Configuration Drift Prevention

Desktops can drift out of compliance for various reasons, including employee-assigned account privileges, operating system and application updates, and untimely policy rollouts by endpoint management platforms.

• Scan and remediate misconfigurations: To minimize exposure and reduce the attack surface, scan and remediate operating system security settings and configurations across your Windows devices.
• Versatile security settings: Audit for Windows account privileges and permissions, check for device hardening settings, including BitLocker configuration, and test for web protection and block policies.
• Detailed insights: Provides classification of misconfiguration based on severity, remediation status, descriptions of misconfiguration, devices affected and when the misconfiguration was first seen.

Scan for a wide variety of third-party cybersecurity tools and get security software asset management information across your Windows devices.

• Scan for security controls: Scan and report issues related to whether or not endpoint security software is installed on your devices and remediate to bring those devices into compliance.
• Cybersecurity tools asset management: Improve your security posture by tracking installed endpoint security software inventory, including version and install date information and service running state information.
• Wide out-of-the-box variety of tools: Report on a wide range of cybersecurity tool vendors and their endpoint security products, including antivirus, antimalware, VPN, EDR, XDR, DLP, and UEM software.

Using advanced automation capabilities, ControlUp can continuously remediate security issues without human interaction. If needed, issues can also be addressed manually, in real-time, at any time.

• Granular targeting for mass-healing: Select all devices or target specific device groups and individual devices for template-based, automated, or individual issue, manual remediation.
• Configurable frequency: For template-based scanning and remediation, customized schedule frequency can be configured as often as needed to meet your compliance standards.
• Reboot and end user notification: Endpoints can be automatically rebooted after remediation and users can be notified with customizable messages before system scans or reboots take place.

Out-of-the-box, ControlUp comes with a variety of prebuilt scans and remediations for common Windows security misconfigurations and compliance checks, but it’s easy to add your own.

• Built-in catalog: Secure DX provides more than 50 built-in scans to audits configuration settings, such as account privileges and permissions, web protection policies, and device hardening settings.
• Custom scans and remediation: If your environment needs a security check that is not included in our catalog, you can add custom script-supported scans and remediations to extend the platform.
• Custom remediation for built-in scans: For built-in security scans that come without a built-in remediation, you can add your own custom remediation and validation scripts to the platform