topic AMP for Endpoints Parent-Child Group Inheritance in Endpoint Security

AMP for Endpoints Parent-Child Group Inheritance

rick505d3 — Fri, 12 Feb 2021 01:30:31 GMT

Hi,

I want to clarify the settings inheritance between parent and child groups.

Parent Group: Org Group1

Windows Policy: Base Windows Policy

Mac Policy: Base Mac Policy

....

Child Group: Finance

Windows Policy: Finance Windows Policy

Mac Policy: --none-- (inherit from parent)

For computers assigned to the Finance group, it's clear the Mac Policy from the parent is inherited by the child group and will take effect. What about the Windows policy. Are the settings completely overridden and only the child 'Finance Windows Policy' is in effect, OR child still inherits and merges any settings from the parent group as applicable? For example, I may have generic Windows exclusions defined in Base Windows Policy, but a further few extra exclusions are needed for Finance users.

Regards,

Rick.

Re: AMP for Endpoints Parent-Child Group Inheritance

Oliver Kaiser — Fri, 12 Feb 2021 14:15:41 GMT

Settings are being overriden, the parent and child policy are not being merged.

Re: AMP for Endpoints Parent-Child Group Inheritance

jalcalagarcia — Fri, 16 Jun 2023 10:37:19 GMT

Sorry I have a related doubt. In this case Parent Policy Override child policy or Child Policy is more restrictive? If I look the computer, the applied policy Is that is configured on the group it belong not the policy on the Parent group.

Thanks

Re: AMP for Endpoints Parent-Child Group Inheritance

Ken Stieers — Fri, 16 Jun 2023 14:32:18 GMT

There is no policy merge. If you apply a policy to a child group, the whole thing applies, no matter if one is more restrictive.