# Understanding Browser Security

A look under the hood at how the browser security agent scans, collects data, and enforces policy across your endpoints.

## Specifications of Agent Processes

The resource footprint of each agent process involved in browser security.

### Agent process resource usage

| Agent Process | Running Application Name | Bandwidth Consumption (Approx.) | CPU Consumption (Approx.) | Memory Consumption (Approx.) |
|---|---|---|---|---|
| Browser agent module | bmagent.exe | 20 KB | 9 - 15% | 20 MB |
| Browser Native Host Application | brnativehost.exe | NA | 0 - 0.5% | 8 MB |
| Component Upgrade | dcconfig.exe | 2.1 MB | 0 - 0.5% | 1 MB |

## Browser Scanning and Data Collection

When scans run, and how long the data they collect is kept.

### Scan timing and retention

Browser scans are conducted following agent onboarding and agent version upgrades. Subsequent scans are not automatic, but can be scheduled daily, weekly, or monthly according to organizational needs.

> **Note:** Web activity data collected during scans is retained for 30 days from the scan's completion.

## Prerequisites

Some browser security features depend on the Browser Security extension being installed; others don't.

### Extension dependency

The Browser Security extension is mandatory on all managed browsers within endpoints to provide comprehensive visibility into web applications and activity. The following functionalities require the extension to be present:

- Download Filter
- Web Filter
- Browser Router
- Web activity tracking

Conversely, the following features do not require the Browser Security extension:

- Add-on Management
- Threat Prevention
- Data Leakage Prevention
- Browser Customization
- Java Manager
- Browser Lockdown
- Web Isolation
- Browser Restriction

For automatic first-party extension installation, open **Browsers → Add-on Settings** and review **Install Browser Security extensions on managed browsers**. Internet/intranet tracking are separate choices. Save and verify the result. For targeted deployment, use the [official installation procedure](https://www.manageengine.com/browser-security/help/installing-extensions-with-browser-security-addon.html).

> **Note:** The Windows message **Command-line that bypass managed extensions is restricted** identifies a browser startup check. It can block a browser started with extension-disabling arguments even when the console shows no deployed browser policies. Changing an extension restriction or browser warning preference does not establish that this separate guard is disabled. See [browser launch-block guidance](https://www.manageengine.com/products/desktop-central/help/browser-security/browser-faq.html).

> **Note:** If an Endpoint Central agent-managed computer is absent from Browsers, check its Browser Security entitlement and applicable Endpoint Security scope. In the selected-computer add-on workflow, open **Admin → Global Settings → Endpoint Security → Manage** and review the computer. Check the Browser Security component state and last contact. Base-agent installation alone does not establish an installed Browser component or inclusion in Browser managed views. After processing scope/component changes, refresh and verify the view. Enrollment does not prove policy enforcement.

## Policy Deployment and Enforcement in Agent

How quickly policies take effect, and how conflicts between policies are resolved.

### To Computers

Associating or removing a policy requests the operation for the target computer. The endpoint must receive and process the command before enforcement changes. Review per-computer status and remarks, then verify browser behavior. Offline devices cannot confirm completion until they reconnect.

### To Groups

Upon association and deployment of a policy to a custom group, it's immediately applied to all currently online agent machines in that group. For large custom groups exceeding 100 machines, the policy is initially applied to a subset of 100 machines, with the remaining machines receiving it during the next refresh cycle.

### Browser Security Policy Conflict Precedence

When multiple policies of the same feature (for example, Web Filter) are deployed to a single endpoint, the most recently deployed policy is enforced.

> **Insight:** For example, if two Web Filter policies are deployed — one blocking access to google.com and the other permitting it — the policy deployed most recently determines the effective access control.

After publishing a policy modification, check **Yet to update computers** in Summary. Use **Update Policy** where available and confirm the update. Review per-computer status and browser behavior. Publication alone does not prove that every associated computer received the version.

> **Note:** For a Windows Bookmark Manager payload, separate overlapping policies do not concatenate their bookmark lists. Put bookmarks that must coexist into one policy and verify its deployed collection. Add-on Management also selects the retained collection for each applicable add-on payload; do not assume that selected extension lists from different policies are merged.

> **Note:** The Windows Browser Restriction enforcement path can create AppLocker rules with the `MEBSPAPPLOCKER` identifier. This differs from the managed-extension command-line launch guard. If another product also controls AppLocker, provide the effective rules and policy status to support before changing either policy set. See [Browser Restriction](https://www.manageengine.com/products/desktop-central/help/browser-security/browser-restriction.html).

## Related

- [Browser Security Overview](https://www.manageengine.com/products/desktop-central/help/browser-security/browser-overview.html)
- [Browser Security FAQ](https://www.manageengine.com/products/desktop-central/help/browser-security/browser-faq.html)