Restrictions

223 individual lockdown toggles across 16 protection surfaces. Each restriction has an on/off state visible in the CtrlOne policy panel.

Basic Protection

15 restrictions - Day-one defaults that block the obvious holes - Registry Editor, Control Panel, Windows Update, shortcuts.

Advanced Protection

39 restrictions - Deep-system controls for hardened fleets: Group Policy, Task Manager, Defender, services, drivers and more.

Desktop Protection

17 restrictions - Lock down what users can do on the desktop - wallpaper, icons, themes, right-click and personalisation.

USB Protection

6 restrictions - USB storage control - mass-storage off / read-only / block, MTP/PTP phone blocking, and a password-controlled unlock per drive insertion, plus per-class policy where the device class and Windows build support it.

Software Block Protection

14 restrictions - Block specific apps, installers, file types and tools from launching on the PC by name and signature.

Control Panel Protection

38 restrictions - Hide individual Control Panel applets so users see what they need. Hiding an applet is not the same as preventing every way of launching it.

Browser Protection

13 restrictions - Browser-engine-level controls (Chrome, Edge, Firefox) - Incognito, Extensions, DevTools, downloads.

Start Menu Protection

4 restrictions - Trim the Start menu - Run, Search, Power, recent items - for kiosk and shared-PC scenarios.

Function Keys Protection

12 restrictions - Disable F1-F12 system shortcuts and the function-key combos that bypass restrictions.

Hot Keys

6 restrictions - Session input guards that swallow Win-key and Ctrl/Alt combos so they can't be used to escape lockdown (a per-session keyboard hook, not a kernel driver).

Attachment Block Protection

14 restrictions - Stop risky email attachments and downloaded executables from running on protected machines.

Premium Protection

12 restrictions - Top-tier shields - tamper protection, ransomware storm detection, signed offline policy cache, per-app time budgets, screen-time report card, disk / SMART early warning, webcam-mic notifier, config value signing, protection service recovery and approved agent updates.

Browser Hardening

10 restrictions - Harden Chrome, Edge and Firefox - turn off saved passwords, autofill, sync, history and the first-run import wizard.

Content Filter

12 restrictions - Category-based website blocking - adult, gambling, drugs, piracy, social, streaming, gaming and more, applied system-wide.