Policies assigned to groups - membership changes not working

Question

I have a single ZESM IR8 server setup.
All security throughout my environment, ZESM and otherwise, is based on group membership.
If I change a user from one group to another group this change does not reflect in their policy assignment.
Scenario: GroupA = standard user policy, GroupB = power user policy.
UserA was first in Group A and therefore got the standard user policy.
UserA now requires the power user policy.
Remove UserA from GroupA and add UserA to GroupB (in iManager).
UserA does NOT get the "power user" policy that is assigned to GroupB
Am aware that I can assign the policy at a user level but this is NOT an option in my environment. All security assignments MUST happen at a group level.

Answer 1

What you observed is the expected behavior.
ZESM doesn't updates group membership in real time once a policy has been published. I've described this behavior on previous posts.
What the MC does behind the scenes when you click "Publish" on a container or group object is to assign the policy individually to each member/user. For groups, it resolves membership at the time the policy is published then the MC iterates among each member assigning the policy to each of them. That's why you don't see updates once the policy is published.
Try Updating the published policy to see if that works. From the docs:
Updating a Published Policy
Once a policy has been published to the user(s) or computer(s), simple updates can be maintained by editing the components in a policy, and re-publishing. For example, if the ZENworks Endpoint Security Management Administrator needs to change the WEP key for an access point, the adminstrator only needs to edit the key, save the policy, and click Publish. The affected end-users and computers receive the updated policy (and the new key) at their next check-in.
>>>
From: laurabuckley<[email protected]>
To:novell.support.zenworks.endpoint-security-management
Date: 12/15/2009 7:16 AM
Subject: Policies assigned to groups - membership changes not working
I have a single ZESM IR8 server setup.
All security throughout my environment, ZESM and otherwise, is based on
group membership.
If I change a user from one group to another group this change does not
reflect in their policy assignment.
Scenario: GroupA = standard user policy, GroupB = power user policy.
UserA was first in Group A and therefore got the standard user policy.
UserA now requires the power user policy.
Remove UserA from GroupA and add UserA to GroupB (in iManager).
UserA does NOT get the "power user" policy that is assigned to GroupB
Am aware that I can assign the policy at a user level but this is NOT
an option in my environment. All security assignments MUST happen at a
group level.
laurabuckley
laurabuckley's Profile: http://forums.novell.com/member.php?userid=122
View this thread: http://forums.novell.com/showthread.php?t=395870