Policies are used to push specific configurations to ESET products running on client computers. This allows you to avoid configuring each client's ESET product manually. A policy can be applied directly to individual Computers as well as groups (Static and Dynamic).

Policy application

Policies are applied in the order that Static Groups are arranged. This is not true for Dynamic Groups, where child Dynamic Groups are traversed first. This allows you to apply policies with greater impact at the top of the Group tree and apply more specific policies for subgroups. Using flags, an ECA user with access to groups located higher in the tree can override the policies of lower groups. The algorithm is explained in detail in How Policies are applied to clients.

Policy removal rules

When you have a policy in place and decide to remove it later on, the resulting configuration of the client computers will depend on the version of installed ESET security product on the managed computers:

ESET security products version 6 and older: The configuration will not automatically revert back to the original settings once the policy is removed. The configuration will remain according to the last policy that was applied to the clients. The same thing happens when a computer becomes a member of a Dynamic Group to which a certain policy is applied that changes the computer's settings. These settings remain even if the computer leaves the Dynamic Group. Therefore, we recommend that you create a policy with default settings and assign it to the root group (All) to have the settings revert to defaults in such a situation. This way, when a computer leaves a Dynamic Group that changed its settings, this computer will revert to default settings.

ESET security products version 7: When a policy is removed, the configuration will automatically revert back to the previous policy that was applied to the clients. When a computer leaves a Dynamic Group where particular policy setting were in place, these policy settings will be removed from the computer. icon_no_apply_policy Not apply flag turns individual policy settings to the default state on client computers.

Merging policies

A policy applied to a client is usually the result of multiple policies being merged into one final policy.



We recommend that you assign more generic policies (for example, the update server) to groups that are higher within the group tree. More specific policies (for example, device control settings) should be assigned deeper in the group tree. The lower policy usually overrides the settings of the upper policies when merged (unless defined otherwise using policy flags).