Skip to content
Dynacop Docs

The policy model

Dynacop policies answer one question per machine: how strictly is sign-in controlled here?

The layers

Section titled “The layers”
System defaults        safe out-of-the-box values
      ↓
Resource policy        THE policy you edit, per machine
      ↓
Account policy         optional narrowing for one Windows account
  • System defaults are deliberately safe: fail-open, Enforce off (password fallback available), Shield off.
  • The resource policy is where you work — every setting below is edited on the resource’s policy card. New resources start from a template of these defaults.
  • Account policies can only narrow the resource policy for a single Windows account (e.g. deny one account, or exempt one service account) — never widen it.

Full settings catalog

Section titled “Full settings catalog”

Sign-in and MFA — details in sign-in policies:

Setting Meaning Default
Require MFA on Which sessions prompt: console / rdp / both / none (none = monitor-only) both
Fail-mode Backend unreachable: open = allow, closed = deny open
Enforce Disable password-only fallback at the sign-in screen off
MFA timeout Seconds the prompt waits (10–600) 60
Lockout threshold Failed code attempts before lockout (1–100) 5
Lockout duration Seconds locked (30–86400) 300
Unknown user enroll / allow / deny for logins Dynacop doesn’t know enroll
Enforce grants Zero-trust: no access record ⇒ deny off
Offline access Allow local verification with no network on

Access shape:

Setting Meaning Default
Access Resource-wide allow / deny allow
Allowed MFA Authenticator (TOTP) TOTP
Protocols Console / RDP console + rdp
IP restriction Allowlist of IPs/CIDRs for RDP — see IP restrictions empty (anywhere)

Fleet & integration:

Setting Meaning Default
Auto-discover accounts Agent reports local Windows accounts on
Automatic update Agent self-updates — see updates on
Notification emails Extra recipients for access changes —
API export Include this resource in the Threat Feed API on

Shield (attack blocking) — details in configuring Shield:

Setting Meaning Default
Attack blocking Auto-block brute-force source IPs off
Threshold / window N failed attempts within M seconds → block 20 / 600
Block duration First block TTL, growing to a max on repeat 15 min → 24 h
Persistent blocking Cumulative low-and-slow threshold and its TTL 100 → 30 days
Private IPs Also block LAN/private ranges off
Safe IPs Never-block allowlist —