You install the Endpoint Protector hardware appliance or virtual appliance. From their you deploy a small client application to computers you wish to control. You can deploy directly from the console or via Active Directory, folder share or other means.
This low level service runs seamlessly on each client computer (Windows, Mac OSX or Linux)
The service interacts with the various device ports & applications available on that machine, and then applies the required permissions and controls that you set using the Endpoint Protector management server.
This service cannot be bypassed / stopped / removed even if you have local admin privileges! This service can also be completely invisible to end users.