Painted myself in a corner with Policies and System Tree

[Travler]

This post concerns On-Access Default Processes Policies for VSE 8.8.

My ePO (4.6.6) System Tree is designed so each of our company's departments' workstations are in their own Groups (all Accounting workstations in a group called Acct, all Business Office workstations in a group called BusOfc, etc.).  Since most of these do not need any special policies, they inherit policies from the Directory policy assigned to "My Organization".  When there have been special needs (usually servers needing special exclusions from On-Access Scanning), I've created a Group specifically for that machine(s), applied a new policy to this new Group, and then moved the machine(s) into it.  This new policy would be built from the Directory policy mentioned earlier.  Over time I have ended up with 45 of these special groups.

Now, I'm needing to add some new exclusions from On-Access Scanning to go to every machine in the organization.  Obviously, I can get most of these covered by adding the exclusion to the Directory policy at "My Organization" at the top of the tree.  But, since I had to break inheritance to create the 45 special groups, they won't inherit these changes.  Is there any way to add these new exclusions to all machines without having to add them manually to all 46 groups?

Thanks in advance!

[andrep1]

no... sadly, a big failure of the current product.

[Travler]

Thanks, Andre.  That's what I was afraid of.

Well, does anyone have any tricks on making this a little less painful? 

All I've come up with so far is being relegated to a ton of copy/paste procedures.

[andrep1]

I understand that ePO 5 has a policy compare feature... but we just try to restrict the number of separate policies.

[cllapole · Accepted solution]

If I had this issue, I would probably go about it this way...  Go to your policy catalog, select your VSE policy and change the category to OAS, then do an Export.  Modify the XML file (if you are creative enough, you can figure out a quick way to run through it).  Then import the policies back in.  This isn't a couple quick clicks, which would be nice to be able to do (although I don't call it a big failure personally); but I can sure do that way faster than all of the clicking around that many different policies. 

As for assigning special exceptions through the system tree, I have changed over to using a lot more tagging to assign policy.  It may not make sense for your setup, and it is quite a change of thought process, but I have been very happy using Policy Assignment Rules in conjunction with Server Tasks and various tagging.

[Travler]

Thanks, Chris.  Modifying the XML file is a great idea.  Since I ended up doing it the long, manual way policy by policy, I sureI wish I'd thought of that earlier!  I'll try it next time, though!

I haven't used tagging too much, but I have been experimenting with it a bit more of late.  Thanks for sharing!