52
automatically added to this group when they match the conditions, but will never be removed. The content of a sticky
group can be reset manually at the root level.
NOTE:
This parameter can only be set when creating a new group.
To edit an existing group, simply select it from the Parametric Groups list and then press the
Edit...
button in the
bottom of the window. For group deletion, select the desired group and press the
Delete
button.
You can manually refresh the group list by pressing the
Refresh
button. To import a group from a file select a group in
the
Parametric Groups
section under which you want the new group to be imported and click the
Import...
button.
Confirm your selection by clicking
Yes
. Locate the file you want to import and click
Open
. The group (and all of its
subgroups) will be imported under the selected location. To export a group (and all of its subgroups) select it in the
Parametric Groups
section, click the arrow on the
Import...
button and select
Export...
Confirm by clicking
Yes
, select
a name and a location for your export file and click
Save
.
NOTE:
You can use your mouse to drag and drop groups already in the
Parametric Groups
section.
5.2.3 Active Directory Synchronization
The Active Directory Synchronization uses automatic group creation (with corresponding clients) based on the
structure defined by Active Directory. It allows the administrator to sort clients to groups, as long as the client name
matches the object type
computer
at the side of Active Directory (AD) and belongs to groups in the AD.
There are two main options that determine the manner of synchronization:
The
Synchronize groups
option allows you to choose which AD groups will be synchronized. The
All groups
option
results in synchronization of the complete AD tree structure whether or not the AD groups contain ERA clients. The
next two options (
Only groups containing ERA Server clients
and
Only groups containing ERA primary server
clients
) mean stricter synchronization and result in the synchronization of only groups containing existing ERA clients.
With the
Synchronization type
option you define whether the AD groups to be synchronized will be added to the
existing AD groups (
AD groups import
) or if the existing AD groups will be completely replaced by those to be
synchronized (
AD groups synchronize
).
The
Synchronize
option allows you to schedule the AD synchronization to a certain time interval.
Detailed configuration of Active Directory synchronization can be done using the Configuration Editor (
ESET Remote
Administrator
>
ERA Server
>
Setup
>
Groups
>
Active Directory Synchronization options
). By default, only
Computer security groups and Computer organization units
are synchronized. However, you can add other Active
Directory objects by checking the desired option.
NOTE:
For ERAS to synchronize with Active Directory, ERAS does not need to be installed on your Domain Controller.
The Domain Controller only needs to be accessible from the computer where your ERAS is located. To configure
authentication to your Domain Controller, go to
Tools
>
Server Options
>
Advanced
>
Edit Advanced Settings
>
ESET Remote Administrator
>
ERA Server
>
Setup
>
Active directory
. The format of the server name is
LDAP://
servername
or
GC://servername
. When empty, global catalog (GC) is used.
5.3 Policies
Policies are in many ways similar to Configuration tasks, except they are not one-shot tasks sent to one or more
workstations. Rather, they provide continuous maintenance of certain configuration settings for ESET security
products. In other words, a Policy is a configuration that is forced to a client.
5.3.1 Basic principles and operation
Access the Policy Manager by selecting
Tools
>
Policy Manager...
The Policy Tree on the left lists the policies that are
present on individual servers. The right side is divided into four sections –
Policy settings
,
Policy configuration
,
Policy action
and
Global policy settings
– the options in these sections enable an administrator to manage and
configure policies.
The primary functions of the Policy Manager include creating, editing and removing policies. Clients receive policies
from ERAS. ERAS can use multiple policies which can inherit settings from each other or from policies from an upper
server.
The system of adopting policies from an upper server is called
inheritance
; policies that are created as a result of
inheritance are referred to as
merged policies
. Inheritance is based on the Parent – Child principle, i.e. a child policy
