Tray app
The tray app runs in every signed-in user’s session. It exists to make enforcement transparent: when a device is blocked, the user sees why, immediately.
What it shows
- A tray icon with a tooltip summarizing the current state
- A toast when a device is blocked, naming the device and the matched rule
- A status window with current state, policy and kernel details, and the most recent events on that machine
States
| State | Meaning |
|---|---|
| Healthy | Policy active, enforcement live. |
| Stale | Has not reached the cloud recently. Default-block in effect. |
| Tamper | Refresh-token replay or service-stop attempt detected. Re-enrollment needed. |
| Trial expired | Billing lapsed. Enforcement disabled. Add a card to resume. |
| Discovery mode | Devices allowed and logged, not blocked, while the window is open. |
| Protection paused | A user paused enforcement on this machine. Devices are still recorded. |
Pausing protection
If the endpoint’s group allows it, the tray menu offers Pause protection for 5, 15, 30 or 60 minutes. The user picks a duration and types a reason, both recorded and alerted on. Protection resumes automatically when the window ends, and anything plugged in during it is re-checked at that moment, so a device admitted during a pause does not keep working afterwards. A restart also ends a pause, and the user can end one early with Resume protection now.
How it talks to the service
Over the named pipe \\.\pipe\PermitUSB.Agent. The pipe ACL allows LocalSystem and Administrators full access, and interactive users read and write. The tray polls the pipe for a status snapshot, small enough that the polling cost is invisible.
The tray asks; it never decides. A pause request is re-checked by the privileged service against live policy before anything happens, because the tray runs in the user’s session and is not trusted for enforcement decisions.
Disabling the tray
The MSI registers the tray as a per-user run key. To suppress it, remove HKLM\Software\Microsoft\Windows\CurrentVersion\Run\PermitUSB.Tray. Enforcement keeps working and only the user-facing affordance disappears. We do not recommend this on end-user machines, since transparency is the whole point, but it is reasonable for kiosks where a tray icon would confuse.
Something missing or wrong here? Tell us. Documentation gaps get filled fast.