In this article, you will learn everything you need to know about the settings you can configure for the Heimdal client-side products from the Heimdal Dashboard -> Endpoint Settings. To go to the Endpoint Settings, log in to the Heimdal Dashboard, click the Endpoint Settings button (top-right corner), and select a Group Policy.
1. Endpoint Settings
2. General
3. DNS Security
4. Patch & Assets
5. Endpoint Detection
6. Privileges & App Control
7. Remote Desktop
ENDPOINT SETTINGS
In the Endpoint Settings, you have a section dedicated to Windows endpoints where you can create and manage the Group Policies that are applied to the endpoints inside your organization. The Modules Overview button gives an overview of the status of each Group Policy in the Windows GPs list. In the Windows GP tab, you can change their priorities according to your needs (by using drag & drop), duplicate/enable/disable a Group Policy, or use the Group Policy Inheritance mode feature and the Opt-in Reseller Master GP feature (if activated by your reseller).
Group Policy Inheritance
Group Policy Inheritance works only for the 3rd Party Patch Management product and merges the settings for the 3rd Party Application list (automatic install/automatic update/manual install) across multiple Group Policies (it does NOT merge Delay, Version, Scheduler, or Application Blocklist settings). This feature does NOT apply to endpoints that are manually applying a Group Policy (specific Group Policy). Thus, the inheritance will only work on endpoints that are automatically applying a Group Policy. Group Policy Inheritance also considers the AD Group membership of an endpoint if the Heimdal Dashboard Group Policies are linked to AD Groups (AD Computer Group/AD User Group, but not Azure AD Groups) to achieve a more granular customization of the Group Policy settings that will apply to an endpoint or multiple endpoints.
When Group Policy Inheritance is enabled, an endpoint will apply the 3rd Party Patch Management settings (automatic install/automatic update/manual install) specified in the Group Policy that is applying to it, but it will also apply the 3rd Party Application settings (automatic install/automatic update/manual install) from the rest of the Group Policies that match the endpoint (from the highest priority to the lowest priority). The criteria that will merge from other Group Policies are the Install, Update, Allow Install checkboxes and the Infinity Management checkbox.
In case the same application is managed by 2 Group Policies, the Group Policy with the highest priority takes precedence. In the case below, if Group Policy A (Google Chrome x64 is set to install the Latest Version) has a priority of 5 and Group Policy B (Google Chrome x64 is set to stay on Version 112.0.5615.50) has a priority of 6, the Heimdal Agent will keep Google Chrome x64 on version 112.0.5615.50 because Group Policy B is the Group Policy with the highest priority.
SCENARIO 1 - AN ENVIRONMENT WHERE THE GROUP POLICIES ARE APPLIED BASED ON PRIORITIES
a. An endpoint that is applying Group Policy A (priority 6, the highest) will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy A, Group Policy B, Group Policy C, Custom 2, Custom 1.
b. An endpoint that is applying Group Policy B (priority 5) will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy A, Group Policy B, Group Policy C, Custom 2, Custom 1.
c. An endpoint that is applying Group Policy C (priority 4) will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy A, Group Policy B, Group Policy C, Custom 2, Custom 1.
SCENARIO 2 - AN ENVIRONMENT WHERE THE GROUP POLICIES ARE APPLIED BASED ON AD COMPUTER/USER GROUPS
a. An endpoint that is applying Group Policy A (priority 6) because the endpoint is a member of the Development AD Computer Group will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy A, Custom 2, Custom 1 (Group Policy A is automatically applied to the endpoint, while Custom 2 and Custom 1 are also merged because they are not linked to any AD Computer/User Groups).
b. An endpoint that is applying Group Policy B (priority 5) because the endpoint is a member of the Marketing AD Computer Group will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy B, Custom 2, Custom 1 (Group Policy B is automatically applied to the endpoint, while Custom 2 and Custom 1 are also merged because they are not linked to any AD Computer/User Groups).
c. An endpoint that is applying Group Policy C (priority 4) because the endpoint is a member of the Support AD Computer Group will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy C, Custom 2, Custom 1 (Group Policy C is automatically applied to the endpoint, while Custom 2 and Custom 1 are also merged because they are not linked to any AD Computer/User Groups).
d. In the snippet below, an endpoint that is applying Group Policy A (priority 3) because the endpoint is a member of the Development AD Computer Group will apply the 3rd Party Application settings (automatic install/automatic update/manual install) from Group Policy A, Custom 2, Custom 1 (Group Policy A is automatically applied to the endpoint, while Custom 2 and Custom 1 are also merged because they are not linked to any AD Computer/User Groups).
e. If the endpoint is applying a Group Policy where Application Uninstall targets a 3rd Party Application that is managed/merged from another inherited Group Policy, the uninstall rule takes precedence: that application will not be installed or updated from the inherited Group Policy.
