Device control enabled without license

Elastic Security
1

My stack is running on 9.4.3. It was a fresh install to that version. I have created a fleet policy with Elastic Defend. Where device control would be, I have this warning

Device Control

Upgrade to Elastic Enterprise

To turn on this protection, you must upgrade your license to Enterprise, start a free 30-day trial, or spin up a cloud deployment(external, opens in a new tab or window) on AWS, GCP, or Azure.

That is fine as I don't have an enterprise license. In dev tools, when I run

GET kbn:/api/fleet/package_policies/

"device_control": {
"enabled": true,
"usb_storage": "deny_all"
},

On all OS sections, that is enabled. I have tried creating a new fleet policy and it does the same thing. Through the policy, I am not able to untoggle device control. How do i turn it off via dev tools or other methods? Did I configure something in fleet to make this happen?

2

Hi,
Thanks for flagging this!

You're right that this isn't expected behavior, on a Platinum license, Device Control should be off by default. We've confirmed this is a bug and a fix is in progress. We'll follow up in this thread once it's merged so you know which release it lands in.

Workaround in the meantime
Create the Elastic Defend integration using the Data Collection preset. Policies created this way have Device Control disabled by default. A couple of things to be aware of:

  • Data Collection is a telemetry-only preset, so it also starts with the endpoint protections (malware, ransomware, memory, behavior) turned off. It collects events (process, file, network, DNS, etc.) but does not actively protect the host out of the box.
  • After creating the policy, you can turn the protections you want back on from the policy settings. Device Control will remain off, on a Platinum license the toggle stays locked, so enabling other protections won't bring it back.

This lets you run a policy with the protections you need while keeping Device Control disabled until the fix ships. Please let us know if you run into any issues with the above, and we'll update here when the fix is merged.

3

That's expected with a Basic license. The device_control section may still appear in the policy, but it isn't enforced without an Enterprise license. If the UI won't let you disable it, it's safe to ignore, or check if a newer Elastic Defend integration version fixes the policy template behavior.

4

When I plugged a USB stick in, it complained that a local group policy was restricting it. I installed the new policy the way Konrad_Szwarc said and now I am able to use a usb stick.