the Explorer sidebar and 'This PC' page, and unpins it from Quick Access / Home. Image files inside the folder remain on disk and still open normally.
Hides the Videos folder from the Explorer sidebar and 'This PC' page, and unpins it from Quick Access / Home. Video files inside the folder remain on disk and still play when opened directly.
Tiles a faint watermark with the PC name, user and date across the desktop, so photos of the screen carry a traceable marker.
Hides the Public Documents folder from the Explorer sidebar and Quick Access. Files stay on disk and remain reachable by path.
Hides the Public Downloads folder from the Explorer sidebar and Quick Access. Files stay on disk and remain reachable by path.
Hides the Public Pictures folder from the Explorer sidebar and Quick Access. Images stay on disk and still open normally.
Hides the Public Videos folder from the Explorer sidebar and Quick Access. Videos stay on disk and still play when opened directly.
Hides the Public Music folder from the Explorer sidebar and Quick Access. Music stays on disk and still plays when opened directly.
Per-class USB control - allow keyboards / mice / printers while blocking storage, cameras, MTP or HID. Three-mode mass-storage lockdown (off / read-only / block).
Lets USB flash drives and external disks mount but blocks all writes to them.
Blocks USB mass-storage devices (flash drives, external HDDs, SSDs) so they can no longer mount. USB keyboards, mice, headsets and printers continue to work normally.
Prevents Android phones, iPhones and digital cameras from connecting over USB as media devices, so their storage cannot be browsed.
Replaces the all-or-nothing USB sledgehammer with per-class control: allow keyboards, mice and printers while blocking storage, cameras, MTP, network adapters or HID. Survives reboot and applies before the device enumerates.
Three-mode mass-storage control. Read-only blocks writes immediately on already-mounted volumes; Block stops new sticks from mounting at all. Keyboards, mice and phone-charging are unaffected.
Block specific apps, installers, file types and tools from launching on the PC by name and signature.
Blocks new software installations across multiple layers - stopping every type of Windows Installer package and closing the per-user side-load path.
Blocks the Microsoft 3D Viewer UWP app (formerly Mixed Reality Viewer).
Blocks every media-playback app that ships with Windows - the legacy Windows Media Player, the modern Media Player / Groove Music app, and the Movies & TV app.
Blocks the Microsoft Clipchamp video-editor UWP app (bundled by default in Win11 22H2+).
Blocks the Microsoft To Do task / checklist app (a rebrand of Wunderlist) so it exits immediately on launch.
Blocks the Microsoft Paint 3D app so it exits immediately on launch.
Blocks UC Browser, an Alibaba-owned Chromium-based browser with a multi-year track record of shipping with hostile telemetry and unwanted bundled components.
Blocks Opera Browser, a Chromium fork that ships with a built-in free unlimited VPN/proxy that bypasses corporate egress controls.
Blocks Vivaldi Browser (Vivaldi Technologies AS - Norway-based Chromium fork founded by ex-Opera CEO Jon von Tetzchner after the Opera CN ownership change).
Blocks Brave Browser, the largest Chromium fork by install base after Chrome, Edge and Opera, marketed as a privacy-focused browser.
Blocks Mozilla Firefox, the largest non-Chromium third-party browser on Windows and Microsoft's documented managed-alternative when Edge is locked down.
Blocks Microsoft Edge (Microsoft-shipped Chromium-based web browser that REPLACED Internet Explorer as Windows default browser starting Win10 1507/Win11 21H2, ONLY browser pre-installed on every shipping Windows 10/11/Server 2019/2022/2025 box).
Blocks Apple Safari for Windows (Apple-shipped WebKit-based web browser).
Blocks Google Chrome (Google-shipped Chromium-based web browser - most-deployed third-party browser on Windows).
Blocks WhatsApp (Meta/Facebook end-to-end-encrypted consumer messaging product).
Blocks Microsoft Teams (unified Teams chat/video/collaboration product, fka Lync, fka Skype for Business).
Blocks Google Meet (browser-based G Suite / Google Workspace video conferencing product, fka Google Hangouts Meet, fka Google Duo for groups).
Blocks every shipped Zoom Video Communications desktop app so any launch attempt fails.
Blocks the LinkedIn app and the LinkedIn website - feed, jobs, messaging and profiles - in Chrome and Edge.
