How to end the learning mode manually?

This document outlines the step-by-step process of how to end the learning mode manually in ThreatLocker Dashboard.

This article is a part of our ThreatLocker How-to Guides series, Chapter 04 – Learning and Training Mode.

Introduction

ThreatLocker’s Learning Mode (Training Mode) is designed to observe application behavior on endpoints without enforcing restrictions. While this mode is typically scheduled with a defined end time, there may be situations where administrators need to manually stop it for example, if the learning period is completed earlier than expected.

This guide explains how to manually end Learning Mode on a device.

Implementation

Step 1: Access the Devices Panel and Select the Target

1. Log in to the ThreatLocker Portal
2. Navigate to the Devices tab from the main navigation panel
3. Locate the target device currently in Learning Mode.
4. Select the checkbox next to the device.
5. Click on the “Secure Mode” button at the top of the page
6. When prompted, click “Yes” to confirm the change

Step 2: Verify That Learning Mode Has Ended

1. After switching to Secure Mode, remain in the Devices tab

2. In the Mode column, verify that the device no longer displays “Application Control Learning Mode”

3. It should now indicate “Secured”, confirming that Learning Mode has ended.

Conclusion

Manually ending Learning Mode in ThreatLocker is a simple but essential task when policy testing is complete or needs to be halted earlier than scheduled. Switching the device to Secure Mode ensures that enforcement policies are applied immediately, allowing administrators to maintain full control over application execution.
Always confirm the mode status to ensure the transition was successful and minimize any potential security gaps.