CPA Compliance Mode Configuration Window

All options required to achieve CPA compliance are set for Computers and Users/Groups in your environment.

At least one option required to achieve CPA compliance is not set for Computers or Users/Groups in your environment. You will be in this mode when preparing to enable full compliance (for example, ensuring that settings do not disrupt the functioning of endpoints).

You are not enforcing CPA compliance requirements in your environment.

Select to start enforcing the option settings required for CPA compliance in your environment. You will be unable to change option settings required for compliance in ToolsDefault Options, with the exception of Client Hardening (to Extended) and Execution Log (to Log Access Denied).

Important: Test the required option settings in your environment before applying CPA compliance mode.

Select to block the execution of unauthorized executable files.

Select to prevent users from locally authorizing files to execute.

Select to prevent users with administrative privileges from uninstalling the Ivanti Device and Application Control agent, as well as deleting local shadow files and log entries. You can remain CPA compliant by setting the more restrictive Extended option (valid salt value required to deactivate the agent) in Tools > Default Options > Computer tab.

Select to log every application-related execution event. The volume of logged events produced by this CPA Software Execution Control characteristic can overwhelm your database in very large deployments. You can, with the approval of your company’s certification authority, change this logging option to the less detailed Log Access Denied in Tools > Default Options > Computer tab. You will remain CPA compliant and reduce the logged events to only those applications which are blocked; please be aware you are no longer capturing the allowed application executions.

Select to block the execution of all unauthorized executable files.

Select to log every application-related execution event. The volume of logged events produced by this CPA Software Execution Control characteristic can overwhelm your database in very large deployments. You can, with the approval of your company’s certification authority, change this logging option to the less detailed Log Access Denied in Tools > Default Options > Computer tab. You will remain CPA compliant and reduce the logged events to only those applications which are blocked; please be aware you are no longer capturing the allowed application executions.

Select to prevent all VBScripts, JScript, or macros not centrally authorized from running.

Select to log every denied macro and script execution access event.

Select to block without delay the running of unauthorized logon scripts.