This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Assign SEC Policy to Active Directory Security Group?

Hi,

I have tried searching the documentation as well as searching on the forums and the internet and wanted to know if it is possible to assign a Device Control Policy to an AD security Group?

For example I have groups synced to AD OUs and these are per department, and want some staff (managers) to have USB access, but not everyone.

These managers happen to already be in an AD Sec Group so I would like to use that, rather than having to create a SUB group / OU for allowed USB access.

Is that possible?

Many thanks,

Scott.

This thread was automatically locked due to age.

Parents

0 QC over 11 years ago

Hello Scott,
SEC only syncs the OU structure and the computer objects within, it doesn't use other information from AD. In addition policies are assigned to SEC groups (and indirectly to the computers belonging to them), "user" doesn't exist at all.
This is as it is now. It might change but personally I don't think this will happen really soon.
Christian
:37283
Cancel
Vote Up 0 Vote Down

Cancel
0 MariusEckardt over 7 years ago in reply to QC

any Update for this ? I have the same Problem, i want to create some AD-Groups with Computerobjects. For this Groups i wanted to assign a Policy... (v 5.3.1)
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to MariusEckardt

Hello MariusEckardt,

first of all, 5.3.1 is past its retirement date, you should upgrade SEC ASAP.

the same Problem ... AD-Groups with Computerobjects
really the same? The OP asked about policies assigned to Users whereas you are talking about Computers. Do I understand correctly that you have Computer Objects in the same OU but want to assign different policies based on Security Group membership?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 MariusEckardt over 7 years ago in reply to QC

yes thats correct.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to MariusEckardt

Hello MariusEckardt,

I'm afraid this hasn't changed. AD import/sync just considers containers (OUs).
The rationale is that an AD object can be a member of more than one Security Group and you'd need a way of defining precedences in case of conflicting settings (think of linked GPOs and RSOP). This would make management with the console very complex, IMO all but impossible.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 MariusEckardt over 7 years ago in reply to QC

ok, thank you for your answers.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 MariusEckardt over 7 years ago in reply to QC

ok, thank you for your answers.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data