---
title: Cluster Device Command Check
slug: kronpam-reference-guide-3-9-0/cluster-device-command-check
docTags: 
createdAt: 2025-09-29T09:27:43.273Z
---

It is possible to configure Kron PAM so that specified commands cannot be executed on the same cluster of devices for a certain period of time (see [Policy Groups Creation](docId\:IAl36JqVgAGycVY8Rs3un) for more).

To perform these operations; a policy key must be created as a **Black Key**.

1.            Navigate to **Policy >** Add **Policy Key**.
2.           Select the **Policy Key Type as Black Key.**
3.           Click **Next** button.
4.           Add the **Command** that will be blocked for a certain period of time on devices that are clustered to the **Black key Regex** **pattern **field on the screen.
5.           Enter a name for the **Black Key** you created.
6.           **Select** which **Element Types** it will be valid for.
7.            Click **Save** button.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Q1A8MKAdXwu5-bK8gjxIH_image.png)

The defined Policy Key should be assigned to a Policy group

1.      Navigate to **Policy > Policy Group**.
2.     Navigate to the **Policy Group** field then click on the **Add** button.
3.     Fill in the mandatory fields: 
\* **Name**, 
\* **Operation Mode**, 
\* Select **Policy Key(s)**, 
\* If the policy group will have a **Connection** or **Command Approval**, select relevant fields.
4.     Navigate **Next** Button.
5.     Activate the **Cluster-Wide Command Restriction** switch.
6.     Enter duration as **seconds** to **Duration For Cluster-Wide Command Restriction.**
7\.     Select Action for Black Key Policies and click Save.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/BSc--aKhziSeYR0xlJe1s_image.png)

After the policy definition, the parameter setting which cluster device group this rule should be applied to must be defined in the Device Group. Relevant parameter should be following screen.

1\.	Navigate to **Devices > Inventory**.
2\. Select the **Cluster Device Group** for which you want to restrict the command from running on which devices for a predefined period then **click Edit** Button.
3\. Navigate the **Next** button.
4\. Extend the **Custom Properties** tab.
5\. Click **Plus** button top of the Parameter List then select or enter below parameter:
Parameter Key: **useAsClusterGroup**
Parameter Value: **true**

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/FFOZfvvJdqEQZi7yOTbZY_image.png)

In case of an emergency, if the user needs to run the Black key command on devices defined as a Cluster, the ***pam-enable-cluster-emergency*** command should be executed. 

When user run this command this will temporarily disable cluster restrictions for the duration specified in the system parameters for that specific device.