Multiple policies active on single server

Hello Int3g3r,

Thank you for reaching community forum. Yes, Only one policy can be applied for server and endpoint clients, and it’s impossible to enforce two policies simultaneously. 
When updating a certain policy like base policy. The changes will only apply to the base policy it self and not to the other policies available on your central. 
When you clone the base policy, what is currently applied to the policy settings is the only setting that will be carried on once you clone the policy. Any additional changes after performing the clone will not going to reflect the cloned policy. So if you wish to apply new settings for your existing server, you need to apply them to the existing policy wich your server is currently using. 

New Idea!

Allow multiple policies to be applied.  Much like Group Policy Objects in Active Directory, each policy will have it's specific function and they layer on top of each other, the ones applied later taking precedence.

Hello David Sain1,

sorry, but this idea isn't new (as you likely have guessed anyway ).

Whether inheritance or multiple assignment it makes things much more complex.
Take the case of the OP: An exception is added to the base policy, For some reason you do not want that it takes effect on a certain server. For this to work you'd need to be abler to either
• turn off inheritance in a "later" policy - though you'd have to copy the existing exceptions and have to remember that changes in "earlier" policies no longer apply to this one. Same situation as now
or
• specify an opposite for every setting - likely less problems than with inheritance but you still have to check the "later" policies

Stacking more than two GPOs that affect the same policy is IMO not a really good idea. You can do a lot with AD, GPOs, filters ... - and you can do a lot of nonsense and even harm. Thus in addition to multiple policies you need the equivalent of RSOP. Can be done but ....:
As protection policies should not be changed frequently or on a regular basis and also kept as few as possible and as close as possible to the recommended settings one policy is arguably the better concept when it comes to products like Central.

Christian

But an option to merge policies would be nice.
Now if I want to exclude a process on all clients and servers I have to do this manually on all policies.
This is very tedious.
This only gets more tedious the more different policies you have created.

Hello Int3g3r,

You can use global exclusion if you want to exclude some processes to all of your client's devices and servers. You don't need to add exclusion to each of your policies. 

Perfect! Thank you!

https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/Overview/GlobalSettings/GlobalExclusions/index.html#exploit-exclusions

Perfect! Thank you!

https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/Overview/GlobalSettings/GlobalExclusions/index.html#exploit-exclusions