Policies are collections of settings that you create, configure, and apply, then enforce. Most policy settings correspond to settings that you configure in the Trellix Endpoint Security (ENS) Client. Other policy settings are the primary interface for configuring the software.
Policy enforcement ensures consistent security configurations across the environment, preventing unauthorized changes and maintaining a secure endpoint posture. Policy enforcement is enabled by default, and is inherited in the System Tree, but you can manually enable or disable enforcement on specified systems by adjusting the Enforcement status to Enforcing or Not enforcing.
Policy Categories
Your managed product adds these categories to the Policy Catalog. The available settings vary in each category.
Firewall categories
Category | Description |
|---|---|
Options | Specifies options for the Firewall, including:
|
Rules | Specifies firewall rules, and groups of rules, that define what traffic is allowed and what is blocked. When DNS blocking is enabled in Options, this policy dynamically adds a rule near the top of the firewall rules list. This rule prevents resolving the IP address of the specified domain. |
Customizing policies (ePO - On-prem)
Each policy category includes default policies.
You can use default policies as is, edit the My Default default policies, or create policies.
Policy | Description | Management platform |
|---|---|---|
Trellix Default | Defines the default policy that takes effect if no other policy is applied. You can duplicate, but not delete or change, this policy. | All |
Trellix Default Server | Defines the default server Rules policy, which allows all server default services, such as Windows AD Authentication, Web/FTP, and mail servers, to accept client service requests. You can duplicate, but not delete or change, this policy. | All |
My Default | Defines default settings for the category. | ePO - On-prem |
User-based policies (ePO - On-prem)
User-based policies (UBP) enable policies to be defined and enforced using ePO - On-prem policy assignment rules with an LDAP server. These assignment rules are enforced on the client system for the user at log-on, regardless of the ePO - On-prem group.
User-based policies are enforced when a user with a matching assignment rule logs on to the client system on the console. System-based policies (SBP) are enforced when two or more users are logged on to a system. Policy assignment rules take precedence over policies defined in the System Tree.
The user policy supersedes the system policy. All system policies apply and any user-based policy overrides the system policy.
Policy assignment rules are enforced only if the user logs on as the interactive user. The system policy, rather than the user policy, is enforced if the user logs on:
With a runas command
To a remote desktop or terminal service where the user's logon is not set to interactive
For more information about user-based policies and policy assignment rules, see the ePO - On-prem Help.
Comparing policies
You can compare all policy settings for the module using the Policy Comparison feature in ePO - On-prem. For information, see the ePO - On-prem Help.
For information about policies and the Policy Catalog, see the ePO - On-prem documentation.