FAQ

How fast does the agent pick up a policy change?

The default poll interval is ten minutes, configurable per agent with PolicyPollIntervalSeconds. Lower values are fine in dev if you want changes to land faster while testing; production typically stays at the default. Etag-based conditional GET makes a no-op poll cheap, and the tray’s Refresh policy button triggers an immediate out-of-cycle fetch when a user cannot wait.

What happens to plugged-in devices when policy changes?

On every successful policy fetch the agent runs a reconciliation pass. For any device currently plugged in: if the new policy says block and the agent originally allowed it, it disables. If the new policy says allow and the agent had previously disabled it, it re-enables. No replug needed.

Can users uninstall the agent?

A non-admin user cannot, because the service ACL prevents stopping the service. A local admin with elevated rights can, as with any endpoint agent. Uninstalling automatically decommissions the endpoint in your dashboard, records a security event, and can raise an opt-in Endpoint decommissioned alert, so an unexpected removal is visible rather than silent.

Does the agent send file contents?

No. The agent reports plug and unplug events with device metadata: VID, PID, serial, friendly name and class. It does not read files from the device.

How much data does the agent send?

Roughly one event per plug or unplug at about 1 KB of JSON each, plus one policy poll every ten minutes, most of which are 304s with empty bodies at about 200 bytes. For a typical office desktop with a few plug events a day, daily traffic is well under 100 KB.

What about devices on USB hubs?

Each child device on the hub is enumerated separately and evaluated against the policy independently. The hub itself usually shows up as class USB and is allowed; downstream devices are evaluated normally.

What if a device reports a fake VID or PID?

The agent matches on what Windows sees in PnP, so a device that lies about its VID or PID matches, or fails to match, against the lied-about values. Vendor-name and class fallbacks catch many such cases.

Can I run the dashboard self-hosted?

Not currently. The agent SERVER parameter is configurable, so a self-hosted control plane is technically possible, but we do not ship docs, installer or infrastructure for it.

How does it interact with Windows Defender or EDR?

Cleanly. PermitUSB controls device-level enable and disable while Defender and EDR scan files. They operate at different layers and do not interfere.

What is logged when a device is blocked?

On the agent, an entry in the SQLite event store with a timestamp, the device fingerprint (VID, PID, serial, name, class), the matched rule or default block, and the action taken. The cloud receives the same record, and the tray shows a toast.

How do I export events?

From the Events page, choose Export for CSV or JSON honoring your current filters. For programmatic access the API exposes /api/events with cursor-based pagination.