Changing the profile configuration will allow enduser to make any changes to CCS that he wants.
The Client Access Control section has to be configured.
The detailed explanation can be found on: Client Access Control, Manage Device, Xcitium Endpoint Manager, Security Manager | Xcitium