Reseller Master GP Distribution
Reseller Master GP Distribution is a feature that allows resellers to deploy a Reseller Group Policy to all the customers who have opted in to the Reseller Master GP. The Reseller Master GP Distribution feature can be activated only from the Reseller account and enables the Opt-in Reseller Master GP functionality on the reseller's customers. A reseller can create one or multiple Reseller GPs.
Opt-in Reseller Master GP allows the customer (or the reseller) to apply the Group Policy settings configured by the Reseller in the Reseller Master GP. This GP cannot be edited or disabled by an Enterprise customer, but its priority can be changed in the Group Policy list.
The Download button allows you to download an Excel file with all the Group Policies and the settings in each Group Policy.
GENERAL
The General tab is divided into 6 modules: General Management, Device Info Notifications, BitLocker Management, Scripting, USB Management, and System Restore Management.
GENERAL MANAGEMENT
In the General Management tab, you can configure Group Policy settings that refer to GP assignment, check intervals, thresholds, and other additional settings.
Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.
General Settings
Policy name - sets the name of the Group Policy.
Language - allows you to select the language of the Heimdal Agent UI to be enforced on the endpoints.
Group Policy priority - shows the priority of the Group Policy in the Group Policy list. To change it, drag and drop the Group Policies to reorder them in the Endpoint Settings.
Targeted machine type - allows you to determine whether the Group Policy applies to Servers, Endpoints (workstations), or Both. By default, the Group Policy is applied to both Server and Endpoint machines. Changing the default value of the Group Policy after it has been applied to one or multiple endpoints may force the endpoints to re-assign to a different Group Policy (depending on whether they are Servers or Endpoints).
Azure AD Group assignment - allows you to link the Group Policy to one or more Azure Active Directory Groups (Microsoft 365 Groups, Distribution Groups, Mail-enabled Security Groups, Security Groups). Endpoints (computers or users) that are members of the specified Azure AD Group(s) will automatically receive and apply this Group Policy.
Public IP-based assignment - allows you to automatically assign the Group Policy to endpoints matching the specified Public IP address(es). You can add a single Public IP address, multiple Public IP addresses, or IP ranges (separated by dashes), which need to be separated by commas. For example: 1.1.1.1,1.1.2.2-1.1.3.3,3.3.3.3.
AD Computer Group / Hostname Group / ComputerTag assignment - allows you to link the Group Policy to an Active Directory Group, a Hostname Group, or a ComputerTag (in the local Windows Registry). The Group Policy settings will apply to the endpoint (computer object) if the computer itself is a member of the specified group.
AD User Group / UserTag assignment - allows you to link the Group Policy to an Active Directory Group or a UserTag (in the local Windows Registry). The Group Policy settings will apply to the user if the signed-in user account is a member of the specified group.
Automatic Group Policy sync interval [minutes] - sets the interval the Heimdal Agent uses to automatically synchronize the Group Policy settings with the Heimdal Dashboard and servers. The interval can be set between 15 and 1440 minutes; the default is 180 minutes.
Licensing check interval [minutes] - sets the interval the Heimdal Agent uses to check the Heimdal license. The interval can be set between 1440 and 2880 minutes.
Terminal Server Group Policy sync - prevents the Heimdal Agent from automatically syncing the Group Policy settings every time a new user logs in to the operating system. This functionality works on servers only (it does not apply to regular endpoints). The Heimdal Agent will use the interval configured in the Automatic Group Policy sync interval to communicate with the Heimdal servers. This is dedicated to Terminal Servers on which multiple users are logging in.
Proxy Settings
This feature is designed to allow the Heimdal Agent to communicate with the Heimdal Dashboard if the endpoint(s) is/are placed behind a Proxy Server. It allows you to specify the proxy settings by adding the needed information in the displayed fields.
Use machine's default settings - the Heimdal Agent will automatically detect and use the system's default Proxy settings from the computer's Internet Settings for all communication with the Heimdal Core service. If this option is enabled, the Heimdal Agent will impersonate the user who is currently logged in on the computer to pick up the Proxy configuration. If no user is logged in, the Heimdal Agent will not be able to collect the Proxy information.
