Vector PC-Duo Gateway Manual page 119

The user-specific security policy is applied first.
1
The group security policy for any group to which the user belongs is applied next.
2
The remote machine security policy is applied next.
3
The group security policy for any group to which the remote machine belongs is
4
applied last.
For each security policy, denied access to features takes precedence over allowed
access.
Effective security and managed Host group security policies
When applying a security policy to a group of managed Hosts, note the following:

Every managed Host belongs to the
Security for the
All Hosts
default access and control policy allows domain Administrators full control to all managed
Hosts.

Create any number of groups, and assign Gateway Hosts to them. You may want to
use groups to locate specific managed Hosts easily, or to group them in logical ways.
Additionally, when you assign access rights at the group level, you can assign the same
security policy to a group of related managed Hosts.

Assign managed Hosts to one or more groups. Group security policies that you assign
are aggregated in the effective security calculation, with all group-level deny-type rules
taking precedence over allow-type rules. Consequently, the group security contribution to
the effective security of a managed Host is calculated using all of the group managed
Host policies obtained from all of the groups to which the managed Host belongs.
Session security
Configure security for completed recording sessions of a specific Host by selecting the
tab on the Properties window for that Host.
Session Security
NOTE: The security features described in this section are identical to those described in
"Session security for a group", except that in this case they apply only to the selected
managed Host.
All Hosts
group, the security policy applies to all managed Hosts. The
Gateway Configuration
group. When you configure Host
119