Self-protection

Enforcement is kernel-mode on current agents: a Microsoft-signed filter driver sits on the USB stack and blocks devices below anything reachable from Device Manager or an elevated PowerShell session. User-mode enforcement runs underneath it as a second layer, backed by the mechanisms below - and is the only layer on endpoints without the driver installed.

Kernel-mode driver

The driver enforces policy from early boot using a locally cached snapshot, before the Windows service starts - there is no window where a blocked device works because the agent hasn't come up yet. Blocking happens on the bus: re-enabling a device in Device Manager doesn't restore access, because the driver denies it beneath that layer. Kernel enforcement is active on any endpoint with the driver installed. A kill switch, per endpoint or workspace-wide, stands the driver down to user-mode enforcement; it takes effect within minutes and survives a restart.

Service ACL

On install, the service security descriptor is set to deny STOP / PAUSE / CHANGE_CONFIG to non-administrators. A regular user can't Stop-Service PermitUSB.Agent from a non-elevated PowerShell.

Watchdog

Every ~30 seconds, the agent walks its known set of disabled USB devices viaWin32_PnPEntity. For each device the agent itself has previously disabled, if it's now enabled, the watchdog re-disables it and emits a watchdog_re_disable tamper event.

The set is only the devices the agent itself disabled. Devices that existed before the agent ever ran (mice, keyboards, internal peripherals) are never touched by the watchdog. This prevents "the agent disabled my mouse" failure modes.

Stale-policy fail-closed

If the agent can't reach the cloud for longer than the configured staleness window (default 7 days), it ignores its cached policy and falls back to default-block. The tray shows "Policy stale" amber. See stale-policy for the full mechanism.

What this catches

  • Casual users running Stop-Service from a normal terminal
  • Admins re-enabling a blocked device via Device Manager (denied at the bus on kernel-enforced endpoints; re-disabled within 30s + tamper logged on user-mode endpoints)
  • Refresh-token replay attempts (caught by the rotation counter; tenant locked + tamper logged)
  • Long offline periods used to "outwait" enforcement (stale-policy default-blocks)
  • Loss of kernel enforcement - if the driver is removed on an endpoint configured for kernel mode, the agent raises an Error-severity security event (event ID 4002)

What it doesn't catch

  • An elevated admin uninstalling the agent and driver entirely. The uninstall automatically decommissions the endpoint, records a security event, and can raise an opt-in "Endpoint decommissioned" alert - an unexpected uninstall is worth investigating.

Tamper events surface in the dashboard on the Events view (filtered to tamper), with severity badges. Configure email / webhook alerts on thewatchdog_re_disable, refresh_token_replay, and policy_stale kinds for proactive notification.