---
title: "General policy configuration"
slug: "general-policy-configuration"
tags: ["Product Usage", "EDR", "Endpoint Security"]
updated: 2026-09-12T20:09:54Z
published: 2026-09-12T20:09:54Z
canonical: "docs.trellix.com/general-policy-configuration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# General policy configuration

You can use the **General** policy tab to configure Trellix EDR on monitored devices.

| Option | Definition |
| --- | --- |
| **Enable read-only for Trellix EDR data folders** | This option is enabled by default. Data folder isn't readable. Only log files are readable when they are enabled. If they are enabled, files in `%PROGRAMDATA%\McAfee\MAR\data` are readable. |
| **Enable content updates** | This option is enabled by default. When the **Enable content updates** option is selected, the dynamic content update feature allows Trellix to immediately respond to newly found vulnerabilities by pushing content updates automatically to endpoints. > [!NOTE] > Note > > Make sure endpoints can access the **https://content.endpoint.ccs-trellix.com** URL and [API URL](/v1/docs/network-ports-and-url-allow-list-1) to successfully update the dynamic content. On endpoints with the Trellix EDR client 4.0.x or later, when the **Enable content updates** option is selected, the client checks for new content updates at the configured interval and gets updated with the latest content on endpoints automatically without performing an explicit deployment task from ePO - On-prem or ePO - SaaS. > [!NOTE] > Note > > The dynamic content update feature is applicable only on the Windows 64-bit operating system endpoints where Trellix EDR 4.0.x or later version is installed. On endpoints with the Trellix EDR client 3.5.x or earlier, make sure the **Enable content updates** option is selected and then check-in (**Software Catalog**) and deploy (**Product Update)** the latest content package from ePO - On-prem or ePO - SaaS. |
| **Content update method** | On endpoints with the Trellix EDR client 4.1.x or later, you have an option to select either **Dynamic content update** or **ePO push content update** to update content on Windows endpoints. Other operating systems do not support the dynamic content update. By default, the dynamic content update is selected and effective only for Windows endpoints. Other operating systems will default to the ePO - On-prem or ePO - SaaS push content update method. The below table gives details about the supported content update methods according to the version and operating system. \| Version \| Endpoints with OS \| Supported methods \| \| --- \| --- \| --- \| \| 4.1.x or later \| Windows \| Dynamic content update and ePO push content update \| \| Linux \| Content update is not supported \| \| macOS \| ePO push content update \| \| 4.0.x \| Windows \| Dynamic content update \| \| \| Linux \| Content update is not supported \| \| \| macOS \| ePO push content update \| \| 3.5.2 or earlier \| Windows \| ePO push content update \| \| \| Linux \| Content update is not supported \| \| \| macOS \| ePO push content update \| |
| Version | Endpoints with OS | Supported methods |
| 4.1.x or later | Windows | Dynamic content update and ePO push content update |
| Linux | Content update is not supported |
| macOS | ePO push content update |
| 4.0.x | Windows | Dynamic content update |
|  | Linux | Content update is not supported |
|  | macOS | ePO push content update |
| 3.5.2 or earlier | Windows | ePO push content update |
|  | Linux | Content update is not supported |
|  | macOS | ePO push content update |
| **Check for content updates at an interval** | Updates the client content on endpoints at the configured time (in minutes) when content updates are enabled. On endpoints with the Trellix EDR client 4.0.x or later, the default interval set is 240 minutes. The minimum and maximum interval you can set is between 60 and 1440 minutes. On endpoints with the Trellix EDR client 3.5.x or earlier, the default interval set is 240 minutes. The minimum and maximum interval you can set is between 5 and 1440 minutes. However, the minimum interval varies based on the Trellix EDR client extension version installed. If the version is 4.0.x or later, the minimum interval you can set is 60 minutes. > [!NOTE] > Note > > Click **Show advanced** to display other policy options. |
| **The maximum number of results returned by the Trellix EDR Real-time Search** | Sets the maximum number of results returned by Trellix EDR search expressions. The default value set is 512. The minimum and maximum results you can set is between 32 and 8192. |
| **Enable password to uninstall the Trellix EDR client (Windows only)** | This option is disabled by default. Prevents the user from uninstalling Trellix EDR client without an uninstallation password > [!WARNING] > Important > > This feature is supported only on Microsoft Windows. |

### Tamper protection

The tamper protection feature allows the Administrator to configure a policy to prevent a user from uninstalling Trellix EDR client without an uninstallation password.

> [!WARNING]
> Important
> 
> This feature is supported only on Microsoft Windows.