Product Deployment - skip deploment based on tag

[tcox8]

We are currently deploying DLP. We have about 200 departments but only about 50-75 will be getting DLP. There are certain computers within those departments that will NOT be getting DLP installed for various reasons. I have already tagged those appropriately. I would love to use the product deployment so I can just select all the departments have them under one deployment but I can't seem to find a way to NOT deploy to the specified/tagged machines. I can create the 50-75 individual client tasks and set it to not deploy based on the tag but that is a lot to manage. Especially when upgrades need to happen.

What would be the recommendation for this?

[Hem]

We can create task on machine group in system tree, move all those machines to that group where wanted to deploy dlp.

[tcox8]

@Hem - But the machines are already in the groups based off of department (syncs from AD). That is how we want to deploy them. Basically.. if a new computer gets automatically added to that department, DLP will install. If I move all the machines to one group I will not be able to tell what department they belong to and if future computers should get DLP or not.

[cdinet]

If they are tagged appropriately, then when you create the task, you have an option to not send it to systems that have a certain tag.  To do that, you would need a tag that is for the no dlp systems.  You would then use "and has none of these tags:" option.

[tcox8]

@cdinet - Not to be rude.. but did you read my post? In the original post I stated that I know I can do that but I was looking for a quicker way than creating 75 different deployments.

[cdinet]

Why would you need to create all individual tasks?  Yes, I read your post.  Here is what I was suggesting, but it is making assumptions on how your systems are tagged.

1.  If systems are tagged to deploy or not to deploy - simple tagging, one or the other.

2.  Create one deployment task at my org, send to computers with tag deploy and does not have tag not to deploy.