help
■
■
■
A member of the Distributed COM Users group on the server where the Enterprise Console management server is installed. (The Distributed COM Users group is located in the Builtin container of the Active Directory Users and Computers tool.)
Assigned to at least one Enterprise Console role.
Assigned to at least one Enterprise Console sub-estate.
4.2 Creating and using groups
You must create groups and place computers in them before you can protect and manage those computers.
4.2.1 What are groups for?
Groups are useful because you can:
■
Have computers in different groups updated from different sources or on different schedules.
■
■
Use different anti-virus and HIPS, application control, firewall, and other policies for different groups.
Manage computers more easily.
Tip: You can create groups within groups and apply a specific set of policies to each group and subgroup.
4.2.2 What is a group?
A group is a folder that holds a number of computers.
You can create groups yourself or you can import Active Directory containers, with or without computers, and use them as computer groups in Enterprise Console. You can also set up synchronization with Active Directory so that new computers and containers as well as other changes in Active Directory are copied into Enterprise Console automatically.
Each group has settings for updating, anti-virus and HIPS protection, firewall protection, and so on. All the computers in a group should usually use these settings, which are called a “policy.”
A group can contain subgroups.
4.2.3 What is the Unassigned group?
The Unassigned group is a group where Enterprise Console holds computers before you put them into groups.
You cannot:
■
Apply policies to the Unassigned group.
■
■
Create subgroups in the Unassigned group.
Move or delete the Unassigned group.
29
Sophos Enterprise Console
4.2.4 Create a group
If you use role-based administration, you must have the Computer search, protection and
groups right to perform this task. For more information, see Managing roles and sub-estates
(page 18).
To create a new group for computers:
1. In the Endpoints view, in the Groups pane (on the left-hand side of the console), select where you want to create the group.
Click the computer name at the top if you want to create a new top-level group. Click an existing group if you want to create a subgroup.
2. On the toolbar, click the Create group icon.
A “New Group” is added to the list, with its name highlighted.
3. Type a name for the group.
Updating, anti-virus and HIPS, application control, firewall, patch, data control, device control, tamper protection, and web control policies are applied to the new group automatically. You can
edit these policies, or apply different policies. See Edit a policy (page 36) or Assign a policy to a group (page 36).
Note: If the new group is a subgroup, it initially uses the same settings as the group it is within.
4.2.5 Add computers to a group
If you use role-based administration, you must have the Computer search, protection and
groups right to perform this task. For more information, see Managing roles and sub-estates
(page 18).
1. Select the computers that you want to add to a group. For example, click the Unassigned group and select computers there.
2. Drag and drop the computers onto the new group.
If you move unprotected computers from the Unassigned group to a group that has automatic updating set up, a wizard is launched to help you protect them.
If you move computers from one group to another, they will use the same policies as the computers already in the group they are moved to.
4.2.6 Delete computers from a group
If you use role-based administration, you must have the Computer search, protection and
groups right to perform this task. For more information, see Managing roles and sub-estates
(page 18).
You can delete computers from a group, for example, if you want to remove entries for computers that are no longer on the network.
Important: If you delete computers that are still on the network, they will no longer be listed or managed by the console.
30
help
If you’ve upgraded from an earlier version of Enterprise Console and have computers that are encrypted with legacy Enterprise Console–managed full disk encryption, do not delete these computers from the console. Encryption recovery may not be possible in this case.
To delete computers:
1. Select the computers that you want to delete.
2. Right-click and select Delete.
If you want to see the computers again, click the Discover computers icon on the toolbar. These computers will not be shown as managed until they are restarted.
4.2.7 Cut and paste a group
If you use role-based administration, you must have the Computer search, protection and
groups right to perform this task. For more information, see Managing roles and sub-estates
(page 18).
1. Select the group you want to cut and paste. On the Edit menu, click Cut.
2. