Enforce requirements

Review the requirements before you install and use Enforce.

Core platform dependencies

Make sure that your environment meets the following requirements:

• Tanium™ Core Platform servers: 7.4.3.1204 or later*

• Tanium™ Client: Any supported version of Tanium Client. For the Tanium Client versions supported for each OS, see Tanium Client Management User Guide: Client version and host system requirements.

  If you use a client version that is not listed, certain product features might not be available, or stability issues can occur that can only be resolved by upgrading to one of the listed client versions.

* Tanium Core Platform server 7.4.3.1204 is the minimum supported Tanium Core Platform server version for Enforce. It is a best practice to use Tanium Core Platform server 7.4.5.1240 or later. For more information, see Tanium Server release notes: Version_7.4.3.1204 Special Notes.

Client extensions

Tanium Endpoint Configuration installs client extensions for Enforce on endpoints. Client Extensions perform tasks that are common to certain Tanium solutions. The Tanium Client uses code signatures to verify the integrity of each client extension prior to loading the extension on the endpoint. Each client extension has recommended security exclusions to allow the Tanium processes to run without interference. See Security exclusions for more information. The following client extensions perform Enforce functions:

• Config CX - Provides installation and configuration of extensions on endpoints. Tanium Client Management installs this client extension.
• Core CX - Provides a management framework API for all other client extensions and exposes operating system metrics. Tanium Client Management installs this client extension.
• (Windows endpoints) Recorder CX - Provides the ability to save event data on each endpoint and monitor the endpoint kernel and other low-level subsystems to capture a variety of events. Tanium Enforce, Tanium Integrity Monitor, Tanium Map, or Tanium Threat Response installs this client extension.*
• DEC CX - Provides a direct connection between endpoint and Module ServerTanium Cloud. Tanium Direct Connect installs this client extension.
• Enforce CX - Provides Enforce functions on the endpoint. Tanium Enforce installs this client extension.
• Stream CX - Provides the ability to gather large amounts of data from endpoints and send it to an external destination. Tanium Enforce or Tanium Threat Response installs this client extension.

* This client extension also installs the Tanium Driver.

Tanium™ Module Server

Enforce is installed and runs as a service on the Tanium Module Server host computer. The impact on the Module Server is minimal and depends on usage.

Endpoints

Supported Internet protocols

Enforce supports IPv4 and IPv6 addresses.

Supported operating systems

Enforce policies support the following endpoint operating systems:

All Windows editions that support the Group Policy feature are supported for each of the following Windows versions, unless otherwise noted. Available Group Policy settings vary depending on Windows version and edition.

Host and network security requirements

Specific ports and processes are needed to run Enforce.

For Tanium Cloud ports, see Tanium Cloud Deployment Guide: Host and network security requirements.

Security exclusions

If security software is in use in the environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow the Tanium processes to run without interference. The configuration of these exclusions varies depending on AV software. For a list of all security exclusions to define across Tanium, see Tanium Core Platform Deployment Reference Guide: Host system security exclusions.

To use Enforce features that require End-User Notifications or Direct Connect, you must also configure the required security exclusions for each of these services to allow them to run without interference.

Internet URLs

For anti-malware policies, allow outbound communication from the Tanium Module Server to the following Microsoft download URLs. See Managed Anti-Malware definitions download URLs for configuration details.

User role requirements

The following tables list the role permissions required to use Enforce. To review a summary of the predefined roles, see Set up Enforce users.

For more information about role permissions and associated content sets, see Tanium Console User Guide: Managing RBAC.

The Enforce service account role is for internal use only. It is automatically managed by the Enforce user. Do not assign the Enforce service account role to users.

