File Access Control- Policies
File Access Control governs who can read, write, or change specific files, folders, and registry keys on your endpoints. A policy is a list of access actions, each granting or revoking permissions on one target.
Edition & permission
Device Control is EndpointOps edition. You need View File Access Control permission.
How to get here
- In the left sidebar, click Device Control.
- Click the File Access Control card.
Navigate to: Device Control → File Access Control → Policies
URL path: /device-control/file-access-control-settings/policies
The Policies screen
| Column | What it shows |
|---|---|
| Name | The policy name. |
| Description | What it's for. |
| Configuration Level | Computer or User. |
| Actions Count | How many access actions the policy carries. |
| Created Time | When it was created. |
Create adds a policy; rows have Edit and Delete.
How do I create a policy?
Click Create. The form opens in a drawer.
| Field | Required | Notes |
|---|---|---|
| Name | Yes | The policy name. |
| Configuration Level | Yes | Computer or User. |
| Description | No | What it's for. |
| Actions | Yes | One or more access actions- click Add Access Control Action. |
| Apply On Startup / User Login | No | When the policy takes effect (label follows the level). |
Each action targets a File, Folder, or Registry key:
- File / Folder- the Path, the User/Group it applies to, an Action (Append / Overwrite / Revoke), an Inheritance scope, and a permissions table (Allow/Deny Read, Write, Execute, Modify, Full Control).
- Registry- the Hive Key (HKLM, HKCU, etc.) and Key path, the User/Group, the Action, a registry Inheritance scope, and a permissions table (Allow/Deny Read, Full Control).
Save to add the policy, then deploy it.
Related
- Deployments- push a policy to endpoints.