Understanding Device Control

Last Updated On: 23 Jul 2026|

7 minutes read |

Learn how Device Control discovers devices, distributes policies, enforces access rules, and processes temporary-access requests.

Foundation

Platform support and agent footprint

Review the supported operating systems and the approximate resource use of Device Control agent processes.

Supported operating systems

Device Control supports the following Windows and macOS releases:

Windows: Windows 11, Windows 10, Windows 8.1, Windows 8, and Windows 7.
Windows Server: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2.
macOS: macOS 15 Sequoia, macOS 14 Sonoma, macOS 13 Ventura, macOS 12 Monterey, and macOS 11 Big Sur.

Agent process specifications

Each Device Control function runs through a signed agent process. The following values show the approximate bandwidth, CPU, and memory consumption reported for each process.

Approximate resource consumption of Device Control agent processes.
Agent process	Device name	Digital signature	Bandwidth consumption (~)	CPU consumption (~)	Memory consumption (~)
Device Control Service	uesAgentService.exe	ZOHO Corporation Private Limited	N.A	0 - 0.5%	1 MB
Device Control Policy Processing	dcconfig.exe	ZOHO Corporation Private Limited	5 KB	0 - 1%	6 MB
Device Audit	uesDevCtrlSummary.exe	ZOHO Corporation Private Limited	N.A.	0-3%	6 MB
File Audit Data Populator	uesFaDataPopulator.exe	ZOHO Corporation Private Limited	N.A.	5-10%	12 MB
File Shadow	uesFileShadow.exe	ZOHO Corporation Private Limited	N.A.	0-1.4%	1-1.5 MB
Component Upgrade	dcconfig.exe	ZOHO Corporation Private Limited	7.5 MB	0-1%	1 MB
File Audit	uesFauser.exe	ZOHO Corporation Private Limited	N.A.	0-1%	2 MB

Synchronization

Discover devices and distribute policies

The agent inventories connected devices once and then receives policy changes through immediate delivery or scheduled refreshes.

One-time device scan

After installation, the agent performs a one-time scan to identify connected devices and collect their details. The scan results become available in the web console when collection finishes.

Agent-server policy synchronization

Diagram showing Device Control policy deployment from the server to managed agents

Device Control policy deployment and agent synchronization.

A newly created Device Control policy can reach managed agents through either of the following deployment modes:

Deploy Immediately: The server pushes and applies the policy to agents that are online. For large custom groups with more than 200 machines, the first 200 machines receive it immediately and the remaining machines receive it during the next refresh cycle.
Deploy: The policy waits for the next 90-minute refresh cycle.

Policy edits and deletions, group membership changes, and updates to unmanaged devices synchronize with agents during refresh cycles. When a Distribution Server is present, policies and configurations replicate to it before reaching agents during the same 90-minute cycle.

Enforcement

Apply access rules on endpoints

A kernel-mode driver evaluates device connections, applies authorized access, and resolves overlapping policies by precedence.

Kernel-level policy enforcement

The agent passes the received policy to the dcfafilter kernel-mode driver. This driver watches device connections and permits access only when the deployed policy authorizes the device.

Events for audited and blocked devices are uploaded during the 90-minute refresh cycle.

Diagram showing how the Device Control agent enforces policies on an endpoint

Policy enforcement by the Device Control agent and kernel-mode driver.

Conflict precedence

When more than one policy applies to the same target group, Device Control resolves the conflict in this order, from highest to lowest precedence:

Allow Temporary Access
Allow Trusted Devices
Allow Device Policy
Block Device

Example

For example, if one policy allows removable storage devices and another blocks them, the allow policy takes precedence and the storage device remains usable on the target machine.

Warning

After a Device Control policy is applied successfully, it disables any Secure USB configurations on those machines. Removing the Device Control policy does not restore the earlier Secure USB settings.

Access

Process temporary-access requests

Users can request immediate administrative approval when they need to use an untrusted device.

Request and approval workflow

A user requests access to an untrusted device, and the request is sent to the server immediately.
An administrator approves the request, making the device available to the user immediately.

Temporary-access request flow from the user to the administrator.