Virtual Groups In Policy Rules; Why Use Virtual Groups - Check Point HARMONY R81 Administration Manual

Virtual Groups in Policy Rules

You can use these types of groups in SmartEndpoint:
n Active Directory group - These are synchronized automatically from Active Directory
using the Directory Scanner. You cannot modify an Active Directory group.
Virtual group - Create these in SmartEndpoint or use one of the predefined virtual
n
groups. There are two types of virtual group:
Virtual Group
l
Computer Group
l
Virtual Groups work like Active Directory groups. You can:
n Create groups and then add users and computers to the groups automatically or
manually.
n Assign policies to virtual groups or users.
n Put users and computers into more than one group.
n Select which policies have priority for endpoints that belong to more than one virtual
group.
You can use Virtual Groups with Active Directory for added flexibility or as an alternative to
Active Directory.
Members of Active Directory OUs or groups can also be members of Virtual Groups.
Important - You can use virtual groups to manage computers and servers in all
environments. To manage users with a virtual group, you must do one of these steps:
Use Full Disk Encryption and enable User Acquisition.
n
n Import objects into Endpoint Security with the Active Directory Scanner. Then,
you can move them between virtual groups manually.
For each Endpoint Security component, only one rule can be assigned to a user or computer.
Therefore, if a user belongs to more than one group, with a different rules assigned to each
group, the Endpoint Security Management Server applies the first rule that matches the users
or computer.

Why Use Virtual Groups

You may want to use Virtual Groups if you are:
- Can contain users and computers.
- Can contain only computers.
R81 Harmony Endpoint Server Administration Guide | 152
Virtual Groups in Policy Rules