No proxy - the Heimdal Agent will not use any Proxy when communicating with the Heimdal Core service.
Manual proxy - allows you to explicitly define the Proxy settings (Host, Port, Domain, Username, and Password) that the Heimdal Agent should use for communication with the Heimdal Core service.
Agent Settings
Include in the Release Candidate program - enrolls the Heimdal Agent in the Release Candidate Program. The Heimdal Agent will automatically receive the latest Release Candidate (Beta) version available on the Heimdal servers, providing early access to upcoming features and improvements before general release.
Hide Heimdal Agent UI - runs the Heimdal Agent without the GUI. The agent's protective services remain fully active and run silently in the background. This feature is recommended for File Servers, Citrix Servers, Terminal Servers, or RDP Servers where multiple users are connecting at the same time.
Keep Heimdal Agent UI running on screen lock - allows you to keep the Heimdal Agent UI running when a Windows session is locked or disconnected, instead of restarting it. When enabled, the same Agent instance continues running in the background until the user signs out. By default, this option is disabled, and the Agent UI restarts after a session lock or reconnect.
Agent toast notification on GP synchronization - displays a brief on-screen notification to the end user when a Group Policy synchronization process has finished.
Time synchronization with Windows Time Server - syncs the endpoint's time with the Windows Time Server to ensure correct communication between the Heimdal Agent and the Heimdal servers, as time discrepancies can interrupt protection and lead to connectivity issues. The Heimdal Agent will run w32tm /resync and net time /set /y in the background every time a Group Policy check is performed.
Skip prompting the end-user when requesting logs - allows you to request the Heimdal Logs or the Event Viewer Logs from any endpoint without the explicit approval of the user. This option is enabled by default. If this option is disabled, the Heimdal Agent will display a pop-up on the end-user endpoint each time a Heimdal Dashboard Administrator tries to collect the Heimdal Logs or the Event Viewer Logs from the endpoint, to confirm that the user allows the Administrator to collect the logs. The Heimdal Support Team also has access to this feature. If the option is enabled, the Heimdal Support Team can collect the information without the confirmation of the user.
Agent uninstall password - allows you to set an uninstall password that will be required when uninstalling the Heimdal Agent from any endpoint that is applying the current Group Policy. It prevents unauthorized users from uninstalling the Heimdal Agent or performing other changes. To uninstall the Heimdal Agent, you can also use the Master Uninstall Password available for each day in the Guide section.
Non-Heimdal device network scanning - allows you to select an endpoint (from the Device Info view) and scan the network for devices/endpoints that are not running the Heimdal Agent. Attention! Enabling this option does not mean the agent will automatically scan for non-Heimdal devices.
Wake on LAN - enables/disables the Wake-on-LAN functionality, which allows the Heimdal Agent to remotely turn on or wake endpoints from a low-power state (e.g., sleep or powered off) via a network message. Wake-on-LAN is not supported if the endpoint is in an IPv6 network, is connected through Wi-Fi, uses a logical adapter for VPN (logical adapters don't have MAC addresses), or uses a docking station.
Communication Settings
Real-time communication - allows the Heimdal Agent to communicate with the Heimdal Dashboard (with a delay of under 1 minute) and apply Server Messages/operations triggered from the Heimdal Dashboard. Some of the operations are: Group Policy update requests, Next-Gen Antivirus on-demand scans, log requests, PEDM elevation notifications, Wake-on-LAN requests, isolation requests, unisolation requests, and scans for non-Heimdal devices.
Collect telemetry data - enhances the data/log collection by installing Sysmon (Microsoft System Monitor) to get more data for incident resolution in the Event Viewer Logs. The Sysmon logs come with a retention time of 30 days. If you are already using Sysmon, we will overwrite your existing configuration; if Sysmon is not installed on your endpoint(s), enabling this feature will install it.
P2P transfer - when active, it allows the Heimdal Agent to share and retrieve 3rd Party Application patches and agent updates within the local network, reducing the reliance on external internet bandwidth for every individual machine.
P2P Port - the port used for P2P transfer. This field is required when P2P transfer is enabled and accepts values between 0 and 65535.
Use P2P Priority Update Server(s) only - forces the Heimdal Agent to retrieve all 3rd-party patches, definition files, and other updates exclusively from your designated Priority Update Server(s) through P2P. Once enabled, any computer marked as Priority Update Server in the Device Info section will be able to serve available patches, definition files, and other updates to computers in the same network. Client machines will first attempt to retrieve updates from these local servers before falling back to the default Heimdal update source.