Blocks Pinterest (the Pinterest Inc. visual-discovery / image-bookmark social network, >500 M monthly active users).
Blocks Snapchat (the Snap Inc. ephemeral-messaging / Stories / Spotlight short-form video network, >400 M daily active users).
Blocks TikTok (the ByteDance short-form video network, >150 M U.S. monthly users + >1 B global).
Blocks Reddit (the link-aggregator / discussion-forum site, >100 M daily active users post-IPO 2024).
Blocks Meta's Threads, the microblogging service spun out of Instagram. Threads has no Windows desktop app - it is web-only - so this blocks the Threads website in Chrome and Edge.
Blocks Midori Browser, a lightweight WebKitGTK-based browser originally created in 2007 for the Xfce desktop environment.
Blocks Dolphin Browser, a gesture-driven mobile browser from Dolphin Browser Inc. (formerly MoboTap) primarily distributed for Android and iOS.
Blocks Comodo Dragon, a Chromium-based browser from Comodo Group (now reorganised under Xcitium Inc.) marketed for security-conscious users.
Blocks Epic Privacy Browser, a Chromium fork from Hidden Reflex Sales Pvt. Ltd. marketed as a privacy-first 'always-on private browsing' browser.
Blocks the upstream Chromium open-source browser, the codebase from which Chrome, Edge, Brave, Opera, Vivaldi, Yandex Browser, Comodo Dragon, SRWare Iron and Epic Privacy Browser are all built.
Prevents the Telegram desktop and Microsoft Store apps from opening, and blocks the Telegram website in Chrome and Edge so the web version cannot be used either.
Prevents the Facebook and Messenger apps from opening and blocks the Facebook and Messenger websites in Chrome and Edge, so the whole Meta surface is unavailable.
Prevents the Messenger app from opening and blocks the Messenger website in Chrome and Edge.
Prevents any Python interpreter - including the launcher, IPython and Conda - from running.
Prevents the Tor Browser and its bundled connection helpers from launching, so users cannot use Tor to bypass web controls.
Prevents the Pale Moon browser, including its portable version, from launching.
Prevents the Puffin browser from launching and blocks its installer and updater so it cannot reinstall itself.
Hide individual Control Panel applets so users can see what they need and nothing else.
Hides the 'Administrative Tools' applet from Control Panel.
Hides the 'AutoPlay' applet from Control Panel.
Hides the legacy 'Backup and Restore (Windows 7)' applet from Control Panel.
Hides the 'BitLocker Drive Encryption' applet from Control Panel.
Hides the 'Color Management' applet from Control Panel.
Hides the 'Credential Manager' applet from Control Panel.
Hides the 'Date and Time' applet from Control Panel.
Hides the 'Default Programs' applet from Control Panel.
Hides the 'Device Manager' applet from Control Panel.
Hides the 'Devices and Printers' applet from Control Panel.
Hides the 'Ease of Access Center' applet from Control Panel.
Hides the 'File Explorer Options' applet (formerly 'Folder Options' on Win7/8) from Control Panel.
Hides the 'File History' applet from Control Panel.
Hides the 'Fonts' applet from Control Panel.
Hides the 'Indexing Options' applet from Control Panel.
Hides the 'Internet Options' applet from Control Panel.
Hides the 'Keyboard' applet from Control Panel.
Hides the 'Mail (Microsoft Outlook)' applet, installed by Office, from Control Panel.
Hides the 'Mouse' applet from Control Panel.
Hides the 'Network and Sharing Center' applet from Control Panel.
Hides the 'Phone and Modem' applet from Control Panel.
Hides the 'Power Options' applet from Control Panel.
Hides the 'Programs and Features' applet from Control Panel.
Hides the 'Recovery' applet from Control Panel.
Hides the 'Region' applet from Control Panel.
Hides the 'RemoteApp and Desktop Connections' applet from Control Panel.
Hides the 'Security and Maintenance' applet, formerly known as Action Center, from Control Panel.
Hides the 'Sound' applet from Control Panel.
Hides the legacy 'Speech Recognition' applet from Control Panel.
Hides the 'Storage Spaces' applet from Control Panel.
Hides the 'Sync Center' applet, which manages Offline Files, from Control Panel.
