Top-tier shields - tamper protection, ransomware storm detection, signed offline policy cache, per-app time budgets, screen-time report card, disk / SMART early warning, webcam-mic notifier, config value signing, protection service recovery and approved agent updates.
12 features
Watches Documents, Desktop, Pictures, Videos, Music and Downloads for bulk-rename storms. Triggers when more than 20 files are renamed within 5 seconds in a single folder - kills the offending process, restores original filenames from a rolling shadow journal, and logs the incident. Honey-file canaries detect ransomware-style scans before user files are touched.
Detects bulk extension swaps (e.g. .docx → .locked, .jpg → .enc) on user document folders. Same 20-in-5-seconds threshold as mass rename, with extension-class heuristics for the canonical ransomware suffix list (.locked, .enc, .crypt, .crypted, .pay, .ransom, .888, etc.). Process killed, files restored from journal, incident logged.
A layered ransomware shield: decoy files that trip an alarm when encrypted, protection for Windows backup snapshots, detection of known ransomware programs and startup tampering, and detection of dropped ransom notes. It automatically quarantines the offending program and records the incident.
Authenticated cached restrictions stay enforced on the device during connection outages. Going offline does not by itself disable or degrade a device; policy integrity, licence expiry and endpoint isolation are checked separately.
Set daily time limits and optional time-of-day windows for individual apps (for example, 30 minutes a day of a game, only between 4-6pm). Tracked per user and kept across reboots.
End-user-visible daily summary fired as a tray balloon at 18:00 local. Shows top apps + total active minutes for the day so the user sees what was tracked. No cloud round-trip required.
SYSTEM-only background probe runs every 5 min. Surfaces low-disk and predictive SMART failure attributes long before Windows itself notices, so a failing drive becomes a heartbeat alert instead of a Monday-morning crash.
User-session GUI polls the Capability Access Manager every 5s and flashes a tray balloon when a new app starts using the webcam or mic. Catches apps that bypass the indicator LED on cheaper laptops.
The four guarded configuration values (Server URL, Account Username, Account Password Hash, Launch Password Hash) carry an HMAC-SHA256 sibling signature. Tampering with a value without resigning is detected and reverted on the next agent tick.
CtrlOne runs as one protection service, CtrlOneProtectionService, with Windows Service Control Manager recovery to restart it after a failure. The service supervises its per-session helpers, such as the agent GUI, and records unexpected stops in the audit trail. There is no separate paired service.
The agent checks for a newer build, downloads it, verifies it and applies the approved update in place. Verification and recovery outcomes are recorded so operators can see which devices converged on the new build and which need attention. Updates follow approval and do not bypass verification.
Before restarting the desktop to apply restrictions, the agent checks that it can safely do so. If the check fails three times it leaves the desktop running untouched, so tightly locked-down PCs never end up with a blank screen.