Groups

Discovery > Domains > Domain Watch > Policies > Groups tab

Note: In Active Directory, users must have a first name, last name, username,.password and email address.

The Groups tab sets Discovery policies by (user) groups for a selected domain.

For more information see:

• Configuring Group Policies
• Managing Remote Portal Access
• Enabling Portal Access in Discovery
• Enabling/Disabling Domain Users Accounts or Resetting Domain User Passwords
• Making Changes to Discovery Managed User Logons
• Supported Domain Logon Formats

Setting Policies by Individual User

You can set policies by individual user using the Users tab.

Included and Excluded

Once a probe is installed, Discovery is configured by setting selected domain folders and items to included or excluded. Discovery policies provide IT automation—such as installing agents or creating users—only for included folders and items. Discovery only harvests detailed information for included folders and items, minimizing the amount of data required to maintain synchronization with the domain.

Header Fields

• Policy Status

  - Original - Discovery policies have not yet been configured.

  - Modified - Discovery policies have been configured but not yet applied. After clicking the Apply Changes button, this icon remains unchanged until the harvest has been completed.

  - Applied - Discovery policies have been applied.

• Last Full Sync - Date/time of last full synchronization for this domain.
• Last Incremental Sync - Date/time of last incremental synchronization of all outstanding changes for this domain. Clicking Apply Changes after modifying policies on any Policies tab performs an "on demand" incremental synchronization. Activation performs a recurring incremental synchronization.

Actions

• Configure Group Policy - Includes selected users as either VSA users or Portal Access candidates. When this dialog opens, the Member User Policy drop-down list provides the following options:
  • Do Not Include Users - Do not create VSA user logons or Portal Access logons for domain users listed in this user group.
  • Create Staff Members - Creates a staff member record. These users can be assigned Portal Access to a machine manually.

    Note: The user can only be manually assigned the Portal Access user of a machine—using the Users & Portal Users page—if the user was the last user logged on to that machine. The list of eligible machines are listed in the Last Logged-onto Machines field in the lower panel of this same page.

  • Create Staff and make Auto Portal Candidates - Designates domain users in this user group as Portal Access candidates. See Making Portal Access Candidates for details.
  • Create VSA Users - Creates VSA user logons for domain users listed in this user group. You must select a role and scope.
    • If a scope with the same name as the organization does not already exist, a displays to the right of the Scope Lookup drop-down list of the User Policy dialog. Clicking the icon enables you to create a new scope that has the same name as the organization associated with the domain. Once the scope is created the no longer displays to the right of the Scope Lookup drop-down list and text at the top of the dialog indicates the default scope already exists.
    • If the same user is assigned to multiple groups, and different roles and scopes are assigned to each group, then when the user logs on to the VSA, these roles and scopes will be available in the roles/scope selector in the upper-right corner of the VSA window.
    • Roles/scope assignments using the Groups tab and Users tab can be modified and reapplied multiple times. Successive changes will cause roles and scopes to accumulate, rather than be replaced. Discovery never removes records in the VSA.

      You can assign a VSA user to a scope outside of the organization associated with the domain network. This enables a VSA user to use a single scope to have visibility of all machine groups in multiple organizations. You must ensure the scope selected provides access to each domain organization.

      You can assign a VSA user to a scope outside of the organization associated with the domain network. This enables a VSA user to use a single scope to have visibility of all machine groups in multiple organizations. You must ensure the scope selected provides access to each domain organization.

  • User Department Override - Administrators can automatically map the departments used to organize staff records inside the VSA using the OU hierarchy that already exists in Active Directory. This occurs when a Group or User policy selects the Use Directory Default value. When this occurs, a staff record created by policy is assigned to the department that matches its current OU location. If an Active Directory administrator renames the OU or moves the user to a different OU location, the staff record is changed in the VSA to match it. Tracking moves fully requires policies be set in both the source and target OUs. Parent departments are created as necessary, to match the OU hierarchy. Alternatively, a staff record can be assigned a policy that assigns it to a fixed department. This policy can be overridden by Users policy.
• Apply Changes - Applies Discovery policy changes pending on all Policies tabs.

Column Headings

• Type - - Group
• Group Name - A canonical name provides the complete hierarchy of OUs/containers used to locate folders and items—such as computers, contacts or groups—in a domain, similar in format to the full path name of a file in a disk directory.
• Users Policy
  • Do Not Include Users - Do not create VSA user logons or Portal Access logons for domain users listed in this user group.
  • Create Staff Members - Creates a staff member record.
  • Create Staff and make Auto Portal Candidates - Designates domain users in this user group as Portal Access candidates. See Making Portal Access Candidates for details.
  • Create VSA Users - Creates VSA user logons for domain users listed in this user group.
• Total Users - The total number of users in this group.
  • Role Policy - The VSA role to assign to newly created VSA users if Users Policy is Create VSA Users.
  • Scope Policy - The VSA scope to assign to newly created VSA users if Users Policy is Create VSA Users.
• Dept Override - Specifies the department to assign a newly created user. Use Directory Default specifies the default department for the organization associated with the domain using the Probe Deployment tab.