Endpoint groups

Why groups

Different teams need different policies. Engineering might allow approved thumb drives, the lobby kiosk should be HID-only, the warehouse scanners need only their scanner. Groups let you set those independently without duplicating a policy.

Per-group policy and discovery

Each group has at most one assigned policy, and a group with none falls back to your workspace default policy. Each group also has an optional discovery_mode_until field. While it is set in the future, every rule action served to that group is coerced to audit.

Default group

Each workspace has exactly one default group, created during bootstrap. Newly enrolled endpoints land there unless their install command specified a different group.

Pre-assigning a group at install

Pass ENDPOINT_GROUP to msiexec with the name of the group the new endpoint should join:

Names are matched case-insensitively and trimmed of surrounding whitespace, so "Information Technology" and "information technology" resolve to the same group. Quote values containing spaces. An unrecognized name soft-falls back to the workspace default with a warning logged cloud-side, so a typo in a deployment script never blocks enrollment.

Moving endpoints

Two ways, and they reconcile automatically.

From the dashboard

On the Endpoints page, change a row’s group with the per-row picker, or select several rows and bulk-move them from the action bar. The agent picks up the new group’s policy on its next poll and syncs the new group name back into its local agent.json so the two stay in agreement.

From the endpoint

Edit %ProgramData%\PermitUSB\agent.json as Administrator, set the EndpointGroup field to the new name, and restart the PermitUSB.Agent service. The agent re-asserts on every service start, so this moves the endpoint immediately. Useful for a site-side admin re-homing a machine without dashboard access.