Help CenterA month or two after completing your ThreatLocker onboarding, it is good practice to review your policy list and remove any duplicate, unwanted, or unused policies. If a policy is not being used, it provides no value to you.
To view which policies are actively being used in your environment, navigate to the Applications > Policies page. From here, you can select the refresh to the right of 'Last Match,' or you can select the 'Update Last Match Date' button located within the Policy Management Menu.
This will update the 'Last Match' column. This process could take up to an hour to complete.
If you have policies that have never been matched or are no longer matched, you can remove them one by one or en masse by leveraging the 'Remove Unused Policies' button. Keeping your policy list short is ideal for maintaining good control over your environment.
Removing Individual Policies
Navigate to the Application Control > Policies page. You can select which policies to be removed by clicking the checkbox to the left of the policy name(s) you wish to remove and then selecting the 'Delete Policy' button. The number of selected policies will appear on the button.
In the screenshot above, you can see this policy doesn't have a 'Last Match,' so it is not being used.
Leveraging the Remove Unused Policies Button
Navigate to the Application Control > Policies page. Select the 'Remove Unused' button at the top of the page in the Policy Management Menu.
A date box will appear. By default, the date is set to one month prior. You can change this date to any date that is more than 30 days in the past. All policies that have NOT been matched since the date you selected will be removed, with a couple of exceptions:
- ThreatLocker's default policies will not be removed using this button.
- Any policies that were created within the time frame you selected will also not be removed.
- No policies set to explicitly deny an application will be removed.
Note: No policies that have been matched since the specified date selection will be removed.
Once you have selected a date, use the dropdown to select whether the Entire Org, Groups, or individual machines will have these policy changes applied.
The checkbox will allow administrators to delete unused policies from the specified organization level, as well as all lower machine/group hierarchy levels (e.g., selecting the checkbox with the Entire Organization option will delete all unused policies in the Entire Org level, as well as all groups and individual machines).
