Tray app
The PermitUSB tray app runs in every signed-in user's session. It exists to make enforcement transparent: when a device is blocked, the user sees why, immediately.
What it shows
- A tray icon, with a tooltip summarising current state
- A toast when a device is blocked: device name + matched rule
- A status window with the current state, policy and kernel details, and the most recent events on that machine
The icon itself is the same in every state - the tooltip is what differentiates them, so hovering always gives you the current answer without a colour to interpret.
States
| State | Meaning |
|---|---|
| Healthy | Policy active; enforcement live. |
| Stale | Hasn't reached the cloud recently. Default-block in effect. |
| Tamper | Refresh-token replay or service-stop attempt detected. Re-enrollment needed. |
| Trial expired | Billing lapsed. Enforcement disabled. Add a card to resume. |
| Discovery mode | Devices allowed and logged, not blocked, while the window is open. |
| Protection paused | A user paused enforcement on this machine. Devices are still recorded. |
Pausing protection
If the endpoint's group allows it, the tray menu offers Pause protection for 5, 15, 30 or 60 minutes. The user picks a duration and types a reason, both of which are recorded and alerted on. Protection resumes automatically when the window ends, and anything plugged in during it is re-checked at that moment - so a device admitted during a pause does not keep working afterwards. A restart also ends a pause, and the user can end one early with Resume protection now.
Self-service pause is off by default. Turn it on per endpoint group.
How it talks to the service
Named pipe \\.\pipe\PermitUSB.Agent. The pipe ACL allows LocalSystem + Administrators full access and Interactive Users read+write. The tray polls the pipe for a status snapshot - small enough that the polling cost is invisible.
The tray asks; it never decides. A pause request, for example, is re-checked by the privileged service against live policy before anything happens - the tray runs in the user's session and is not trusted for enforcement decisions.
Disabling the tray
The tray is registered as a per-user run-key by the MSI. To suppress it, removeHKLM\Software\Microsoft\Windows\CurrentVersion\Run\PermitUSB.Tray. Enforcement keeps working - only the user-facing affordance disappears. We don't recommend this for end-user machines (transparency is the whole point), but it's a reasonable choice for kiosks where a tray icon would be confusing.