Policy Exclusion - how to?

[j-gray 35]

I have policies applied to a dynamic group (Mac Computers).

 

I have a static group called 'Test Group' for some Macs. I'd like to exclude the policies applied to the dynamic group and have only policies for the static group applied.

 

Is there any way to exclude policies?

[Gonzalo Alvarez 66]

Hi @j-gray,

 

As far as I know (someone correct me if I wrong)

the Dynamic groups don't have policy or task, only the Statics ones.

 

Furthermore, when you move 1 pc from group A to B, the Agent

apply the policy on B group, removing the previous one (policy of A group).

 

I believe you not exclude policy, just replace with a new one with your

desires parameters.

 

Hope this help you.

[jimwillsher 65]

Dynamic groups can have tasks. I use them all the time, for example I have a dynamic group called "outdated clients" which has an "upgrade client" task assigned to it.

 

To answer the OP I would suggest you simply move your "test" computers to a different group so that the policies don't get applied.

 

 

Jim

[MartinK 378]

I have policies applied to a dynamic group (Mac Computers).

 

I have a static group called 'Test Group' for some Macs. I'd like to exclude the policies applied to the dynamic group and have only policies for the static group applied.

 

Is there any way to exclude policies?

 

There is no way how to do that directly, you have at least two possibilities:

• move those computers to static group that is outside of dynamic group's scope. But be careful as when computer stops applying specific policy, it does not mean settings will return to default - they will either stay unchanged or will be replaced with another policy in case the same settings are applied in multiple policies.
• create policy in your test group that will override all settings. This policy has to be manually created and you have to apply all settings with configuration you wish. This will also work only for settings that are not forced from policy with higher priority.

[j-gray 35]

There is no way how to do that directly, you have at least two possibilities:

The dynamic group is "OS edition . OS type = (equal) Mac OS", so our OS X policies are applied to all OS X devices. This made the most sense to me as we want the same policies applied to all our OS X devices.  So in this case, it's not possible to move OS X computers outside of that group's scope. Option 2 looks like the only viable option.

 

It would be awesome if there was a way to exclude policies or otherwise block policy inheritance in certain groups for testing purposes.