Locking Down Shop-Floor Windows PCs with CtrlOne
A manufacturer ran Windows PCs across three plants - operator stations on the shop floor, HMI and label-printing terminals, and machines in shared break areas. These PCs are used by many operators across shifts, often sit on patchy factory-floor networks, and had drifted into an inconsistent, hard-to-secure state. Here is how CtrlOne brought them under one standard.
- 3 - plants on one policy standard
- USB - storage blocked on the shop floor
- Offline - enforcement that holds without a network
The problem
Shop-floor PCs are shared by operators across every shift and rarely rebooted. Anyone could plug in a USB drive, launch an unapproved app, or change settings that took a station offline mid-production.
The plants sit on unreliable networks, so any control the team relied on had to keep working even when a machine lost connectivity - and it had to be the same on every site.
- Shared operator and HMI stations used by many people across shifts
- USB drives moving files - and malware - between production machines
- Unapproved apps and setting changes taking stations offline during production
- Patchy shop-floor networks that couldn't be relied on for enforcement
- Inconsistent configuration across three plants
The deployment
The manufacturer deployed the CtrlOne agent to every plant PC and grouped machines by role - operator station, HMI terminal, break-area PC - each with its own policy pushed from the console.
- USB device-class control blocks storage drives while keeping scanners, keyboards, and other approved peripherals working
- Application control allows only the production and line-of-business apps each station needs
- System tools and settings are locked so operators can't take a station offline
- Offline fail-closed enforcement keeps the policy in place when a machine loses the network
- A restore baseline snaps any drifted station back to its approved state
Our floor PCs are shared all day and the network isn't always there. CtrlOne locks them down the same way on every line and keeps them locked even when a machine drops offline.
The results
Production machines became predictable, and the small plant-IT team stopped chasing station-by-station problems.
- Every shop-floor and HMI PC across three plants runs the same enforceable policy
- USB storage - a common malware path between machines - is blocked by default
- Unplanned station downtime from tampering and rogue apps dropped sharply
- Enforcement holds even on unreliable factory networks
- A rebuilt or replaced station is production-ready in minutes
The benefits
Standardizing on CtrlOne gave the manufacturer stable production endpoints and far less firefighting.
- Consistent, enforceable configuration across every plant and shift
- Fewer production interruptions caused by USB malware or rogue software
- Enforcement that does not depend on a reliable network connection
- New or replaced stations inherit the right policy automatically
- Policies manage Windows settings only and remove cleanly - the agent never alters production or machine-control software
Frequently asked questions
Will locking down shop-floor PCs interfere with production software?
No. CtrlOne enforces Windows policy only - it never modifies or removes your production or machine-control applications. Approved apps and peripherals keep working; only risky surfaces like USB storage and system tools are removed.
What happens when a station loses network connectivity?
Offline fail-closed enforcement keeps the locked-down policy in place without a connection, so protection never lapses on patchy factory-floor networks.
Can different stations have different rules?
Yes. Machines are grouped by role in the console - operator station, HMI terminal, break-area PC - and each group gets its own policy.
Lock down your shop-floor PCs
See how CtrlOne blocks USB storage and unapproved apps on shared production machines - with offline-safe enforcement that holds on any network.
This is a representative deployment scenario that illustrates how CtrlOne is used in this industry. Figures are illustrative of typical outcomes, not a verified named-customer result.