hmLoadTopic({
hmKeywords:"flags",
hmTitle:"Flags",
hmDescription:"When merging policies, you can change the behavior by using policy flags. Flags define how a setting will be handled by the policy.",
hmPrevLink:"admin_pol_policies_wizard.html",
hmNextLink:"admin_pol_manage_policies.html",
hmParentLink:"admin_pol.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; <a href=\"admin_pol.html\">Policies<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > Policies > Flags",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Flags<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">When merging policies, you can change the behavior by using policy flags. Flags define how a setting will be handled by the policy.<\/p>\n\r<p class=\"p_Normal\">For each setting, you can select one of the following flags:<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Not apply policy flag\" title=\"Not apply policy flag\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_no_apply_policy.png\"\/> <span class=\"f_UI\">Not apply<\/span>—Any setting with this flag is not set by policy. Because the setting is not forced, it can be changed by other policies later on.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Apply\" title=\"Apply\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_apply_policy.png\"\/> <span class=\"f_UI\">Apply<\/span>—Settings with this flag will be sent to the client. However, when merging policies, it can be overwritten by a later policy. When a policy is applied to a client computer and a specific setting has this flag, that setting is changed regardless of what was configured locally on the client. Because the setting is not forced, it can be changed by other policies later on.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"The Force flag\" title=\"The Force flag\" width=\"15\" height=\"16\" style=\"margin:0;width:15px;height:16px;border:none\" src=\".\/images\/icon_force_policy.png\"\/> <span class=\"f_UI\">Force<\/span>—Settings with the Force flag have priority and cannot be overwritten by a later policy (even if the later policy has a Force flag). This assures that this setting won’t be changed by later policies during merging.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Normal\">Using the <img alt=\"The Force flag\" title=\"The Force flag\" width=\"15\" height=\"16\" style=\"margin:0;width:15px;height:16px;border:none\" src=\".\/images\/icon_force_policy.png\"\/> <span class=\"f_UI\">Force<\/span> flag selectively on individual settings can break the configuration consistency. To ensure an expected final state, the <img alt=\"The Force flag\" title=\"The Force flag\" width=\"15\" height=\"16\" style=\"margin:0;width:15px;height:16px;border:none\" src=\".\/images\/icon_force_policy.png\"\/> <span class=\"f_UI\">Force<\/span> flag must be applied consistently across all related policy settings. Otherwise, the partial enforcement can lead to the application of the related settings from other policies.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">To make navigation easier, all rules are counted. The number of rules you have defined in a specific section will be displayed automatically. Also, you will see a number next to the category names in the tree. This shows a sum of rules in all its sections. This way, you will quickly see where and how many settings\/rules are defined.<\/p>\n\r<p class=\"p_Normal\">You can also use the following suggestions to make policy editing easier:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Use <img alt=\"Apply\" title=\"Apply\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_apply_policy.png\"\/> to set the <\/span><span class=\"f_UI\">Apply<\/span><span class=\"f_NormalList\"> flag to all items in a current section<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>Use <img alt=\"Not apply policy flag\" title=\"Not apply policy flag\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_no_apply_policy.png\"\/> <span class=\"f_UI\">Not apply<\/span> flag to delete rules applied to the items in the current section.