Enforce Global user role permissions

Permission	Enforce Administrator1,2,5	Enforce Defender Scan User1,2	Enforce Defender Scan Viewer1,2	Enforce Endpoint Configuration Approver1,2,3	Enforce Operator1,234	Enforce Policy Administrator (Global)1,2	Enforce Policy User (Global)1,2	Enforce Policy Viewer (Global)1,2	Enforce Quarantine Administrator 1,2	Enforce Write Content Wipe Action1,2
Disk Encryption Recovery Keys Read, rotate, export, or delete recovery keys for disk encryption in given content sets	EXPORT ROTATE READ DELETE				EXPORT ROTATE READ DELETE
Enforce SHOW: View the Enforce workbench OPERATOR: Read, edit, and delete most Enforce objects (except edit access to Enforce settings)	SHOW4 OPERATOR	SHOW4	SHOW4	SHOW4	SHOW4 OPERATOR	SHOW4	SHOW4	SHOW4	SHOW4	SHOW4
Enforce Administrator Unrestricted access to Enforce	ADMINISTER
Enforce Create Enforce policies in given content sets	ENFORCEMENT				ENFORCEMENT	ENFORCEMENT	ENFORCEMENT
Enforce Defender Scan View, create, or delete Defender scans	READ WRITE	READ WRITE	READ		READ WRITE
Enforce Edit Any Edit available policy enforcements. Users always have access to enforcements that they created.	ENFORCEMENT				ENFORCEMENT	ENFORCEMENT
Enforce Endpoint Configuration Approve Enforce items in Endpoint Configuration				APPROVER
Enforce Endpoint Configuration All View or create Endpoint Configuration items for Enforce	WRITE				WRITE	WRITE	WRITE	READ
Enforce Endpoint Wipe Issue Windows Remediation actions that wipe, freeze, or recover endpoints						ACTION				ACTION
Enforce Operator Settings Globally read or edit most Enforce settings	READ WRITE				READ WRITE
Enforce Policy Prioritize, view, create, or edit Enforce policy priorities in given content sets	PRIORITIZE READ WRITE				PRIORITIZE READ WRITE	PRIORITIZE READ WRITE	READ WRITE	READ
Enforce Recovery Portal View recovery portal configuration and status, or write recovery portal configuration and download the installer	READ WRITE
Enforce Settings Globally read or edit all Enforce settings	READ WRITE
Enforce Write Policy Create policy packages for enforcements
Policy Template Read, edit, or delete policy templates in given content sets	READ WRITE DELETE				READ WRITE DELETE	READ WRITE DELETE	READ	READ
Policy Type Read or edit policy types in given content sets	READ WRITE				READ WRITE	READ WRITE DELETE	READ WRITE	READ
Reports Read, edit, or delete reports in given content sets	READ WRITE DELETE				READ WRITE DELETE	READ WRITE DELETE	READ WRITE DELETE	READ
Restore from Quarantine Restore files quarantined by Microsoft Defender.	ADMINISTER				ADMINISTER				ADMINISTER
Enforce MDM Action Provides Mac Device Enrollment policy privileges for non-destructive actions such as lock, as well as un-enrolling a device	USER				USER
Enforce MDM Mac Policy View, use, and write Mac Device Enrollment policies	USER VIEWER READ WRITE				USER VIEWER READ WRITE	USER VIEWER READ WRITE	USER VIEWER READ WRITE	VIEWER READ
1 This role provides module permissions for Tanium Interact. You can view which Interact permissions are granted to this role in Tanium Console. For more information, see Tanium Interact User Guide: User role requirements. 2 This role provides module permissions for Tanium Trends. You can view which Trends permissions are granted to this role in Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. 3 This role provides module permissions for Tanium Endpoint Configuration. You can view which Endpoint Configuration permissions are granted to this role in Tanium Console. For more information, see Tanium Endpoint Configuration User Guide: User role requirements. 4 To import the Enforce solution, you must be assigned the Administrator reserved role. 45 This role provides module permissions for Tanium Mac Device Enrollment. You can view which Mac Device Enrollment permissions are granted to this role in Tanium Console. For more information, see Tanium Mac Device Enrollment User Guide: User role requirements.

Global Template (Permissions restricted by operating system content sets: Windows, macOS, or Linux) user role permissions

