# Device control enabled without license
**URL:** https://discuss.elastic.co/t/device-control-enabled-without-license/388399
**Category:** Elastic Security
**Created:** [July 17, 2026, 2:29pm UTC](https://discuss.elastic.co/t/device-control-enabled-without-license/388399 "2026-07-17T14:29:27Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jumpingrock](https://discuss.elastic.co/u/jumpingrock)
#### Post date: [July 17, 2026, 2:29pm UTC](https://discuss.elastic.co/t/device-control-enabled-without-license/388399/1 "2026-07-17T14:29:27Z")
My stack is running on 9.4.3. It was a fresh install to that version. I have created a fleet policy with Elastic Defend. Where device control would be, I have this warning
> ### **Device Control**
>
> #### **Upgrade to Elastic Enterprise**
>
> To turn on this protection, you must upgrade your license to Enterprise, start a free 30-day trial, or spin up a [cloud deployment(external, opens in a new tab or window)](https://www.elastic.co/cloud/) on AWS, GCP, or Azure.
That is fine as I don't have an enterprise license. In dev tools, when I run
> GET kbn:/api/fleet/package\_policies/
>
> "device\_control": {
> "enabled": true,
> "usb\_storage": "deny\_all"
> },
On all OS sections, that is enabled. I have tried creating a new fleet policy and it does the same thing. Through the policy, I am not able to untoggle device control. How do i turn it off via dev tools or other methods? Did I configure something in fleet to make this happen?
---
### Author:  [@Konrad\_Szwarc](https://discuss.elastic.co/u/Konrad_Szwarc)
#### Post date: [July 17, 2026, 8:16pm UTC](https://discuss.elastic.co/t/device-control-enabled-without-license/388399/2 "2026-07-17T20:16:41Z")
Hi,
Thanks for flagging this!
You're right that this isn't expected behavior, on a Platinum license, Device Control should be off by default. We've confirmed this is a bug and a fix is in progress. We'll follow up in this thread once it's merged so you know which release it lands in.
**Workaround in the meantime**
Create the Elastic Defend integration using the **Data Collection** preset. Policies created this way have Device Control disabled by default. A couple of things to be aware of:
- Data Collection is a telemetry-only preset, so it also starts with the endpoint _protections_ (malware, ransomware, memory, behavior) turned **off**. It collects events (process, file, network, DNS, etc.) but does not actively protect the host out of the box.
- After creating the policy, you can turn the protections you want back on from the policy settings. Device Control will remain off, on a Platinum license the toggle stays locked, so enabling other protections won't bring it back.
This lets you run a policy with the protections you need while keeping Device Control disabled until the fix ships. Please let us know if you run into any issues with the above, and we'll update here when the fix is merged.
---
### Author:  [@davidwarner44](https://discuss.elastic.co/u/davidwarner44)
#### Post date: [July 18, 2026, 7:23am UTC](https://discuss.elastic.co/t/device-control-enabled-without-license/388399/3 "2026-07-18T07:23:39Z")
That's expected with a Basic license. The `device_control` section may still appear in the policy, but it isn't enforced without an Enterprise license. If the UI won't let you disable it, it's safe to ignore, or check if a newer Elastic Defend integration version fixes the policy template behavior.
---
### Author:  [@jumpingrock](https://discuss.elastic.co/u/jumpingrock)
#### Post date: [July 18, 2026, 11:48am UTC](https://discuss.elastic.co/t/device-control-enabled-without-license/388399/4 "2026-07-18T11:48:54Z")
When I plugged a USB stick in, it complained that a local group policy was restricting it. I installed the new policy the way Konrad\_Szwarc said and now I am able to use a usb stick.
---
### Author:  [@Konrad\_Szwarc](https://discuss.elastic.co/u/Konrad_Szwarc)
#### Post date: [August 19, 2026, 4:40pm UTC](https://discuss.elastic.co/t/device-control-enabled-without-license/388399/5 "2026-08-19T16:40:30Z")
The issue was addressed in [this PR](https://github.com/elastic/kibana/pull/282133) and is scheduled to be released in `9.5.2` and `9.4.6` versions.