SafeConsole PortBlocker

USB Access Control and Data Loss Prevention (DLP)

Enables control of USB port access across endpoints in government and enterprise environments by acting as a desktop agent that blocks unauthorized USB Mass Storage Devices. Prevents unauthorized data transfers, leaks, and accidental file loss by ensuring only approved devices can connect, thereby strengthening endpoint and network security. Automatically blocks unauthorized or unapproved USB devices as soon as they are inserted to shield systems from malware, intrusions, breaches, and data leaks. Enables administrators to define distinct access control states, including blocking all mass storage devices by default upon installation until registered or whitelisted, whitelisting specific devices to allow access while blocking others, disabling blocking entirely to allow all mass storage devices to connect without restrictions, suspending all device access control when necessary, or resetting the system to a default state. Enforces flexible read-only access configurations for specific USB ports, unlisted devices, or all mass storage devices, allowing secure file transfers while preventing data writes, modifications, and unauthorized transfers.

Granular Device Whitelisting and Policy Management

Allows administrators to whitelist approved USB devices based on hardware IDs (VID, PID, and serial number) for specific users, groups, or globally, with options to grant temporary, time-limited, or permanent access. Provides unique policy configuration options, visible in SafeConsole only when the PortBlocker endpoint selector is active, supports importing and approving SafeConsoleReady devices, and permits serial numbers containing spaces in policy configurations to improve hardware compatibility. Controls the maximum number of device list items displayed in PortBlocker policy via server settings, allows user roles with disabled "Read server properties" permissions (such as Support) to view the PortBlocker device list in policy settings, and ensures whitelist policies are updated and enforced in real-time across endpoints so only currently approved devices can connect.

Real-Time Monitoring, Audit Logging, and Event Reporting

Monitors all USB ports and device activity in real-time to instantly detect and block unapproved devices, generating detailed audit logs and event tracking inside SafeConsole to support forensic analysis, compliance, and security posture assessments. Logs all blocking events, connected USB devices, and blocked connection attempts, including assigning a unique serial number to each endpoint, utilizing unique workstation names for tracking PortBlocker endpoints, and recording additions or modifications to custom entries in server logs. Supports exporting endpoint data in XML or CSV formats to generate comprehensive reports containing computer names, assigned users, software versions, and other tracking data. Displays a dedicated, structured report section within Audit Logs detailing all connected USB devices across the network (visible when licensed and appropriate administrator permissions are met), enables a silent audit mode, detects and logs suspiciously recurrent events (pb_repeat_event), records system resets as "PortBlocker Reset", logs active states as "PortBlocker Active", and sends immediate notifications to administrators whenever an unapproved USB device is inserted or blocked.

Centralized Management via SafeConsole Platform

Integrates with SafeConsole to centrally manage PortBlocker endpoints using a configurable connection URL, ensuring consistent security management and seamless support for existing SafeConsole policies, secure USB management, and anti-malware modules. Enables per-endpoint management, tracking, and custom policy assignment directly to individual PortBlocker computers via the Endpoint Details popup, including registering installations to specific, existing users during installation using a unique token or the optional USER parameter. Dynamically synchronizes PortBlocker IDs to workstation names for streamlined endpoint identification, and filters which policies are displayed based on the managed endpoint software and host operating system (Windows or macOS). Allows administrators to adjust policy groups directly within the management interface for faster provisioning, supports custom configurations for the interval (in minutes) between PortBlocker server policy refreshes, offers a larger policy capacity for system scalability, provides a simplified policy table view that hides PortBlocker columns by default unless enabled via Options settings, and offers a server setting to release inactive PortBlocker seats in bulk for efficient license management.

Enterprise Mass Deployment and Automated Installation

Supports mass deployment, silent installation, automated policy triggers, and unattended upgrades across enterprise environments. Provides an MSI installer package for Windows (deploying a device driver, a Windows service, and a user-facing desktop application) and a native PKG installer for macOS, enabling automated deployment via Microsoft Group Policy Objects (GPO), PDQ Deploy, PowerShell scripting, and Jamf Pro or Jamf School (providing a signed PBInstaller.mobileconfig file for macOS enrollment). Registers PortBlocker automatically with a SafeConsole server during installation (logged as "PortBlocker Registered") using a connection token URL, and supports mass deployment settings scripting utilizing the com.safeconsole.massdeploy configuration domain to store the connection URL, auto-accept the EULA via EULA=1 configuration, and run under the local system account to avoid UAC prompts. Controls the post-installation client launch via the LAUNCH_CLIENT parameter (setting to 0) to prevent unresponsive background processes, applies predefined policies to endpoints at installation using policy tokens, and triggers deployment policies via login events, recurring check-ins, or manual administrator-defined triggers.