Hides the legacy 'System' applet - the 'About this PC' and advanced system settings surface - from Control Panel.
Hides the 'Work Folders' applet and its per-user sync engine from Control Panel.
Hides the 'Windows Mobility Center' applet from Control Panel.
Hides the 'Windows Defender Firewall' applet, including its advanced-security console link, from Control Panel.
Hides the 'User Accounts' applet, including the advanced user-accounts and Credential Manager surfaces, from Control Panel.
Hides the 'Troubleshooting' applet and its diagnostic tools from Control Panel.
Hides the 'Taskbar and Navigation' applet (per-user shell-integration surface that Microsoft also forwards to the Win11 Settings > Personalization > Taskbar UWP page) from Control Panel.
Browser-engine-level controls (Chrome, Edge, Firefox) - Incognito, Extensions, DevTools, downloads.
Blocks every standard way to remove the agent - silent uninstalls, the Programs and Features entry, stopping or deleting its service, force-closing it, and deleting its files. It self-heals if any protection is tampered with.
Kills Microsoft Explorer's upload-to-web wizard so users cannot push files to OneDrive, SharePoint or arbitrary FTP destinations from right-click menus.
Throttles browser UPLOAD bandwidth (outbound only) to a precise operator-typed KB/s value via Windows native QoS Policy on common browser executables.
Throttles download speed in the major browsers (Chrome, Firefox, Edge, Brave, Opera and Vivaldi) down to a limit you set in KB/s.
Blocks advertisements, trackers and banner networks across every browser (Chrome, Firefox, Edge, Brave, Opera, Vivaldi and IE) by filtering out around 80 of the largest ad-network domains system-wide.
Forces Chrome and Edge to block ALL downloads - every file type, every source, every site - using their enterprise download-restriction policy.
The New Incognito / InPrivate Window menu entries disappear. All browsing logs to history.
Users cannot install new extensions from the Web Store. Already-installed extensions are also disabled until removed.
The browser blocks ALL downloads - every file save returns 'failed - blocked'. Streaming media in the page still plays.
F12, Ctrl+Shift+I and the View source / Inspect right-click verbs all refuse to open the DevTools panel.
Adult content is filtered out of Google search results and only moderate-restricted YouTube videos play.
Forces every website camera and microphone request to be denied in Chrome, Edge and Firefox, so web pages can't capture video or audio.
Locks proxy settings and DNS-over-HTTPS so users can't reroute traffic to slip past the web filter.
Trim the Start menu - Run, Search, Power, recent items - for kiosk and shared-PC scenarios.
Removes the Sleep entry from the Start menu power button so users can only Sign out / Restart / Shut down. Auto-sleep from idle timeout still runs on its own schedule.
Removes the Sign out entry from the Start menu user-icon flyout so users cannot manually sign out. Lock and switch-user remain available unless those are blocked separately.
Removes the Restart entry from the Start menu power button. Windows Update can still trigger automatic restarts via its scheduled tasks unless WU is also disabled.
Removes the Shut down option from the Start menu power button so users cannot power the PC off from the interface. The hardware power button still works.
Disable F1-F12 system shortcuts and the function-key combos that bypass restrictions.
Blocks the F1 key system-wide. F1 normally opens Help in Office, browsers, Windows Explorer and most desktop apps.
Blocks the F2 key system-wide. F2 normally renames the selected file or folder in Windows Explorer.
Blocks the F3 key system-wide. F3 normally opens Find / Search in browsers, Explorer and most editors.
Blocks the F4 key system-wide. F4 normally drops down the address bar in Explorer and repeats the last action in Office.
Blocks the F5 key system-wide. F5 normally refreshes the current page in browsers and Explorer and starts slideshow in PowerPoint.
Blocks the F6 key system-wide. F6 normally cycles focus between panes in browsers, Explorer and Office.
Blocks the F7 key system-wide. F7 toggles caret browsing in browsers and triggers spell-check in Office.
Blocks the F8 key system-wide. F8 toggles selection-extend mode in Excel and (on some hardware) opens the boot menu pre-Windows.
Blocks the F9 key system-wide. F9 normally recalculates formulas in Excel and refreshes fields in Word.
Blocks the F10 key system-wide. F10 normally activates the menu bar in browsers, Explorer and most desktop apps.
