Isolate/Lockdown/Screen Lock Selected Computer(s)

ThreatLocker administrators are able to use Isolate, Lockdown, and Screen Lock options from the Devices page within the ThreatLocker Portal.

This feature requires ThreatLocker Agent Version 8.2 or greater. The organization where the selected computer exists must also have ThreatLocker Detect enabled as a product.

How to Isolate or Lockdown a Selected Computer

1. Navigate to the Devices page in the ThreatLocker Portal.
2. Click on the computer you wish to enable Isolation Mode or Lockdown Mode on.
3. In the pop-up window, select the ThreatLocker Detect tab.
4. Click either the "Isolate" or "Lockdown" button in the top right corner.

Selecting the Desired Effect

• Isolation Mode: The selected computer will be isolated from all inbound and outbound network traffic besides network traffic to and from the ThreatLocker Portal or through the ThreatLocker API. 

1. 1. Click on "Isolate" as shown below.
   2. A new textbox will appear. Enter the notes/reasoning for putting the computer in Isolation Mode.
   3. Click the "Isolate" button.

• Once Isolation Mode is selected, "Isolation Mode" will be displayed under the Hostname on the Devices page as shown below.

• Lockdown Mode: The selected computer will be locked down. All inbound and outbound network traffic, reads and writes in monitored locations, and executions except network traffic to and from the ThreatLocker Portal or through the ThreatLocker API and vital Windows functions will be blocked.

1. 1. Click on "Lockdown" as shown below.
   2. A new textbox will appear. Enter the notes/reasoning for putting the computer in Lockdown Mode.
   3. Click the "Lockdown" button.

• Once Lockdown Mode is selected, "Lockdown Mode" will be displayed under the Hostname on the Devices page. 

Removing Isolation or Lockdown

To remove either Isolation Mode or Lockdown Mode, navigate to the ThreatLocker Detect tab and select either the "Remove Isolate" or "Remove Lockdown" button. For this example, Lockdown Mode will be removed.

1. Click on either "Remove Isolate" or "Remove Lockdown" as shown below.
2. A new textbox will appear. Enter the notes/reasoning for clearing the computer, i.e., removing Isolation Mode or Lockdown Mode.
3. Click the "Remove Isolate" or "Remove Lockdown" button.

How to Screen Lock a Computer

1. Navigate to the Devices page in the ThreatLocker Portal.
2. Select the checkbox next to the desired computer(s).
3. Choose the "Screen Lock Computer" button at the top of the screen.
4. Select "Yes" on the popup to confirm you would like to apply the change to the selected computer(s).  The selected computer(s) will have their screen(s) locked, and the user will have to provide credentials to unlock the computer screen.