Locking down settings so users cannot change them

Written for Synergy 1 (v1.22.3) and Synergy 3 (v3.8.4), checked 17 October 2026.

Note - locked settings are part of Synergy Business Advanced (previously called Business Team) and Synergy Enterprise.

How locked settings work

To fix settings on a computer so the people using it cannot change them, set them with Group Policy on Windows, a configuration profile on macOS, or a policy file. Synergy 1 and Synergy 3 apply them every time sharing starts, however the app is started, and gray out each locked control.

• A setting is locked because its key is present, whatever the value. Only include the keys you want to enforce.
• Remove a key, and the person's own setting is back the next time sharing starts.
• A lock applies to the computer that has it.
• The policy is a control for standard users. A local administrator can still change or remove it.

The policy is not the text-based server configuration file (the .conf file that describes your screen layout). That file is covered in: Creating and using text config files

Where the policy goes

Windows: Group Policy

Set the policy under your product's registry key, given in its section below, with Group Policy Preferences (Computer Configuration, then Preferences, Windows Settings and Registry), Intune, or any tool that writes the registry. For Synergy 1, you can use our Group Policy template instead, from the Synergy 1 section.

Each section in the tables below is a subkey, and each key is a value in it: tlsEnabled in the security subkey, for example. For an on or off setting, use a REG_DWORD of 1 or 0. For any other setting, use a REG_SZ string.

macOS: configuration profile

Deploy a configuration profile from your device management (MDM) tool, with a custom settings payload for your product's preferences domain, given in its section below.

Each section is a dictionary holding its keys, as true or false, a number or a string. Only values the profile manages count, so a preference someone writes to the same domain themselves is ignored. This turns encryption on and copy and paste off:

<key>security</key>
<dict>
  <key>tlsEnabled</key>
  <true/>
</dict>
<key>core</key>
<dict>
  <key>clipboardSharing</key>
  <false/>
</dict>

Without device management, use a policy file instead. Where a profile and a file both set a key, the profile wins.

Policy files

Each product keeps its policy file in its own place, given in its section below. Create the folder if it does not exist. On Linux the file name is case-sensitive. The Flatpak builds of Synergy 1 and Synergy 3 can't read a policy file, so install the DEB, RPM or Arch package on a Linux computer you want locked.

Make the policy file changeable only by administrators

Set the file's permissions before Synergy 1 or Synergy 3 first runs. Both check who can change the policy file before they share, and if anyone other than an administrator can change, replace or delete it, sharing doesn't start. On macOS and Linux, the file, and every folder above it, must be owned by root and not writable by anyone else.

The rule for Windows, where only Synergy 1 reads a policy file, and the message each product shows when the check fails are in your product's section. The steps for each system are under Deploying a policy file.

Settings you can lock

These are the settings you can lock, and the value each one takes. Every key goes under the section heading shown. The control each one grays out is in your product's section, under Locked controls.

Security, under [security]

Key	Value
tlsEnabled	true or false
keySize	2048 or 4096
certificate	The path to a PEM file
checkPeerFingerprints	true or false
lockTrustedFingerprints, trustedFingerprints	See Approve the computers that can connect

The certificate file must hold both the certificate and its private key.

Copy and paste

Key	Value
[core] clipboardSharing	true or false

The lock holds whichever role the computer has: a computer with copy and paste locked off shares no clipboard, whatever computer it connects to. The clipboard size limit can't be locked, so it is not a way to turn copy and paste off.

Logging, under [log]

Key	Value
level	FATAL, ERROR, WARNING, INFO, DEBUG or VERBOSE
toFile	true or false

Network

Key	Value
[core] port	A port number, 24800 by default
[core] interface	An IP address of this computer
[client] remoteHost	A host name or IP address
[server] protocol	As written in Synergy.conf

Locking remoteHost keeps a computer connecting to the server you choose.

Background service (Windows)

Key	Value
[core] processMode	0 for the service, 1 without it
[daemon] elevate	true or false

Other settings

Key	Value
[core] preventSleep	true or false
[gui] enableUpdateCheck	true or false
[server] externalConfig	true or false
[core] enableEnterCommand, enterCommand	true or false, and the command
[core] enableExitCommand, exitCommand	true or false, and the command

No other setting can be locked, apart from one more in Synergy 1, given in its section. A key that isn't in these tables or your product's section is ignored, with a warning in the log.