Blocks the F11 key system-wide. F11 normally toggles full-screen mode in browsers, Explorer and many media apps.
Blocks the F12 key system-wide. F12 normally opens DevTools in browsers and Save As in Microsoft Office.
Block Win-key and Ctrl/Alt combos at the driver level so they can't be used to escape lockdown.
Swallows the Num Lock key system-wide so the user cannot toggle the numeric-keypad mode. The current Num Lock state at the moment the policy is applied stays as-is until the policy is turned off.
Swallows the Caps Lock key system-wide so users cannot accidentally (or intentionally) flip into all-caps typing - useful in form-entry kiosks and data-entry workstations where uppercase input causes downstream parsing problems.
Swallows the Scroll Lock key system-wide. Excel and a handful of legacy apps treat Scroll Lock as a navigation-mode switch; blocking it removes that surprise behaviour for end-users.
Hides every action button on the Ctrl+Alt+Del Secure Attention Sequence screen - Lock, Switch User, Change Password, Sign Out, and Task Manager - policies.
Installs a low-level WH_KEYBOARD_LL hook that swallows the VK_TAB keystroke whenever Alt OR the Windows key is held down - kills Alt+Tab (App Switcher), Win+Tab (Task View / virtual-desktop picker), Ctrl+Alt+Tab (sticky App Switcher), and the less-common Win+Ctrl+Tab.
Installs a low-level WH_KEYBOARD_LL hook that swallows VK_ESCAPE whenever Ctrl is held down - kills Ctrl+Esc, the legacy Start-menu shortcut that still works on every keyboard / RDP session / scripted SendKeys() call even when the Start button itself is hidden.
Block AnyDesk, RustDesk, UltraViewer and other remote-control tools that bypass corporate VPNs.
Blocks Microsoft Quick Assist, the in-box remote-help tool that ships on every Win10/11 install and is the canonical scammer delivery vehicle for tech-support fraud.
Blocks the Chrome Remote Desktop host so the PC cannot be controlled through Google's remote-access service, including unattended access.
Blocks Parsec (Parsec Cloud Inc., now part of Unity - low-latency game-streaming / unattended-remote-access product, popular for cloud-gaming AND remote-game-development AND increasingly abused for tech-support scams + low-latency lateral movement).
Blocks RemotePC (IDrive Inc.'s unattended-remote-access product, a TeamViewer/AnyDesk alternative).
Blocks Zoho Assist (Zoho Corporation's remote-support / unattended-remote-access product, on-demand 6-digit-code AND always-on agent install models).
Blocks Splashtop (Splashtop Inc.'s remote-desktop product family - Streamer / Business / SOS / Personal / Enterprise).
Blocks LogMeIn (GoTo Technologies, formerly LogMeIn Inc. / Citrix Online - Pro / Central / Rescue / Hamachi product family).
Blocks GoToMyPC (GoTo Technologies - the legacy Citrix-era consumer/SMB unattended-remote-access product, separate g2* binary family from LogMeIn proper).
Blocks AnyDesk, the most-named brand in global tech-support-scam complaint data: a tiny portable binary that needs no install or admin and only requires the victim to read back a 9-digit ID.
Blocks UltraViewer (DucFabulous Co., Ltd., Hanoi Vietnam - TeamViewer/AnyDesk-clone, dominant scam-vehicle remote-control product across Vietnam / Southeast Asia / India / Bangladesh / Middle East where AnyDesk and TeamViewer have less brand recognition).
Blocks TeamViewer, historically the #1-named brand in global tech-support-scam complaint data from 2010 to 2025.
Blocks RustDesk, an open-source AnyDesk-clone hosted on GitHub under AGPLv3 by PURSLANE LTD (Hong Kong).
Stop risky email attachments and downloaded executables from running on protected machines.
Blocks attachment uploads from third-party desktop mail clients - Thunderbird, Postbox, Mailbird, eM Client, Foxmail and The Bat! - by clearing queued attachments and capping the allowed attachment size to almost nothing. Fully reversible.
Blocks Gmail attachment downloads in Chrome and Edge. This covers the browser only - downloads through other tools or the Outlook desktop app are not affected.
Records operator intent that ARCHIVE-class file attachments should be blocked on this PC.
