Parent/Child groups Endpoint Upgrade Policy

[verasme]

I have a group and child groups. I can separately assign Endpoint versions to each group in the Product Updates section of their respective policy object. If I set the policy at the parent group to offer a new version of the Endpoint in the Product Updates section, and then set the product version in the policy for the child group to None will the child group receive the updates set by the policy at the parent group?

[Ken Stieers]

No...There is no policy inheritance in the Secure Endpoint

[johnosn · Accepted solution]

The endpoint version is not set on the group, but on the policy and you do not need to set a unique policy for every distinct group. If you want this to work, then you would specify the policy at the parent group and then have the child groups inherit the policy.

Scenario

You have the following groups:

• "Workstation Parent Group"
  • "Workstation Child Group - HR"
  • "Workstation Child Group - IT"

You also have a single policy:

• "Workstation Policy"

Both of the workstation child groups are nested under the workstation parent group.

On the "Workstation Parent Group" you would assign the "Workstation Policy".

On both of the workstation child groups you would set the policy as "Inherited Policy (Workstation Policy)"

Then when you change the version on the "Workstation Policy" it would be deployed to the parent and all child groups that are set to inherit that policy.

Policies get deployed as a single XML file to the connector software. The Cisco Secure Endpoint console will not allow you to only let a portion of the policy be inherited. It is all of that policy or none of that policy.