9. Groups
Deliver policy by machine name, operating system, AD group, user or mailbox.
Policy → Groups
Groups let different parts of the organisation receive different policies. A group is a set of machines (and, for Outlook web panels, mailboxes), chosen by machine name, operating system or Active Directory. Each group can receive its own labels, rules and settings in addition to the Common items that every machine receives.
This page defines groups and their targeting. You assign labels, rules and other items to a group on the item’s own page, and per-group settings in Policy → Rules with the Scope selector.
In this topic
- 9.1 Before you start: Active
Directory
Groups based on AD groups, AD users, AD computers or e-mail addresses need a working directory connection. Configure Administration → Settings → Active Directory (section 6.5) first:
- 9.2 How groups work
A machine is therefore always in exactly one group, or in Default. Put narrow groups above broad ones. A catch-all group at the top would take every machine.
- 9.3 Targeting methods
Choose one method per group in Assign machines by . Methods cannot be mixed in one group.
- 9.4 The Groups page
The page has a help box ( How do groups work? ), + Add Group , one card per group in priority order, and a fixed Default card at the bottom.
- 9.5 Creating and editing a
group
Publish requirements for groups:
- 9.6 The AD picker
Groups, users and computers are stored with their SID (computers by name). Mail entries are added separately with Add mail , because they are not directory objects.
- 9.7 Order and priority
Unlike label order, which is a sensitivity ladder, group order is a priority list . It only matters when a machine matches more than one group.
- 9.8 Enabling, disabling and
deleting
Important A group’s identity is an internal ID, not its name. If you delete a group and create a new one with the same name, it is a different group. Any label or rule that still pointed at the old ID becomes Common…
- 9.9 Checking which group a
machine is in
Agents → Agents , Group column: the effective group as the server calculates it. “(auto)” means targeting matched. No suffix means a manual assignment. Default means nothing matched. Machine drawer → Policy group :…
- 9.10 AD refresh and
domain controller outages
The server looks up the signed-in user’s AD groups (with nested membership) and directory e-mail when the agent reports in. The result is cached per user for about 10 minutes , with a small random spread. A change in…
- 9.11 Worked example:
Executives, Finance and HR
Goal. Executives may print Strictly Confidential documents. Finance gets payment-data rules and a Finance label. HR gets personnel-data rules and must not see the Finance label. Everyone keeps the Common four-level…