Set up team policies and the audit log
Apply admin-signed policies that devices enforce locally: switch features off, limit files, protect the clipboard, allow LAN only.
Organisations can manage devices without accounts or a cloud console. An administrator signs a policy with a private admin key; each device checks the signature and enforces the policy itself.
Steps
Create an admin key (administrator)
On the administrator’s PC run
pdb team init. Keep the key file private.Write and sign a policy
Describe the rules in a JSON file, then sign it with
pdb team sign policy.json --org "Your company". This createsteam-policy.json.Enroll each device
On each PC open Settings › Security & organisation › Organisation › Team enrollment. Enter the organisation name and the Admin key, then click Enroll.
Apply the policy
Click Apply policy file… and choose
team-policy.json, or runpdb team apply team-policy.json.pdb policyshows what is in force.
What a policy can do
- Switch individual features off.
- Block file types or set a maximum file size.
- Keep resident registration and card numbers out of the clipboard.
- Allow the local network only, with no internet connections.
- Require the audit log.
Audit log
Audit log records what each device did in a chain of hashes, so later changes are detectable. Verify integrity (or pdb audit --verify) checks the chain. There are no accounts, SSO or cloud console by design.