Keep cached files indefinitely - the cached files (3rd Party Applications or Heimdal Agent versions) will be stored indefinitely on the Priority Update Server, without clearing up the disk space, until they are manually deleted. If this option is disabled, the Priority Update Server will clean up cached files to free disk space.
Endpoint downloading check interval from Priority Update Server(s) - allows you to set the interval (between 120 and 1440 minutes) used by the endpoints to check on the Priority Update Server(s).
P2P Priority Update servers - enables the Enhanced PUS Flow, providing administrators with granular control over the P2P environment. Through a dedicated grid and an "Add priority update server" modal, administrators can explicitly designate specific endpoints as Priority Update Servers and assign them distinct priority levels. You can add a maximum of 10 devices to the grid. Devices under this policy will sequentially attempt to pull software patches and updates from these designated servers based on their assigned priority before falling back to other local P2P peers or the global Heimdal CDN. The priority can be changed by dragging and dropping the servers in the list. Hostname resolution is always prioritized; if the agent cannot resolve the hostnames of the designated Priority Update Servers, it automatically falls back to the Fallback IP configured for each server, respecting the same priority order.
Priority Update Server retries before fallback to the legacy mechanism - a configurable slider (ranging from 1 to 5) that defines the number of connection attempts a client agent should make to a Priority Update Server. If the Priority Update Server is unreachable after the specified number of retries, the agent will automatically fall back to the standard download mechanism to ensure the update is still delivered.
Compliance Settings
Automatically lock session when idle - the endpoint session will automatically lock once the configured idle time is reached. Upon enabling the option, the Idle interval for automatic locking [minutes] slider becomes available, allowing administrators to define the maximum permitted inactivity period before the session is locked. The default timeout is set to 15 minutes and can be adjusted according to organizational security requirements, within a range of 1 to 30 minutes.
Note: Changes to the Automatic Session Locking setting (enablement or disablement) take effect only after a system restart or user sign-out.
Automatically retrieve Event Viewer Security logs - when enabled, the Heimdal Agent retrieves the Security logs from the Windows Event Viewer on a daily basis and stores them for 90 days for compliance and auditing purposes.
Note: Logs are collected automatically every 24 hours, and the retrieval process does not require any user interaction. If a device is offline or unavailable during a scheduled retrieval, the system retrieves the logs retroactively based on the timestamp of the last successful retrieval. This ensures that there are no gaps in log collection.
All retrieved logs are stored and made available for download, with a retention period of 90 days. These logs can be accessed from the Heimdal Dashboard under Unified Management -> Device Info -> select a Windows OS hostname -> UEM -> Logs -> Windows Event Viewer Logs.
Dashboard users can easily distinguish between Full Event Viewer Logs and Security Logs based on the Type specified in the corresponding column.
Note: Manual, specific retrieval of Security logs is not supported. When the feature is enabled, log retrieval is performed exclusively through the automated process. Manual retrieval is available only for Full Event Viewer Logs.
DEVICE INFO NOTIFICATIONS
Device Info Notifications streamlines notification preferences. This feature includes 23 types of notifications, some of which are enabled by default for newly created Group Policies, organized into 4 sections plus a Settings section. Notifications associated with specific products, such as Next-Gen Antivirus, Firewall, or Windows Updates, will be disabled if those products are not activated for the customer or not enabled in the Group Policy.
Note: The Device Info Notifications settings only apply to Heimdal Agent versions 4.5.0 and newer, after the endpoint receives the latest Group Policy.
Agent Status
Alert when CPU usage exceeds the threshold - The notification is triggered when the endpoint's CPU utilization surpasses the value set on the CPU usage threshold [percentage] slider (50–100%). The slider is only active when this alert is enabled.
Alert when Memory usage exceeds the threshold - The notification is triggered when the endpoint's memory utilization surpasses the value set on the Memory usage threshold [percentage] slider (60–100%). The slider is only active when this alert is enabled.
Alert when Disk usage exceeds the threshold - The notification is triggered when the endpoint's disk utilization surpasses the value set on the Disk usage threshold [percentage] slider (60–100%). The slider is only active when this alert is enabled.
Agent self-update - The notification is triggered when the Heimdal Agent on an endpoint has initiated or completed a self-update.
Agent uninstall - The notification is triggered when the Heimdal Agent is uninstalled from the endpoint. The notification persists until the Heimdal Agent is reinstalled and the Heimdal license key is activated.
