cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Travler
Level 10
Report Inappropriate Content
Message 1 of 6

Painted myself in a corner with Policies and System Tree

Jump to solution

This post concerns On-Access Default Processes Policies for VSE 8.8.

My ePO (4.6.6) System Tree is designed so each of our company's departments' workstations are in their own Groups (all Accounting workstations in a group called Acct, all Business Office workstations in a group called BusOfc, etc.).  Since most of these do not need any special policies, they inherit policies from the Directory policy assigned to "My Organization".  When there have been special needs (usually servers needing special exclusions from On-Access Scanning), I've created a Group specifically for that machine(s), applied a new policy to this new Group, and then moved the machine(s) into it.  This new policy would be built from the Directory policy mentioned earlier.  Over time I have ended up with 45 of these special groups.

Now, I'm needing to add some new exclusions from On-Access Scanning to go to every machine in the organization.  Obviously, I can get most of these covered by adding the exclusion to the Directory policy at "My Organization" at the top of the tree.  But, since I had to break inheritance to create the 45 special groups, they won't inherit these changes.  Is there any way to add these new exclusions to all machines without having to add them manually to all 46 groups?

Thanks in advance!

1 Solution

Accepted Solutions
cllapole
Level 9
Report Inappropriate Content
Message 5 of 6

Re: Painted myself in a corner with Policies and System Tree

Jump to solution

If I had this issue, I would probably go about it this way...  Go to your policy catalog, select your VSE policy and change the category to OAS, then do an Export.  Modify the XML file (if you are creative enough, you can figure out a quick way to run through it).  Then import the policies back in.  This isn't a couple quick clicks, which would be nice to be able to do (although I don't call it a big failure personally); but I can sure do that way faster than all of the clicking around that many different policies. 

As for assigning special exceptions through the system tree, I have changed over to using a lot more tagging to assign policy.  It may not make sense for your setup, and it is quite a change of thought process, but I have been very happy using Policy Assignment Rules in conjunction with Server Tasks and various tagging.

View solution in original post

5 Replies
andrep1
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 6

Re: Painted myself in a corner with Policies and System Tree

Jump to solution

no... sadly, a big failure of the current product.

Travler
Level 10
Report Inappropriate Content
Message 3 of 6

Re: Painted myself in a corner with Policies and System Tree

Jump to solution

Thanks, Andre.  That's what I was afraid of.

Well, does anyone have any tricks on making this a little less painful? 

All I've come up with so far is being relegated to a ton of copy/paste procedures.

andrep1
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 6

Re: Painted myself in a corner with Policies and System Tree

Jump to solution

I understand that ePO 5 has a policy compare feature... but we just try to restrict the number of separate policies.

cllapole
Level 9
Report Inappropriate Content
Message 5 of 6

Re: Painted myself in a corner with Policies and System Tree

Jump to solution

If I had this issue, I would probably go about it this way...  Go to your policy catalog, select your VSE policy and change the category to OAS, then do an Export.  Modify the XML file (if you are creative enough, you can figure out a quick way to run through it).  Then import the policies back in.  This isn't a couple quick clicks, which would be nice to be able to do (although I don't call it a big failure personally); but I can sure do that way faster than all of the clicking around that many different policies. 

As for assigning special exceptions through the system tree, I have changed over to using a lot more tagging to assign policy.  It may not make sense for your setup, and it is quite a change of thought process, but I have been very happy using Policy Assignment Rules in conjunction with Server Tasks and various tagging.

View solution in original post

Travler
Level 10
Report Inappropriate Content
Message 6 of 6

Re: Painted myself in a corner with Policies and System Tree

Jump to solution

Thanks, Chris.  Modifying the XML file is a great idea.  Since I ended up doing it the long, manual way policy by policy, I sureI wish I'd thought of that earlier!  I'll try it next time, though!

I haven't used tagging too much, but I have been experimenting with it a bit more of late.  Thanks for sharing!

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community