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Normal\">See also <a href=\"admin_pol.html#policy_removal_rules\" class=\"topiclink\">policy removal rules<\/a>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"policy_combine\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">How can Administrator allow users to see all policies<\/span><\/h2>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_example\" >\n\r<tr class=\"Table_example\">\n\r<td class=\"Table_example\" style=\"width:4px; background-color:#77BB1A;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_example\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Example\" title=\"Example\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/example.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_example\"><p class=\"p_Normal\"><span class=\"f_Path\">Administrator<\/span> wants to allow user <span class=\"f_Path\">John<\/span> to create or edit policies in his home group and allow <span class=\"f_Path\">John<\/span> to see policies that are created by <span class=\"f_Path\">Administrator<\/span>. Policies created by <span class=\"f_Path\">Administrator<\/span> include <img alt=\"The Force flag\" title=\"The Force flag\" width=\"15\" height=\"16\" style=\"margin:0;width:15px;height:16px;border:none\" src=\".\/images\/icon_force_policy.png\"\/> <span class=\"f_UI\">Force<\/span> flags. User <span class=\"f_Path\">John<\/span> can see all policies, but cannot edit policies created by <span class=\"f_Path\">Administrator<\/span> because <span class=\"f_UI\">Read<\/span> permission for <span class=\"f_UI\">Policies<\/span> with access to Static Group <span class=\"f_Path\">All<\/span> is set. User <span class=\"f_Path\">John<\/span> can create or edit policies in his Home Group <span class=\"f_Path\">San Diego<\/span>.<\/p>\n\r<p class=\"p_Normal\"><span class=\"f_Path\">Administrator<\/span> must follow these steps:<\/p>\n\r<p class=\"p_UI\"><span class=\"f_UI\">Create environment<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span><span class=\"f_NormalList\">Create a new <a href=\"admin_create_new_static_subgroup.html\" class=\"topiclink\">Static Group<\/a> called <\/span><span class=\"f_Path\">San Diego<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span><span class=\"f_NormalList\">Create new <a href=\"admin_ar_permissions_sets.html\" class=\"topiclink\">Permission set<\/a> called <\/span><span class=\"f_Path\">Policy—All John<\/span><span class=\"f_NormalList\"> with access to Static Group <\/span><span class=\"f_Path\">All<\/span><span class=\"f_NormalList\"> and with <\/span><span class=\"f_UI\">Read<\/span><span class=\"f_NormalList\"> permission for <\/span><span class=\"f_UI\">Policies<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span><span class=\"f_NormalList\">Create a new <a href=\"admin_ar_permissions_sets.html\" class=\"topiclink\">Permission set<\/a> called <\/span><span class=\"f_Path\">Policy John<\/span><span class=\"f_NormalList\"> with access to Static Group <\/span><span class=\"f_Path\">San Diego<\/span><span class=\"f_NormalList\">, with functionality access <\/span><span class=\"f_UI\">Write<\/span><span class=\"f_NormalList\"> permission for <\/span><span class=\"f_UI\">Group &amp; Computers<\/span><span class=\"f_NormalList\"> and <\/span><span class=\"f_UI\">Policies<\/span><span class=\"f_NormalList\">. This permission set allows <\/span><span class=\"f_Path\">John<\/span><span class=\"f_NormalList\"> to create or edit policies in his Home Group <\/span><span class=\"f_Path\">San Diego<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 39px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>Create new <a href=\"admin_ar_create_native_user.html\" class=\"topiclink\">user<\/a> <span class=\"f_Path\">John<\/span> and in <span class=\"f_UI\">Permission Sets<\/span> section select <span class=\"f_Path\">Policy—All John<\/span> and <span class=\"f_Path\">Policy John<\/span>.<\/p>\n\r<p class=\"p_UI\"><span class=\"f_UI\">Create policies<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span><span class=\"f_NormalList\">Create a new <a href=\"admin_pol_policies_wizard.html#create\" class=\"topiclink\">policy<\/a> <\/span><span class=\"f_Path\">All—Enable Firewall<\/span><span class=\"f_NormalList\">, expand <\/span><span class=\"f_UI\">Settings<\/span><span class=\"f_NormalList\"> section, select <\/span><span class=\"f_UI\">ESET Endpoint for Windows<\/span><span class=\"f_NormalList\">, navigate to <\/span><span class=\"f_UI\">Network protection<\/span><span class=\"f_NormalList\"> &gt; <\/span><span class=\"f_UI\">Firewall<\/span><span class=\"f_NormalList\"> &gt; <\/span><span class=\"f_UI\">Basic<\/span><span class=\"f_NormalList\"> and apply all settings by <img alt=\"The Force flag\" title=\"The Force flag\" width=\"15\" height=\"16\" style=\"margin:0;width:15px;height:16px;border:none\" src=\".