Is it possible to selectively clear policy objects for a machine?
I have a machine that I want to remove it's Patch Policy from it and then clear the Patch policy objects.
I don't believe so. When you remove a policy, it's settings remain applied to the agent until overridden with a new policy, or, manually set outside of policy (i.e. manual settings within the module).
A way around this may be to create a template account, with 'factory defaults' and apply this template to the agent, to "clear" the agent back to defaults.
We are in discussion with Kaseya however regarding this behavior.
Among other things we use Policy Management to set alarm sets (and alerts) and these were removed in past months on removing a server from a policy.This is confirmed behavior for anything from six to at least nine months now.As far as we've been able to determine this was introduced in version 8, when we really started using Policy Management.And stopped working again in version 9.2 - so we're discussing this with Kaseya now to determine how to handle this.
Strangely enough Kaseya was unable to confirm if and how this worked in previous versions.I did read the explanation given by Brande Schweitzer in another post on Policy Management.This confirms what you said Craig, Policy Management was meant to set certain settings, not to remove them.
It does seem logical and desirable to us that Kaseya would take care of removing settings it automatically set in Policy Management.Keeping Kaseya settings consistent would benefit enormously if policy management not only sets but also removes settings.
Thanks, Craig. That's what I was afraid of.
I agree with you, OudjesEric. You would think that removing a policy would remove the policy settings as well. Has this been suggested as a Feature Request?
Well, we found some very recent and rather surprising behavior on Policy Management.Since my last post we found at the start of the new year our Monitoring settings were removed after changing policy membership.This left us rather at sea about what is happening here and we're discussing this with Kaseya this afternoon.
So, that was what we were used to seeing and that was accepted behavior since around August 2015, it's hard to pinpoint now.It stopped working somewhere in December, could have been 188.8.131.52 that changed this.And rather unexpected it started working again this week, while we can't say we patched, rebooted, or reconfigured our VSA.
I'll update this after our discussion with Kaseya.
You are correct and I am sure Brande Schweitzer can verify that Policy Management was intended to apply settings, but not remove them.
I believe the only exception to this, which was a recent change (August 7th) to monitor sets - check out the 184.108.40.206 Patch release under Policy Management:
The fix was intended to only impact monitor sets, so I am not sure if this is directly related to what you are referencing.
Well, things are getting a bit hazy and why it's working now is anybody\s guess.Had a discussion about this with Kaseya and the 220.127.116.11 patch might throw some light on what happened.
In testing Policy Management Kaseya found when you're removing a machine from a policy with an alarm set, this will not remove alarm sets, as tested by two people from Kaseya. We do have that as a working feature and we're now on 18.104.22.168 - the latest patch level.
The unofficial communication from Kaseya is it should be supported that Policy Management should roll back the changes made, because it has been part of Kaseya for months as a feature.
Support people are now testing the how and why and following that Engineering will/should troubleshoot this to include it as a feature that removing a machine from a view will rollback the changes made by the policy.
I can only call this usefull and hope others are happy with that.
I just got an update that confirms in 22.214.171.124 it now works as follows and this should be considered default behaviour.If a machine is a member of a Policy that applies alarm sets (and alerts), they are now removed if the machine is removed from the policy.So changing the view will and should result in alarm sets (and alerts) being removed.
I don't have any input how things are with 9.1 and 9.0 versions, so am curious what happens on those versions.
We consider this a step forward and I do hope everybody else agrees.I'll keep in touch with Kaseya about this, so any input is welcome....