Enroll devices and set policy

A device is protected once the agent runs and has enrolled with your workspace. Enrolled devices pull your policy and send their block events to the console.

1. Get the enrollment key and the agent

Open the Enrollment tab as an admin.
Choose Rotate enrollment key. The key starts with csk_ and is shown once, so copy it now. Rotating replaces the previous key.
Choose Download Windows agent or Download Linux agent. A macOS agent is available on request.

The Windows agent is not code-signed. Install it only from the console download.

2. Install and enroll on Windows

Run this in an elevated PowerShell, in the folder that holds the download. The Enrollment tab shows the same commands with your key filled in.

$cs = "$env:ProgramFiles\ClearScreen\clearscreen.exe"
New-Item -ItemType Directory -Force (Split-Path $cs) | Out-Null
Copy-Item -Force .\clearscreen-windows-amd64.exe $cs
& $cs install
& $cs enroll "<enrollment key>"
& $cs start

3. Install and enroll on Linux

Run this in the folder that holds the download. It installs a systemd service.

sudo install -m 0755 clearscreen-linux-amd64 /usr/local/bin/clearscreen && sudo clearscreen install && sudo clearscreen enroll "<enrollment key>" && sudo clearscreen start

4. Check the device

Open the Devices tab. The device appears with its computer name and platform. Enrolling the same computer name again replaces that device's key instead of adding a second device. Each plan has a device cap, and a device that would exceed it is refused.

Service commands on the device:

clearscreen status
clearscreen stop
clearscreen start
clearscreen uninstall

5. Set the policy

Open the Policy tab. An admin can change:

Blocked categories, taken from the UT1 lists.
Allowlist and blocklist, one bare hostname per line. Subdomains match automatically. Do not paste https://, paths or wildcards. The allowlist overrides category blocks.
Custom categories, your own domain groups (Business plan).
Block page title, message and logo (PNG, JPEG, WebP or SVG, up to 256 KB).

Choose Save policy and branding. Enrolled devices pull the new policy from the console.

6. Test a block

Open a domain from a blocked category on the device. The domain resolves to the local block page, which shows the domain, category and source. On Windows a desktop toast shows the reason. On Linux a blocked HTTPS site may show a browser certificate warning instead of the block page.

The block page has a Send review request button. The request appears on the Reviews tab. Marking a report allowed there only changes its status. To allow the domain, add it to the allowlist on the Policy tab.

Standalone mode

The agent also runs without an account, with the default policy and the public signed bundle. Standalone mode never reports block events.

sudo clearscreen run --foreground