Manufacturing Device Lockdown: Securing Shop-Floor PCs
Shop-floor PCs and HMIs run one job for years: driving a machine, logging production, or showing a dashboard. They are often old, rarely rebooted, sometimes offline, and disastrous to have go down mid-shift. Manufacturing device lockdown keeps these single-purpose machines doing exactly one thing, safely. This guide covers what to lock down on industrial endpoints and how to keep enforcement working even without a network.
The shop-floor environment
Industrial PCs are single-purpose and stability-critical. Operators are not IT staff, updates can break line software, and downtime is expensive. Many machines sit on isolated networks or go offline for stretches.
The goal is a machine locked to its one purpose, protected from tampering and accidental changes, that keeps running whether or not it can reach a server.
What to lock down
Manufacturing lockdown leans heavily on single-purpose operation and controlling change.
- Single-purpose shell - run the HMI or line app as a kiosk with the desktop and shortcuts locked
- System tools - block Command Prompt, Registry Editor, Task Manager, and Control Panel
- USB - control removable storage, a common malware vector on isolated networks
- Updates and installs - control what can be installed or changed so line software is not broken
- Desktop - locked wallpaper, Start menu, and taskbar so operators cannot wander off task
Offline enforcement and controlled change
Because industrial machines are often offline, enforcement cannot depend on a live connection. Offline fail-closed enforcement keeps the lockdown in place even when the device cannot reach the console, so policy never lapses on an isolated line.
Change should be deliberate: policy versioning lets you snapshot a known-good configuration and roll back instantly if an update or change causes a problem - critical when downtime costs money.
Frequently asked questions
Will lockdown keep working if the machine is offline?
Yes. Offline fail-closed enforcement keeps the locked-down policy in place even without a network, which suits isolated or intermittently connected shop-floor machines.
How do I keep a machine to one job?
Run the HMI or line application as a kiosk with the desktop, shortcuts, and system tools locked, so operators can only use the intended app.
How do I stop USB malware on an isolated network?
Control removable storage - block it or set it read-only - since USB drives are a primary way malware reaches machines that are not on the internet.
What if an update breaks the line software?
Control what can be installed or changed, and use policy versioning to snapshot a known-good state so you can roll back instantly if something breaks.
Lock down the shop floor, online or off
CtrlOne keeps industrial PCs to one job with kiosk lockdown, USB control, and offline fail-closed enforcement - with instant rollback when you need it.