Approve the computers that can connect

To let only the computers you approve connect, set lockTrustedFingerprints to true and list their fingerprints in trustedFingerprints, both under [security]:

[security]
lockTrustedFingerprints=true
trustedFingerprints=fingerprint-of-computer-1,fingerprint-of-computer-2

Each fingerprint is a computer's SHA-256 certificate fingerprint, with or without its colons, and the list is separated by commas. The lock turns encryption and certificate checking on by itself. With the lock on and an empty list, no computer can connect, so check the list first when nothing connects.

A computer that isn't on the list can't connect, and nobody is asked to trust it. What each product shows then is in its section.

File format rules

• Every key sits under its section heading, such as [security], [core], [log], [client], [server], [daemon] or [gui], as in the tables above.
• For on or off settings use true or false (1 and 0 also work). Do not use no, off or disabled; your product's section says what it does with them.
• Save the file as UTF-8. A byte order mark and Windows line endings are both fine, so Notepad's defaults work.

Example policy file

This file requires encryption, lets only two approved computers connect, turns copy and paste off and fixes logging:

[security]
tlsEnabled=true
checkPeerFingerprints=true
lockTrustedFingerprints=true
trustedFingerprints=fingerprint-of-computer-1,fingerprint-of-computer-2

[core]
clipboardSharing=false

[log]
level=INFO
toFile=false

Deploying a policy file

On macOS and Linux, create the folder and the file as root, so a standard user cannot change them. The commands, with your product's paths, are in its section below, and so are the Windows steps for Synergy 1.

Checking that the lock is applied

Start Synergy 1 or Synergy 3 and open the settings. Each locked setting is grayed out, in the place your product's section gives.

To see exactly what a computer has locked, run the Core with --locked-settings. It prints one line listing every locked setting and its value, where the policy came from, any problem with it, and any key it ignored. On Windows:

"C:\Program Files\Synergy\synergy-core.exe" --locked-settings

• If a setting is missing from the list, check its spelling and that it sits under the right section heading.
• If a key is listed as ignored, it isn't one of the settings that can be locked.
• If a problem is listed, or sharing says it can't start, check the file's permissions as described above.
• If a control is grayed out but shows the wrong value, check the value.

Related articles

• Business & Enterprise Hardening Guide
• Deploying across your organization, including silent install on Windows

What follows depends on your product: Synergy 3 or Synergy 1

Synergy 3

Each locked control says Set by your administrator for this computer.

A lock holds even for settings Synergy 3 keeps in step between your computers, so set the policy on every computer you want locked.

Where the policy goes

Windows: Group Policy

Synergy 3's registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Synergy\Synergy 3. These commands turn encryption on and copy and paste off:

reg add "HKLM\SOFTWARE\Policies\Synergy\Synergy 3\security" /v tlsEnabled /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Policies\Synergy\Synergy 3\core" /v clipboardSharing /t REG_DWORD /d 0 /f

On Windows, Synergy 3 reads only Group Policy, not a policy file.

macOS: configuration profile

Synergy 3's preferences domain is com.symless.synergy-3.

Policy files

• macOS: /Library/Application Support/Synergy 3/policy.ini
• Linux: /etc/synergy-3/policy.ini

Make the policy file changeable only by administrators

When the check fails, Synergy 3 shows Can't start, with "Sharing is stopped because your administrator's settings can't be trusted. Ask your administrator to check them."

Locked controls

Key	Control
[security] tlsEnabled	TLS encryption (recommended) (Security page)
[security] keySize	Key length (Security page)
[security] certificate	Certificate (Security page)
[security] checkPeerFingerprints	Only allow verified computers (recommended) (Security page)
[core] clipboardSharing	Text and image copy and paste (Copy & paste page)
[log] level	Log level (Troubleshooting page)
[log] toFile	Applied, with no control
[core] port	Core server/client port (Miscellaneous page)
[core] interface	Network interface (Local networking page)
[client] remoteHost	Server IP (External config page)
[server] protocol	Applied, with no control
[core] processMode	Run in the background service (for UAC prompts and the login screen) (Miscellaneous page)
[daemon] elevate	Run as system to allow UAC interaction (Miscellaneous page)
[core] preventSleep	Stop this computer from sleeping (this computer's settings, Miscellaneous tab)
[gui] enableUpdateCheck	Check for updates (Local settings page)
[server] externalConfig	Configure this computer with an external config file (advanced) (Local settings page)
[core] enableEnterCommand, enterCommand	Applied, with no control
[core] enableExitCommand, exitCommand	Applied, with no control

An empty certificate value locks the computer to the certificate Synergy 3 generates.