Records that executable-type email attachments should be blocked on this PC, covering the standard set of high-risk file types such as programs, scripts and installers.
Blocks outbound email data leaks by closing the standard mail-sending and mail-sync channels and disabling attachment uploads in the Outlook desktop app. Stops both webmail and desktop mail clients from sending data off the PC.
Whitelists Google Drive's own apps (installer and sync client) so the live installer-guard doesn't mistake them for blocked setup files.
Blocks file uploads to Google Drive on the web across Chrome, Edge, Brave, Vivaldi and Opera, including the insert-image/file picker in Docs, Sheets and Slides.
Blocks web uploads to OneDrive personal, OneDrive for Business and SharePoint Online tenants, plus the new Outlook-on-the-web upload path.
Blocks file uploads to Dropbox on the web and its upload API. The desktop Dropbox client is handled separately.
Blocks sending documents, photos and videos through WhatsApp Web by cutting off its media-upload servers.
Blocks sending files, photos and videos through Telegram Web, including drag-drop and pasted screenshots.
Blocks attaching files in Gmail on the web, including drag-drop and pasted screenshots.
Only lets users upload PDF files from the browser - any other file type is cancelled at the file picker across every browser.
Only lets users upload image files (JPG, PNG, GIF, WebP and more) from the browser - anything else is cancelled at the file picker.
Top-tier shields - tamper protection, ransomware storm detection, offline fail-closed, per-app time budgets, screen-time report card, disk / SMART early warning, webcam-mic notifier, HKLM hive signing, GUI crash watchdog and silent self-update.
Watches Documents, Desktop, Pictures, Videos, Music and Downloads for bulk-rename storms. Triggers when more than 20 files are renamed within 5 seconds in a single folder - kills the offending process, restores original filenames from a rolling shadow journal, and logs the incident. Honey-file canaries detect ransomware-style scans before user files are touched.
Detects bulk extension swaps (e.g. .docx → .locked, .jpg → .enc) on user document folders. Same 20-in-5-seconds threshold as mass rename, with extension-class heuristics for the canonical ransomware suffix list (.locked, .enc, .crypt, .crypted, .pay, .ransom, .888, etc.). Process killed, files restored from journal, incident logged.
A layered ransomware shield: decoy files that trip an alarm when encrypted, protection for Windows backup snapshots, detection of known ransomware programs and startup tampering, and detection of dropped ransom notes. It automatically quarantines the offending program and records the incident.
Per-policy 'after N days offline, drop into the strictest restriction set' safeguard. Prevents an attacker from killing connectivity to escape lockdown. Window is rollback-aware - restoring an old policy version restores the safeguard with it.
Set daily time limits and optional time-of-day windows for individual apps (for example, 30 minutes a day of a game, only between 4-6pm). Tracked per user and kept across reboots.
End-user-visible daily summary fired as a tray balloon at 18:00 local. Shows top apps + total active minutes for the day so the user sees what was tracked. No cloud round-trip required.
SYSTEM-only background probe runs every 5 min. Surfaces low-disk and predictive SMART failure attributes long before Windows itself notices, so a failing drive becomes a heartbeat alert instead of a Monday-morning crash.
User-session GUI polls the Capability Access Manager every 5s and flashes a tray balloon when a new app starts using the webcam or mic. Catches apps that bypass the indicator LED on cheaper laptops.
The four guarded configuration values (Server URL, Account Username, Account Password Hash, Launch Password Hash) carry an HMAC-SHA256 sibling signature. Tampering with a value without resigning is detected and reverted on the next agent tick.
Closes the gap where killing the agent + watchdog as a pair (e.g. taskkill /IM by image name) would leave the GUI down. A SYSTEM-side watchdog respawns the GUI on next user logon and flags the kill in the audit trail.
Hourly cloud poll for a newer build. The SYSTEM-elevated copy downloads, verifies, and runs the silent NSIS upgrade in-place. User session resumes against the new EXE on the next login - no operator touch needed.
Before restarting the desktop to apply restrictions, the agent checks that it can safely do so. If the check fails three times it leaves the desktop running untouched, so tightly locked-down PCs never end up with a blank screen.
Per-browser launch blocks via Image File Execution Options - pick which browsers users may run.
