Sign in
Manage application control (WDAC), policy drift, and containment response. Expand a section to work in that area. Set per-device WDAC mode (audit / enforce / disabled) from the Devices page.
Application control (WDAC)
Allow rules (file path / process)Prefer full file paths with wildcards for installed apps (for example Program Files\\Vendor\\*). Use process names only when the path varies. Publish and verify in audit before enforce.
Allow third-party apps by full file path (e.g. C:\Program Files\TacticalAgent\*) or process / file name (e.g. tacticalrmm.exe). Enabled rules are merged into every organisation WDAC policy. The Obsidian agent itself is always allowed automatically and does not appear here.
| # | Type | Value | Notes | Enabled | Actions |
|---|
Endpoint learned itemsPrefer a path allow rule when you already know the install folder. For unknown trees, use Devices → Learn install (scoped session) instead of full-device audit. Promote only business-required paths; skip one-off downloads.
Items observed in audit mode that would be blocked under enforce. Promote them to allow rules before switching a device to enforce.
| Last seen | Source | Type | Value | Hits | SHA256 | Mapped rule | Actions |
|---|
Policy drift
Drift incidentsTreat high/critical drift as an investigation queue. Confirm whether the endpoint failed to apply policy, was manually changed, or needs a profile update.
Policy drift detected between expected and reported endpoint state.
| Time | Endpoint | Category | Severity | Status | Summary | Actions |
|---|
Containment
Per-endpoint overridesUse overrides only for exceptions on a single machine after a profile is already applied. Prefer fixing the shared profile when many endpoints need the same allow. Keep override lists short and specific.
Endpoint-only exceptions
These settings do not change the shared containment profile. They add allows for one endpoint on top of whatever profile is assigned to it.Overrides apply to one endpoint only. They stack on top of the assigned containment profile — they do not replace profile controls, network isolation, or excludes.
- Macro allow — file paths: full paths to approved macros or helper executables for this machine
- Macro allow — file names: file/process names for this machine (
.exe= process,.xlsm/.docm= extension)
Assign a containment profile to the endpoint first (see Apply profile in the builder below), then save overrides here.
Containment profile builderBuild the shared lockdown once, test on a pilot group, then apply organisation-wide. Use Per-endpoint overrides above for one-off exceptions instead of weakening the shared profile.
Profile-wide settings that apply to every endpoint the profile is assigned to. For one-machine exceptions, use Per-endpoint overrides above.
Profile load / save
Load an existing profile before editing. Save new profiles with a clear name (for example workstation-standard). Update only after reviewing the rules preview.Controls Profile-wide
Start from a preset that matches the risk level, then remove only what breaks business tools. Prefer blocking ransomware and lateral tools on all workstations. Avoid organisation-wide PowerShell blocks unless you have tested support impact.Presets provide recommended blocks. Review carefully before organisation-wide rollout.
Program blocks enforce executable launch deny + outbound/inbound network blocking. The agent runtime and its tooling (service wrapper, PowerShell hosts, reg/schtasks/sc/taskkill/conhost) can never be launch-blocked so the agent can always update, fetch policy, restart, redeploy and uninstall. PowerShell can still have its network restricted — only the agent binary keeps guaranteed egress. The dashboard/API address (including any range covering it) and DNS/DHCP stay reachable even under full network isolation.
Office / macros Profile-wide
Enable Office script spawn blocking and macro hardening for most workstations. Put shared approved macros in the profile allow lists here. Put one-machine exceptions in Per-endpoint overrides.Office script guard only stops script hosts and shells launched by Office parent processes. It does not block PowerShell or cmd for the rest of the system (use the options above for machine-wide blocks). In-process macros without a separate process are not stopped by this control — pair with Defender and email security.
Network isolation Profile-wide
Reserve full isolation for incident response. Always allowlist the dashboard/API and required business destinations before enabling. DNS/DHCP remain reachable; confirm remote support paths if needed.Excludes Profile-wide
Excludes weaken the profile for every assigned endpoint. Prefer a dedicated softer profile or a per-endpoint override when only one machine needs an exception.Quick excludes (toggle to allow specific tools even when blocked by preset)
Apply profile
Pilot on a small set of endpoints before organisation-wide apply. Clear applied profile when lifting containment after an incident.Containment profilesKeep a small set of named profiles (standard, strict, IR lockdown). Disable unused profiles instead of leaving ambiguous duplicates.
Reusable containment configurations for endpoint response.
| Name | Status | Applied to | Assigned endpoints | Updated |
|---|
Containment activityUse activity history to confirm who applied or cleared containment during an incident and when it took effect.
Recent containment actions and outcomes.
| Time | Action | Endpoint | Profile | Actor |
|---|