Permission	Enforce Policy Administrator (Template)1,2,4,55,6	Enforce Policy User (Template)1,2,56	Enforce Policy Viewer (Template)1,2,56	Enforce Quarantine Administrator 1,2	Enforce Recovery Key Administrator (Template)1,2 Enforce Recovery Key User (Template)1,2	Enforce Recovery Key Viewer (Template)1,2	Enforce Recovery Portal (Template)1,2	Enforce Recovery Portal Administrator (Template)1,2	Enforce Recovery Portal Viewer (Template)1,2	Enforce MDM Action User1,2,34	Enforce MDM Wipe User1,2,34
Disk Encryption Recovery Keys Read, rotate, or delete recovery keys for disk encryption in given content sets					ROTATE READ DELETE	READ	READ
Enforce SHOW: View the Enforce workbench OPERATOR: Read, edit, and delete most Enforce objects (except edit access to Enforce settings)	SHOW3	SHOW3	SHOW3	SHOW3	SHOW3	SHOW3	SHOW3	SHOW3	SHOW3	SHOW3
Enforce Create Enforce policies in given content sets	ENFORCEMENT	ENFORCEMENT
Enforce Edit Any Edit available policy enforcements. Users always have access to enforcements that they created.	ENFORCEMENT
Enforce Endpoint Configuration (Template) View or create Endpoint Configuration items for OS	WRITE	WRITE	READ
Enforce Policy Prioritize, view, create, or edit Enforce policy priorities in given content sets	READ WRITE	READ WRITE	READ
Enforce Recovery Allows the user to be used as the Enforce Recovery Portal							PORTAL
Enforce Recovery Portal View recovery portal configuration and status, or write recovery portal configuration and download the installer								READ WRITE	READ
Policy Template Read, edit, or delete policy templates in given content sets	READ WRITE DELETE	READ	READ
Policy Type Read or edit policy types in given content sets	READ WRITE	READ WRITE	READ
Quarantine Restore files quarantined by Microsoft Defender	ADMINISTER			ADMINISTER
Reports Read, edit, or delete reports in given content sets	READ WRITE DELETE	READ WRITE DELETE	READ
Enforce MDM Mac Policy Administrator Provides privileges to administer Mac Device Enrollment policies	ADMINISTER
Enforce MDM Mac Policy View, use, and write Mac Device Enrollment policies	USER VIEWER READ WRITE	USER VIEWER READ WRITE	VIEWER READ
Enforce MDM Action Provides MDM privileges for non-destructive actions such as lock, as well as unenrolling a device										USER
Enforce MDM Wipe Provides MDM privileges for wiping devices											USER
1 This role provides module permissions for Tanium Interact. You can view which Interact permissions are granted to this role in Tanium Console. For more information, see Tanium Interact User Guide: User role requirements. 2 This role provides module permissions for Tanium Trends. You can view which Trends permissions are granted to this role in Tanium Console. For more information, see Tanium Trends User Guide: User role requirements. 3 To import the Enforce solution, you must be assigned the Administrator reserved role. 34 This role provides module permissions for Tanium Mac Device Enrollment. You can view which Mac Device Enrollment permissions are granted to this role in Tanium Console. For more information, see Tanium Mac Device Enrollment User Guide: User role requirements. 45 The Enforce MDM Mac Policy Administrator permission is provided only to the Enforce Mac Policy Administrator role by default. 56 The Enforce MDM Mac Policy permission is provided only to the Enforce Mac Policy Administrator, Enforce Mac Policy User, and Enforce Mac Policy Viewer roles by default.

Module Objects with Access Control by Content Sets

Access Control Type	Policy Definition	Policy Type	Policy Templates	Policy Item	Managed Definition Files	Reports	Disk Encryption Recovery Keys
Global
Content Set

Provided administration and platform content permissions

Permission	Permission Type	Enforce Administrator1	Enforce Defender Scan User1	Enforce Defender Scan Viewer1 Enforce Endpoint Configuration Approver1	Enforce Operator1 Enforce Policy Administrator1 Enforce Policy User1	Enforce Policy Viewer1	Enforce Quarantine Administrator 1	Enforce Recovery Key Administrator1 Enforce Recovery Key User1 Enforce Recovery Key Viewer1 Enforce Recovery Portal Administrator1 Enforce Recovery Portal Viewer1	Enforce Recovery Portal1	Enforce Write Content Wipe Action1
Action Group	Administration	WRITE			READ
Computer Group	Administration	WRITE	READ		READ	READ
Token - Use	Administration	WRITE							SPECIAL
Token - View	Administration	WRITE							SPECIAL
Action	Platform Content	WRITE	WRITE		WRITE		WRITE			WRITE
Action for Saved Question	Platform Content	WRITE			WRITE
Filter Group	Platform Content	READ	READ	READ	READ	READ	READ	READ	READ	READ
Own Action	Platform Content	READ	READ		READ		READ			READ
Package	Platform Content	READ	READ		READ		READ			READ
Plugin	Platform Content	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE	READ EXECUTE
Saved Question	Platform Content	READ WRITE	READ WRITE		READ WRITE
Sensor	Platform Content	READ	READ	READ	READ	READ	READ	READ	READ	READ
To view which content set permissions are granted to a role, see Tanium Console User Guide: View effective role permissions. 1 This role provides content set permissions for Tanium Trends. You can view which Trends content sets are granted to this role in Tanium Console. For more information, see Tanium Trends User Guide: User role requirements.

For more information and descriptions of content sets and permissions, see the Tanium Core Platform User Guide: Users and user groups.

Mac and macOS are trademarks of Apple Inc., and registered in the U.S. and other countries and regions.