How to configure the duration of learning mode?

This document outlines the step-by-step process of how to configure the duration of learning mode in ThreatLocker Dashboard.

This article is a part of our ThreatLocker How-to Guides series, Chapter 04 – Learning and Training Mode.

Introduction

ThreatLocker’s Learning Mode (also called Training Mode) allows the system to observe application behavior on endpoints without enforcing allow/deny policies. This is particularly useful during the onboarding of new devices, helping IT teams build accurate, real-world policies.Configuring the correct duration of Learning Mode ensures that enough activity is captured without unnecessarily delaying enforcement. This guide walks you through how to set the duration during the Learning Mode setup.

Implementation

Step 1: Open the Target Device’s Configuration Panel

1. Log in to the ThreatLocker Portal
2. Go to the Devices tab from the main navigation
3. Locate the device where you want to enable Learning Mode
4. Click on the device to open its details window

Step 2: Configure the Learning Mode Schedule

1. 1. In the device details window, navigate to the Maintenance tab to access the maintenance configuration panel.
2. 2. Within the maintenance section, configure the following settings to enable Learning Mode:

• Maintenance Type: Select Application Control Learning Mode
• Set the Start and End Date to define the duration for which Learning Mode should remain active. This sets the period during which ThreatLocker will observe application behavior.
• Applies To: Choose Existing Applications
• Learning Method: Select Automatic

1. 3. Once all fields are completed, click “Add Scheduled Maintenance”, then click “Save” to activate Learning Mode on the selected device.

You will see the target device listed under the Mode column as being in Application Control Learning Mode, with a status of In Progress, scheduled for the selected time period.

Conclusion

Configuring the duration of Learning Mode in ThreatLocker ensures that application behavior is observed only within a defined time window, reducing the risk of unnecessary data collection or prolonged exposure.By setting clear start and end times, administrators can efficiently onboard new devices, monitor software usage, and establish accurate allow/deny policies, all while minimizing user disruption.
This controlled approach strengthens your Zero Trust posture and helps build a more secure and informed policy framework