Locking remoteHost sets the primary computer this one connects to, which Server IP shows when Synergy 3 is configured with an external config file.

For an on or off setting, Synergy 3 ignores no, off and disabled.

Approve the computers that can connect

When computers are approved this way, the list of other computers on the Security page says Chosen by your administrator, and Forget and Compare again are grayed out. Each Synergy 3 computer shows its own fingerprint on its Security page.

Deploying a policy file

On macOS:

sudo mkdir -p "/Library/Application Support/Synergy 3"
sudo tee "/Library/Application Support/Synergy 3/policy.ini" > /dev/null <<'EOF'
[security]
tlsEnabled=true

[core]
clipboardSharing=false
EOF
sudo chmod 644 "/Library/Application Support/Synergy 3/policy.ini"

On Linux:

sudo mkdir -p /etc/synergy-3
sudo tee /etc/synergy-3/policy.ini > /dev/null <<'EOF'
[security]
tlsEnabled=true

[core]
clipboardSharing=false
EOF
sudo chmod 644 /etc/synergy-3/policy.ini

Synergy 1

Use Synergy 1 (v1.22.3 or later) on every computer whose settings you lock. Earlier versions don't hold every lock against a standard user. The details are in our advisories: Synergy security advisories

Pointing at a locked control shows Locked by your administrator.

Where the policy goes

Windows: Group Policy

Use our Group Policy template, which puts every setting it can lock into the Group Policy editor and Intune: Synergy 1 Group Policy template

1. Download the template and extract it.
2. Copy Synergy1.admx into the PolicyDefinitions folder of your Central Store (or C:\Windows\PolicyDefinitions on a single computer).
3. Copy en-US\Synergy1.adml into the en-US folder inside it.
4. In the Group Policy editor, open Computer Configuration, then Policies (in a domain GPO), then Administrative Templates, then Synergy 1.
5. Set each policy you want to lock.

For Intune, import both files as an imported ADMX template instead of copying them. The policies are grouped under Security, Network, Privacy, Logging and System. An on or off policy locks the setting either way: Enabled locks it on, Disabled locks it off, and only Not configured leaves it to the person. A policy that holds a value, such as the port, removes its lock when it's Disabled. Allow only approved computers takes the list of approved fingerprints with it.

Without the template, set the policy under Synergy 1's registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Synergy\Synergy 1, as described above. These commands turn encryption on and copy and paste off:

reg add "HKLM\SOFTWARE\Policies\Synergy\Synergy 1\security" /v tlsEnabled /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Policies\Synergy\Synergy 1\core" /v clipboardSharing /t REG_DWORD /d 0 /f

Synergy 1 also reads a policy file on Windows, covered below; where both set a key, Group Policy wins.

macOS: configuration profile

Synergy 1's preferences domain is com.symless.synergy.

Policy files

• Windows: C:\ProgramData\Synergy\Synergy.policy.ini
• macOS and Linux: /etc/xdg/Synergy/Synergy.policy.ini

A Synergy.locked.ini file deployed for an earlier version of Synergy 1 keeps working where it is: C:\ProgramData\Synergy on Windows, /etc/xdg/Synergy on macOS and Linux, /Library/Synergy on macOS, or /etc/Synergy on Linux. Synergy 1 reads only the first file it finds, Synergy.policy.ini first, so keep one file on each computer.

Make the policy file changeable only by administrators

On Windows, the file and its folder must be owned by Administrators or SYSTEM, and only they may change or delete the file. Standard users can still create files in the folder, which Synergy 1 needs.

When the check fails, Synergy 1 shows Sharing can't start, naming the file other people can change.