Machine is assigned as Heimdal Agent deployer - The notification is triggered when the Heimdal Agent on a Deployer has pushed the Heimdal Agent to a different device.
DarkLayer Guard DLL hijacking - The notification is triggered when a Heimdal Agent DLL hijacking attempt is detected.
Digital signature missing on Heimdal services - The notification is triggered when the digital signature for one of the Heimdal services is missing.
Sysmon install error - The notification is triggered when the Sysmon installation fails. This option is only available when at least one feature that deploys Sysmon is enabled in the Group Policy (DNS Security with Improved TTPC accuracy, Collect telemetry data, or the Threat Engine).
DNS Security
DarkLayer Guard Uptime Checker faulted - The notification is triggered when DNS Security is disabled by the DarkLayer Guard Uptime Checker.
DNS Poisoning - The notification is triggered when the endpoint exhibits signs of potential DNS poisoning.
Patch & Assets
Windows Update restart required - The notification is triggered when the endpoint requires a restart to complete the installation of a Windows update.
Windows Update shutdown detected - The notification is triggered when a shutdown or reboot (required to complete a Windows update) is detected.
Windows Update collection empty - The notification is triggered when no Windows updates have been retrieved for more than 20 days.
Windows Update error on fetching available updates - The notification is triggered when a Windows update fails to install.
Endpoint Detection
Next-Gen Antivirus status - The notification is triggered when Next-Gen Antivirus is not operational or missing.
Next-Gen Antivirus incompatibility - The notification is triggered when another antivirus product/service is installed on the endpoint.
Next-Gen Antivirus restart required - The notification is triggered when an endpoint restart is required for Next-Gen Antivirus to initialize.
Next-Gen Antivirus update error - The notification is triggered when Next-Gen Antivirus fails to get updates.
Next-Gen Antivirus real-time engine error - The notification is triggered when the Next-Gen Antivirus real-time engine is not operational.
Firewall status - The notification is triggered when Firewall Management is not operational or missing.
Firewall incompatibility - The notification is triggered when incompatibilities between an AD GPO Firewall configuration and the Heimdal Firewall Management configuration are detected.
Firewall audit breach events not set - The notification is triggered when Brute Force Attack (BFA) subcategory audit events, generated by user account logon attempts on a computer, cannot be intercepted.
Settings
Identical notifications recurrence threshold [days] - Enable this option to prevent repetitive notifications. New notifications of the same type will only be generated once the number of days set on the slider below (1–7 days) has elapsed since the last notification of that type. The slider is only active when this option is enabled.
BITLOCKER MANAGEMENT
BitLocker is a Windows security feature that provides encryption for entire volumes, addressing the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned devices. By enabling BitLocker Management, the Heimdal Agent will control the way BitLocker handles drives on the computers in your organization. The settings are described here.
SCRIPTING
The Scripting functionality provides administrators with the ability to remotely execute PowerShell and Batch scripts on managed Windows endpoints, either immediately (one-time push) or regularly via integration with the Windows Task Scheduler, under the NT Authority\System user. By enabling Scripting, the Heimdal Agent will be able to push on-demand or scheduled scripts to the devices in your organization. The settings are described here.
USB MANAGEMENT
USB Management allows you to control the way the USB ports work inside your company. They can be restricted or allowed, depending on your preferences. By enabling USB Management, the Heimdal Agent will be able to disable or restrict USB devices connected to the devices in your organization. The settings are described here.
SYSTEM RESTORE MANAGEMENT
System Restore Management enables comprehensive control over restore point creation, automation, and disk space allocation on your endpoints. This ensures system stability and provides essential recovery options, such as rolling back from unstable operating system updates.
Note: System Restore Management requires Patch & Assets to be activated. The module can retrieve the applications affected by a restore point only if Patch & Assets is enabled. OS volumes are automatically included in the checkpoint creation process.
System Restore Management - turns the System Restore Management feature ON or OFF.
General Settings
System Restore reporting mode - retrieves existing System Restore checkpoints (if available) without changing the system settings of the endpoint. While this option is enabled, the remaining General Settings below are disabled.
Create restore point before applying Windows updates - creates a restore point before installing available Windows updates. This option requires Operating System Updates to be turned ON and Operating System Updates reporting mode to be turned OFF.
Data volumes - extends System Restore protection beyond the primary operating system drive to include other data volumes on the endpoint.
Assign disk space - the Disk space usage [percentage] slider sets the percentage of disk space (1–100%) that can be used for storing System Restore points on the endpoint, giving you more control over the managed volumes and the space they use.