Blocks Chrome so it fails to launch from the taskbar, Start menu or any link. Windows already open keep running until closed - pair with Close All Browsers for instant effect.
Blocks Edge so it fails to launch. Edge is the default browser on Windows 10 and 11, so blocking it without setting another default leaves users with no browser unless one is allowed.
Blocks Firefox so it fails to launch. Firefox is the only mainstream non-Chromium browser, so blocking it closes the last gap around Chrome and Edge policies.
Blocks Brave so it fails to launch. Because most Chrome enterprise policies (Incognito, Extensions, Developer Tools) don't apply to Brave, blocking it outright is often the only reliable control.
Blocks Opera so it fails to launch. Opera ships with a built-in VPN that can bypass the 'Disable VPN' control, so blocking the browser outright is the only complete fix.
Blocks Internet Explorer. IE has been retired by Microsoft and replaced by Edge's IE Mode - only legacy intranet apps still need it, so this block is safe on most fleets.
Live browser actions: homepage, allow/blocklists, kiosk, SafeSearch, DNS filtering, data wipe.
Force-close any running browser windows on this PC so policy changes take effect immediately.
Launch the user's default browser pointed at a URL - useful for pushing onboarding links, intranet pages, or compliance notices.
Force a URL as the start page for Chrome and Edge using managed policy. Operator chooses the URL; takes effect on next browser launch.
Add websites to a system-wide block list, one per line, so they fail to load in every browser and app - not just Chrome and Edge.
Remove websites from the system-wide block list. Enter one per line; changes apply immediately.
Allow ONLY the listed URL patterns and block everything else in Chrome and Edge. Pure kiosk-style browsing.
Remove the allow-list / block-list policy so Chrome and Edge browsing is unrestricted again.
Disable Incognito Mode in Chrome and InPrivate Mode in Edge so users cannot bypass history / audit by going private.
Block installation of all extensions in Chrome and Edge - stops side-loaded VPNs, ad-blockers, and rogue add-ons.
Block all file downloads in Chrome and Edge. Useful for kiosk PCs and data-loss-prevention scenarios.
Disable the developer tools (F12 inspector) in Chrome and Edge so users cannot bypass site rules.
Switches every active network adapter to CleanBrowsing Family DNS, blocking adult, proxy and mixed-content sites system-wide for ALL apps and browsers.
Enforce Google + Bing SafeSearch and YouTube Restricted Mode via managed policy so search results are family-safe by default.
Open Chrome full-screen with no browser chrome on a single URL - turns the PC into a single-purpose terminal.
Wipe history, cookies, cache and form data from Chrome and Edge on the target PC for a clean handover or shared-PC reset.
Erase saved passwords stored in Chrome and Edge - important when an employee leaves or a shared-kiosk PC is being repurposed.
Strip every Chrome/Edge managed policy that this agent has applied so the browsers behave like a fresh install again.
Harden Chrome, Edge and Firefox - turn off saved passwords, autofill, sync, history and the first-run import wizard.
Turns off the built-in password manager in Chrome and Edge so the browser no longer saves or auto-fills credentials.
Removes the show-password eye icon from browser-managed password fields in Microsoft Edge.
Stops Chrome and Edge from suggesting or auto-filling saved address details on web forms.
Stops Chrome and Edge from auto-filling saved payment cards at checkout - recommended for PCI-DSS endpoints.
Forces all browser downloads into one locked folder; users can't choose where files are saved.
Stops the first-run wizard from importing bookmarks and favourites from other browsers or profiles.
Stops Chrome and Edge from recording browsing history, so the address bar won't autocomplete from past sites.
Automatically clears browsing history every time the browser is fully closed.
Disables sign-in and sync of bookmarks, history, passwords and extensions to Google or Microsoft accounts.
Mirrors every active Browser Hardening setting into Firefox automatically, so the same rules apply there too.
Category-based website blocking - adult, gambling, drugs, piracy, social, streaming, gaming and more, applied system-wide.
Blocks well-known adult and pornography sites system-wide using a managed hosts-file block list.
Blocks well-known gambling and betting sites system-wide using a managed hosts-file block list.
Blocks well-known drug and substance sites system-wide using a managed hosts-file block list.
Blocks well-known piracy and torrent sites system-wide using a managed hosts-file block list.