Locked controls

Key	Control
[security] tlsEnabled	Enable TLS Encryption (Preferences, Network tab)
[security] keySize	Key length (Preferences, Network tab)
[security] certificate	Certificate (Preferences, Network tab)
[security] checkPeerFingerprints	Require client certificates (Preferences, Network tab)
[core] clipboardSharing	Enable clipboard sharing (Server Configuration, Advanced tab)
[log] level	Level (Preferences, Logs tab)
[log] toFile	Log to file (Preferences, Logs tab)
[log] guiDebug	Enable GUI debug messages (Preferences, Logs tab)
[core] port	Port (Preferences, Network tab)
[core] interface	Network IP (Preferences, Network tab)
[client] remoteHost	Connect to: (main window)
[server] protocol	Network protocol (Server Configuration, Advanced tab)
[core] processMode	Use background service (daemon) (Preferences, Advanced tab)
[daemon] elevate	Always run as system (work at login screen and UAC) (Preferences, Advanced tab)
[core] preventSleep	Prevent this computer from going to sleep (Preferences, General tab)
[gui] enableUpdateCheck	Check for updates on startup (Preferences, General tab)
[server] externalConfig	Use a server config file (Server Configuration, Config file tab)
[core] enableEnterCommand, enterCommand	Run command on enter (Preferences, Advanced tab)
[core] enableExitCommand, exitCommand	Run command on exit (Preferences, Advanced tab)

guiDebug, under [log], is a setting only Synergy 1 can lock, with a value of true or false.

Locking processMode grays out the whole background service group, Always run as system included.

Synergy 1 also reads clipboardSharing under [internalConfig], as earlier versions of this article gave it.

Synergy Enterprise never checks for updates, so it has no Check for updates on startup to lock. Restore Defaults in Preferences is grayed out while anything is locked.

For an on or off setting, Synergy 1 reads no, off and disabled as true: anything other than true, false, 1 or 0 is read as true.

Files written for Synergy 1 (v1.20 and earlier) keep working: Synergy 1 also accepts the old names, such as cryptoEnabled, tlsCertPath and tlsKeyLength under [General], and reads them as the settings above. The old names are read from [General], or from before any heading.

Approve the computers that can connect

When a computer isn't on the list, the person using it sees Computer not approved, showing the computer's fingerprint to give you.

Deploying a policy file

Windows

Group Policy needs none of these steps. To deploy Synergy 1's file instead, create the folder and the file from your deployment tool (Intune, SCCM and GPO startup scripts all run as SYSTEM) or from an administrator account, before Synergy 1 is installed or first launched. Windows lets any standard user create folders under C:\ProgramData, and whoever creates one becomes its owner. So if a standard user launches Synergy 1 before C:\ProgramData\Synergy exists, that user owns the folder, and sharing doesn't start until an administrator takes it back.

Then lock the file itself down, so that only SYSTEM and Administrators can change it and standard users can only read it. In your deployment step, after writing the file:

icacls "C:\ProgramData\Synergy\Synergy.policy.ini" /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" "Users:RX"

Leave the folder's own permissions as Windows sets them. On Windows, Synergy 1 keeps more than the policy file in C:\ProgramData\Synergy, whichever settings profile is in use: it rewrites the server configuration (synergy-server.conf) there every time the server starts, and keeps its TLS certificate and fingerprints in the tls folder inside it. Standard users need to be able to create files there, so read-only access on the folder stops the server from starting. With the "All users" settings profile, the shared Synergy.conf lives there too. The profiles are described in: Configure Synergy 1 for multi-user support

On a computer where the folder already exists, check who owns it and what standard users can do with the file:

icacls "C:\ProgramData\Synergy"
icacls "C:\ProgramData\Synergy\Synergy.policy.ini"

On the file, Users should show (RX) or (R) only, with (F) for SYSTEM and Administrators. If a user account shows (F) on the folder, that user created it. To give the folder back to administrators, open a command prompt with Run as administrator and run these commands, in this order:

icacls "C:\ProgramData\Synergy" /setowner *S-1-5-32-544
icacls "C:\ProgramData\Synergy" /reset
icacls "C:\ProgramData\Synergy\Synergy.policy.ini" /setowner *S-1-5-32-544
icacls "C:\ProgramData\Synergy\Synergy.policy.ini" /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" "Users:RX"

The first command makes the Administrators group the folder's owner; *S-1-5-32-544 names that group in any language of Windows. The second removes the full control Windows gave the user who created the folder, and gives it to whoever owns the folder at that moment, which is why the owner changes first. The last two do the same for the file and lock it down again. A prompt opened without Run as administrator can't hand ownership to Administrators.

Fleet-wide deployment steps, including where this step goes in an Intune, SCCM or Group Policy rollout, are in: Deploying across your organization, including silent install on Windows

macOS and Linux

sudo mkdir -p /etc/xdg/Synergy
sudo tee /etc/xdg/Synergy/Synergy.policy.ini > /dev/null <<'EOF'
[security]
tlsEnabled=true

[core]
clipboardSharing=false
EOF
sudo chmod 644 /etc/xdg/Synergy/Synergy.policy.ini