Automatic restore point creation schedule - configures the Heimdal Agent to automatically create System Restore points on a defined schedule, ensuring regular recovery options are available. This option is only visible in Advanced mode. When enabled, the following schedule settings become available:
- Choose week day - select one or more days of the week (Monday to Sunday). You can optionally limit the schedule to specific weeks of the month; by default, it applies to every week of the month.
- Choose day of month - select one or more days of the month (1 to 31).
- Choose Time Interval [00:00 To Midnight] - set the time window on the selected days using the two-handle slider. The interval must be at least 2 hours long.
- Active during time selection / Inactive during time selection - choose whether restore points are created inside the selected time interval or outside of it.
DNS SECURITY
DNS Security is designed to manage the Heimdal DNS Security - Endpoint engine embedded in the Heimdal Agent. By enabling the DarkLayer Guard engine, the Heimdal Agent will activate the network filter, which protects the computer from infection. The settings are described here.
PATCH & ASSETS
Patch & Assets is structured into 2 modules: 3rd Party Patch Management and Operating System Updates. This Group Policy section is designed to manage the Heimdal Patch & Assets components embedded in the Heimdal Agent.
3RD PARTY PATCH MANAGEMENT
The Patch & Assets - 3rd Party Patch Management module allows users to install or update a specific 3rd Party Application from the list of applications managed by Heimdal. The settings are described here.
OPERATING SYSTEM UPDATES
The Patch & Assets - Operating System Updates module allows the Heimdal Dashboard Administrator(s) to view, download, and deploy available Operating System Updates that are specific to any endpoint in your environment. Heimdal Patch & Assets allows you to select which updates to deploy on the computers applying the current Group Policy, and to delete or hide them. You can also suppress the reboot of the endpoints after the installation completes, or schedule when the endpoints will reboot to complete the installation. The settings are described here.
ENDPOINT DETECTION
Endpoint Detection is structured into 4 modules: Next-Gen Antivirus, Extended Threat Protection, Firewall & RAP, and Ransomware Encryption Protection. This Group Policy section is designed to manage the Heimdal Endpoint Detection components embedded in the Heimdal Agent.
NEXT-GEN ANTIVIRUS
The Endpoint Detection - Next-Gen Antivirus module allows you or your users to perform scans on the endpoints in your environment to keep viruses and other threats away. The settings are described here.
EXTENDED THREAT PROTECTION
Extended Threat Protection (XTP) allows you to collect information about events that occur on computers in your environment, based on rules defined by Heimdal specialists. The settings are described here.
FIREWALL & RAP
The Firewall & RAP (Remote Access Protection) module allows you to control the Windows Firewall from the Heimdal Dashboard. The settings are described here.
RANSOMWARE ENCRYPTION PROTECTION
The Ransomware Encryption Protection module detects processes that perform encryption operations on files on the endpoint with malicious intent. The module processes kernel events for IO reads, writes, directory enumeration, and file execution. Patterns are matched against the collected events after studying the same patterns that are being created by actual ransomware. The engine allows up to 3 files to be encrypted before it flags the process as suspicious. Once flagged, details about the suspicious process are gathered and sent to the Heimdal servers. The settings are described here.
PRIVILEGES & APP CONTROL
Privileges & App Control allows you to control user permissions in your organization and manage elevation and special permissions for applications used on each endpoint. Privileges & App Control is structured into 2 modules: Privileged Access Management and Application Control.
PRIVILEGED ACCESS MANAGEMENT
The Privileged Access Management module allows you to give users the ability to install software they need for a period you select, using the Administrator Session or the Run with Privileged Access Management option for single file elevation. Rights granted can be revoked at any time, and actions are logged for a full audit trail. This is the feature that allows an end-user to request admin privileges over their machine by sending a request to the Heimdal Dashboard System Administrator, who can deny or accept their request. The settings are described here.
APPLICATION CONTROL
The Application Control module allows you to control how processes (and applications) are executed on endpoints inside your organization. You can define a set of rules that describe which processes are allowed or blocked on your machines using details like Software Name, Paths, Publisher, MD5, Signature, or Wildcard Paths. Application Control also controls how a process runs - it can receive automatic elevation from the Heimdal Privileged Access Management module, if configured - and whether the child processes spawned by the process defined in the rule are allowed or blocked. The settings are described here.
REMOTE DESKTOP
By enabling Remote Desktop, the Heimdal Agent will allow you to connect to any of the devices in the organization. The settings are described here.