Configuration Drift Prevention

Drift Detected. Baseline Restored.

Keep every Windows and macOS endpoint aligned to your security standards. ControlUp detects drift and restores the right configuration automatically.

Try for Free Get a Demo

Consistent Security Across Every Endpoint

Consistent security settings strengthen your security posture, reduce risk, and make endpoint compliance easier to prove. ControlUp gives IT the visibility and automation to keep every endpoint aligned to your standards by continuously scanning security settings and controls, then restoring them when they drift.

Define It Once

You define the baseline. ControlUp checks every endpoint against it, restores settings that slip on the schedule you choose, and logs every change. Compliance is always-on rather than a quarterly project.

Catch Drift the Moment It Happens

Periodic audits find drift months after it started. ControlUp continuously scans security settings, account privileges and permissions, device hardening such as BitLocker configuration, and web protection and block policies. Every finding shows its severity, the devices affected, its remediation status, and when it first appeared, so you know exactly what slipped and since when.

Prove Every Security Control Is Running

Your security stack only protects the devices it’s actually running on. ControlUp checks for antivirus, antimalware, VPN, EDR, XDR, DLP, and UEM tools across every endpoint, tracks versions, install dates, and service state, and remediates devices that fall out of line. When an auditor asks whether every laptop runs EDR, you have the answer, not an estimate.

Restore the Baseline Automatically

Finding drift is useful. Reversing it before it becomes an incident is the point. Remediation templates restore your baseline fleet-wide on the schedule your compliance standards require, while targeted, real-time remediation handles a single group or device when you need it. Reboots run on your timing, with a custom heads-up for employees first.

Your Standards, Not Just Ours

More than 50 built-in scans cover common misconfigurations out of the box. When your environment needs something specific, add your own script-based scans and remediations, or attach custom fixes to built-in scans that complete without one. The baseline you enforce is the one your security team actually wrote to begin with.

Key Features

Misconfiguration scanning and remediation

OS security settings scanned and fixed across Windows devices

Security settings audits

Account privileges and permissions, device hardening, and web protection policies

Drift details

Severity, remediation status, affected devices, and first-seen date for every finding

Security control checks

Devices missing required endpoint security software detected and remediated

Security tool inventory

Installed security software, versions, install dates, and service state

Fleet-wide or targeted remediation

Template-based fixes for every device, or manual action on a group or single device

Configurable schedules

Scan and remediation frequency set to match your compliance standards

Built-in and custom scans

More than 50 built-in scans, extended with your own checks and fixes

Explore the Products
This Capability Powers

This capability is included in the ControlUp products below. Each one brings it together with related features for a specific part of your digital workplace.

ControlUp for Compliance: automated incident remediation

ControlUp for
Compliance

Learn More
FAQs
What is configuration drift?
Configuration drift occurs when endpoints deviate from their approved security baseline over time. Common causes include OS and app updates, changes to account privileges, and endpoint management policies that roll out late. Each drifted setting widens the attack surface and creates audit risk.
How does ControlUp prevent configuration drift?
ControlUp continuously scans Windows endpoints against built-in and custom checks. When a setting drifts, automated remediation restores the baseline on the schedule IT defines, and every change is logged.
Does ControlUp replace our existing EDR or UEM tools?
No. ControlUp checks that tools like EDR, antivirus, VPN, DLP, and UEM agents are installed and running, and remediates devices where they aren't. It strengthens your existing security stack rather than replacing it.
Can we add our own compliance checks?
Yes. IT can create custom script-based scans and remediations and attach custom fixes to built-in scans that ship without them.
Will remediation actions interrupt employees?
IT controls the schedule and reboot timing, and employees receive custom notifications before any scan or reboot.