Blocks well-known proxy and VPN-bypass sites system-wide using a managed hosts-file block list.
Blocks well-known malware and phishing sites system-wide using a managed hosts-file block list.
Blocks well-known social media sites system-wide using a managed hosts-file block list.
Blocks well-known streaming and video sites system-wide using a managed hosts-file block list.
Blocks well-known gaming sites system-wide using a managed hosts-file block list.
Blocks well-known shopping and e-commerce sites system-wide using a managed hosts-file block list.
Blocks well-known dating sites system-wide using a managed hosts-file block list.
Blocks well-known crypto-exchange sites system-wide using a managed hosts-file block list.
The web app your operators live in - dashboards, onboarding wizard, policy versioning + rollback, compliance evidence pack, employee portal, bulk actions, saved views, scheduled reports, outbound integrations, SSO, API tokens, BitLocker posture, endpoint isolation and more.
Single-pane fleet view of every PC running CtrlOne - search, filter, group, and drill into per-device restriction status, last-seen, and live actions.
Reusable bundles of restriction toggles you can apply to one PC, a group, or your whole fleet. Versioned, named, and easy to roll out or roll back.
Organise PCs into logical groups (offices, roles, kiosks) so policies and bulk commands target exactly the right machines without one-by-one work.
Curated bundles of restrictions for common scenarios (kiosk, finance team, contractor laptop) so operators don't have to remember which toggles belong together.
Invite teammates as admins or auditors, manage permissions, reset passwords, and audit sign-in history. Email-based invites and password-reset flows included.
Real-time stream of every blocked action on every PC - what was blocked, by which restriction, and when. Filter by device, user, or restriction.
Full hardware and software inventory for every managed PC - CPU, RAM, storage, OS build, installed applications, licence keys and device identifiers - collected at check-in and updated on every sync. Query, filter and export the fleet's asset register from the admin console without touching a single machine.
Curated, opinionated security defaults across screen, recording, USB, clipboard, print, network and apps - flip an entire hardening baseline in one click.
Push browser homepages, allowlists, blocklists, kiosk mode, SafeSearch, DNS filtering, and live URL blocking from one screen across the fleet.
Track licence keys, seat counts, subscription tier per device and per tenant. Activate, deactivate, transfer, and audit licence usage in one place.
Configure email delivery, branding, retention, audit-log cleanup, password policy, and other tenant-wide preferences without opening a config file.
QA-friendly screen that lets operators trigger and verify each restriction without touching production policies - invaluable during onboarding.
Remotely uninstall, reset, or rotate keys on devices that are leaving the fleet - including a forced-clean mode that takes the agent off the PC entirely.
Background engine that watches for offline devices, suspicious block-event spikes, licence expiry, and email-delivery failures - and emails the right operator.
Tamper-evident record of every admin action: policy edits, command queues, user invites, password resets, restores. Filter, export, and retain per policy.
Guided 4-step flow at /onboarding: claim key -> installer download -> first device check-in -> apply policy template. Polls every 5s while waiting for the first device so the operator sees the moment it arrives.
Every policy edit snapshots the prior state into policy_versions. Newest-first list with diff-vs-current and a one-click Restore. Rollback itself snapshots first so it stays undoable.
Streams a ZIP with audit log, policies, policy versions and device posture in CSV + JSON, plus a framework-specific README mapping evidence to controls. Ships HIPAA, SOC 2 and ISO 27001 templates. Manifest carries SHA-256 of every file.
Single-fetch /dashboard summary: devices online/offline/unclaimed, open alerts, operators, 7-day audit volume, agent-version mix and recently enrolled PCs. Auto-refreshes every 30s. Master-admin gets the cross-tenant rollup.
Cookie-gated /portal for end-users. The local agent mints a short-lived signed link the user clicks; they see their device, the restrictions currently on, and can submit unblock-app / temp-unrestrict / other requests for an admin to decide.
Selection bar above the device list for bulk reassign, bulk uninstall and bulk re-policy. Audited per-action; admin / owner only for destructive ones.
Save the current filter, search, sort and column set as a named view. Private-by-default with a per-tenant share toggle so the whole console can land on the same starting page.
Hard ceilings on devices and operators, enforced server-side as a safety floor independent of plan + seat overrides. Stops a runaway script from enrolling 10,000 PCs into a 50-seat plan.