\/images\/icon_force_policy.png\"\/> <\/span><span class=\"f_UI\">Force<\/span><span class=\"f_NormalList\"> flag. Expand the <\/span><span class=\"f_UI\">Assign<\/span><span class=\"f_NormalList\"> section and select Static Group <\/span><span class=\"f_Path\">All<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 39px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">6.<\/span>Create a new <a href=\"admin_pol_policies_wizard.html#create\" class=\"topiclink\">policy<\/a> <span class=\"f_Path\">John Group—Enable Firewall<\/span>, expand <span class=\"f_UI\">Setting<\/span> section, select <span class=\"f_UI\">ESET Endpoint for Windows<\/span>, navigate to <span class=\"f_UI\">Network protection<\/span> &gt; <span class=\"f_UI\">Firewall<\/span> &gt; <span class=\"f_UI\">Basic<\/span> and apply all settings by <img alt=\"Apply\" title=\"Apply\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_apply_policy.png\"\/> <span class=\"f_UI\">Apply<\/span> flag. Expand the <span class=\"f_UI\">Assign<\/span> section and select Static Group <span class=\"f_Path\">San Diego<\/span>.<\/p>\n\r<p class=\"p_UI\"><span class=\"f_UI\">Result<\/span><\/p>\n\r<p class=\"p_Normal\">Policies created by <span class=\"f_Path\">Administrator<\/span> will be applied first because they are assigned to group <span class=\"f_Path\">All<\/span>. Settings with the <img alt=\"The Force flag\" title=\"The Force flag\" width=\"15\" height=\"16\" style=\"margin:0;width:15px;height:16px;border:none\" src=\".\/images\/icon_force_policy.png\"\/> <span class=\"f_UI\">Force<\/span> flag have priority and cannot be overwritten by a later policy. Then policies created by user <span class=\"f_Path\">John<\/span> will be applied.<\/p>\n\r<p class=\"p_Normal\">Navigate to <span class=\"f_UI\">More<\/span> &gt; <span class=\"f_UI\">Groups<\/span> &gt; <span class=\"f_UI\">San<\/span> <span class=\"f_UI\">Diego<\/span>, click the computer and select <span class=\"f_UI\">Details<\/span>. In <span class=\"f_UI\">Configuration<\/span> &gt; <span class=\"f_UI\">Applied policies<\/span> is the final policy application order.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"The order of applied policies\" title=\"The order of applied policies\" width=\"530\" height=\"130\" style=\"margin:0;width:530px;height:130px;border:none\" src=\".\/images\/admin_policy_flags_example.png\"\/><\/p>\n\r<p class=\"p_Normal\">The first policy is created by <span class=\"f_Path\">Administrator<\/span> and the second created by user <span class=\"f_Path\">John<\/span>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><span class=\"f_UI\">Home Group<\/span> is automatically detected based on the assigned permission sets of the currently active user.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_example\" >\n\r<tr class=\"Table_example\">\n\r<td class=\"Table_example\" style=\"width:4px; background-color:#77BB1A;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_example\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Example\" title=\"Example\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/example.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_example\"><p class=\"p_Example_heading\" style=\"page-break-after: avoid;\"><span class=\"f_Example_heading\">Example scenario:<\/span><\/p>\n\r<p class=\"p_Normal\">The currently active user account has the <span class=\"f_UI\">Write<\/span> access right for <span class=\"f_UI\">Software Install Client Task<\/span> and the user account <span class=\"f_UI\">Home Group<\/span> is &quot;Department_1&quot;. When the user creates a new <span class=\"f_UI\">Software Install Client Task<\/span>, &quot;Department_1&quot; will be automatically selected as the client task <span class=\"f_UI\">Home Group<\/span>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">If the pre-selected Home Group does not meet your expectations, you can select the Home Group manually.<\/p>\n\r"
})
