Summary
What Certified Desktop is and why a JCB-managed computer is configured the way it is (encryption, 15-min screen lock, CrowdStrike, CrashPlan, OS + third-party patching, Sassafrass asset tracking), plus a self-check link and answers to common concerns.
Body
Who this is for / when to use it
You're a JCB faculty or staff member with a Cornell-owned, JCB-managed computer, and you've noticed it's set up a certain way — your screen locks itself when you step away, some settings are managed for you — and you're wondering why, or whether something is wrong. This article explains what's configured on your machine and the reasons behind it. You don't have to do anything to turn these protections on, and most of the time you'll never notice them.
Before you start
- This applies to Cornell-owned, JCB-managed computers (your JCB work machine) — not personal devices (for securing a personal device, see Cornell's Secure Your Computer and Mobile Device).
- Nothing here is a task you perform — it's background information. If a specific setting is getting in the way of your work, skip to Common problems and Still stuck? below.
What "Certified Desktop" is
Your JCB computer is a Certified Desktop — Cornell's standard for a securely managed computer, aligned with University Policy 5.10 (Information Security). Cornell adopted it for the same reason peer institutions (Harvard, Yale, MIT, Stanford, and others) run similar programs: a consistent, well-protected baseline is the most effective way to keep university data — and the people who use it — safe. Your machine is enrolled in this program and managed by JCB IT, so a small set of security services is delivered and kept current for you automatically.
> Want to check your own machine? From your managed JCB computer you can see whether it currently meets the Certified Desktop standard at certified.it.cornell.edu.
What's configured on your machine — and why
| Protection |
What it does |
Why it's there |
| Disk encryption |
Every fixed drive in your computer is encrypted. |
If the machine is lost or stolen, the data on it stays unreadable. |
| Automatic screen lock |
Your screen locks after a short idle period. At JCB this is 15 minutes, so a walked-away, unlocked machine doesn't stay open. |
Stops someone from using your session while you're away from your desk. |
| Anti-malware (CrowdStrike) |
Continuously watches for and blocks malware. |
Catches threats early, usually with no action from you. |
| Automatic backup (CrashPlan) |
Backs your files up to Cornell's cloud continuously. |
If your machine fails or is lost, your work can be recovered. |
| Operating-system patching |
Required Windows or macOS security updates are kept installed. |
Closes the security holes attackers rely on. (See the companion patching article for how updates arrive.) |
| Third-party app patching |
Common apps (browsers, PDF readers, etc.) are kept updated too, on both Windows and Mac, via central patching mechanisms. |
Third-party apps are one of the most common ways machines get compromised. |
| Asset tracking |
Your machine is recorded in JCB's IT asset system (Sassafrass). |
Lets JCB IT support, update, and account for the computer over its life. |
> On top of Certified Desktop: as part of ongoing security best practice, JCB also manages a local firewall on your machine. It runs quietly in the background and needs nothing from you.
What this means for you day to day
- You mostly won't notice any of it. These protections are designed to stay out of your way.
- Your screen will lock after 15 minutes idle — that's expected; just sign back in. Locking it yourself when you step away is a good habit (Windows: ⊞ Win + L; Mac: ⌃ Control + ⌘ Command + Q).
- You don't manage these tools — updates, anti-malware, backup, and encryption are handled for you.
- Your files are being backed up, but backup is a safety net, not a substitute for saving your work to approved storage as you go.
- Some settings are standardized and locked to the security baseline rather than left to each person. That's deliberate — it keeps every machine at a known-good level and takes the security housekeeping off you.
Common problems / if that didn't work
- "My screen keeps locking — can that be turned off?" — The 15-minute lock is part of the JCB security standard and isn't something to disable. If it's genuinely disrupting a specific workflow (a presentation, a long-running lab process), contact JCB IT and we'll talk through options.
- "Is Cornell watching what I do on my computer?" — No. These tools protect the machine and its data (malware, encryption, backup, patching, inventory); they are security and management tooling, not activity surveillance.
- "I need to install software / I need admin rights." — Most everyday software you can install yourself; anything that needs elevated rights follows a defined path — contact JCB IT and we'll help.
- "Is my personal computer a Certified Desktop?" — No. Certified Desktop applies to Cornell-owned, JCB-managed machines; personal devices are handled differently. To secure a personal device, see Cornell's Secure Your Computer and Mobile Device.
Still stuck?
If you're unsure whether your machine is a Certified Desktop, or a standard setting is getting in the way of your work, contact JCB IT.
Still need help? Contact the Cornell SC Johnson College of Business Helpdesk at itrequests@business.cornell.edu.
More info
[edited via Jane by rtm25 on 2026-09-09 18:33 UTC]