Per-tenant logos, colours and installer product names. Branding applies to the admin console, the employee portal, and the NSIS installer's UI strings.
Cron-style report schedules that email a PDF or CSV to a distribution list. Built-in templates for fleet posture, audit summary and policy drift.
Per-tenant outbound dispatcher pushes alerts to Slack, Teams, PagerDuty, generic webhooks, Splunk HEC and Microsoft Sentinel. Secret rotation and per-channel filters are first-class.
Each tenant brings its own IdP. State between login start and IdP callback is carried in HMAC-signed envelopes so there's no shared session store to scale or leak.
Mint, scope and revoke long-lived tokens for service accounts. Tokens are role-aware so a CI runner can read inventory without being able to issue commands.
One-click 'cut this PC off the network' that drops a deny-by-default Windows Filtering Platform rule keeping only the agent's cloud channel reachable. Reversible from the same button.
Operator-initiated remote sessions via the device's installed remote-control tool (AnyDesk-class). Agent reports installed/running status and can wipe the tool's saved ID for a clean session.
Force-install missing security patches, surface the per-device patch backlog and roll up across the fleet. Pairs with the offline fail-closed window so unpatched offline PCs degrade automatically.
Per-device BitLocker enable/disable/pause/resume plus a fleet posture rollup: which volumes are protected, which are suspended for the next reboot and which are unprotected.
Heartbeat surface for Defender real-time, signature freshness, Tamper Protection, and any 3rd-party AV / EDR registered with Security Center. A drift in any of these becomes an alert.
Per-device adapter, IP, gateway, DNS, public IP and last-seen-on-which-Wi-Fi data. Used by the geofence and the 'this PC moved off the corporate network' alert.
Per-device USB write events: which file, which volume, which user, when. Pairs with USB Storage Lockdown so the operator can flip from monitor to enforce on a single PC or the whole fleet.
One-click recovery: capture a clean install baseline and restore the PC to it on demand.
At install time the agent captures a baseline of the PC's Windows service settings and website block list, then stores it locally and in the cloud so the system can be restored later.
Background sync makes sure the cloud always holds the latest local baseline - so the operator can restore to install-time defaults even if the PC is wiped and reimaged.
One-click restore replays captured service start types and hosts entries, plus chains the existing CtrlOne backup restore - bringing the PC back to install-time state.
Restore deliberately skips RDP, RPC, DCOM, DNS, DHCP, the CtrlOne agent itself and Defender so the operator session and remote management survive mid-restore.
Local technicians can run the same restore offline via --restore-install-baseline (or /RESTOREDEFAULTS) when the PC is disconnected from the internet.
Per-device card showing capture time, service count, hosts size, last restore status - with a confirm dialog before queueing the cloud restore command.
Time-based restriction windows that auto-apply and auto-restore - block camera, internet and recorders on a daily schedule with no manual touch.
Disables every webcam and camera device on the PC during scheduled windows. Re-enables automatically the moment the window ends - no manual toggle, no agent restart.
Cuts network connectivity (Wi-Fi + Ethernet + cellular) for the scheduled period. The PC stays usable for offline work; access is restored automatically when the window closes.
Terminates and prevents launch of screen / audio recorders (OBS, Bandicam, Camtasia, Snagit, Xbox Game Bar, etc.) for the duration of the scheduled window.
Stack as many time ranges as you need on a single schedule - e.g. 09:00-12:00 and 14:00-18:00. Each window applies and lifts independently.
Windows that wrap past 00:00 (e.g. 22:00 → 06:00) are handled correctly. The engine evaluates start / end on the right calendar day every time.
Once a schedule is saved no operator action is needed. The server fires the restriction ON at start and OFF at end automatically - even if the operator is offline.
Schedule edits propagate to the agent in seconds via the existing command channel. No PC restart, no re-install, no operator intervention required.
While a window is active the user cannot bypass blocked features - the agent re-asserts the block continuously and logs every bypass attempt to the audit trail.
Each PC has its own schedule list - pick the restrictions to enforce, the time windows, and toggle the schedule on or off without affecting other devices.
Every automatic apply / restore is recorded with timestamp, restriction id, schedule id and outcome - visible in the device activity feed for compliance review.