Hello
Is only one policy applied at a time e.g. under Server Protection?
If I adjust the base policy, for example, do I have to adjust the cloned policies as well?
Is it not possible to apply multiple policies to one server?
I expected the exceptions to the copied policies to be inherited.
When customizing the base policy the copied ones are not updated?
Regards Patrick
Hello Int3g3r,
Thank you for reaching community forum. Yes, Only one policy can be applied for server and endpoint clients, and it’s impossible to enforce two policies simultaneously.
When updating a certain policy like base policy. The changes will only apply to the base policy it self and not to the other policies available on your central.
When you clone the base policy, what is currently applied to the policy settings is the only setting that will be carried on once you clone the policy. Any additional changes after performing the clone will not going to reflect the cloned policy. So if you wish to apply new settings for your existing server, you need to apply them to the existing policy wich your server is currently using.
Hello David Sain1,
sorry, but this idea isn't new (as you likely have guessed anyway 
).
Whether inheritance or multiple assignment it makes things much more complex.
Take the case of the OP: An exception is added to the base policy, For some reason you do not want that it takes effect on a certain server. For this to work you'd need to be abler to either
• turn off inheritance in a "later" policy - though you'd have to copy the existing exceptions and have to remember that changes in "earlier" policies no longer apply to this one. Same situation as now
or
• specify an opposite for every setting - likely less problems than with inheritance but you still have to check the "later" policies
Stacking more than two GPOs that affect the same policy is IMO not a really good idea. You can do a lot with AD, GPOs, filters ... - and you can do a lot of nonsense and even harm. Thus in addition to multiple policies you need the equivalent of RSOP. Can be done but ....:
As protection policies should not be changed frequently or on a regular basis and also kept as few as possible and as close as possible to the recommended settings one policy is arguably the better concept when it comes to products like Central.
Christian
Hello Int3g3r,
You can use global exclusion if you want to exclude some processes to all of your client's devices and servers. You don't need to add exclusion to each of your policies.
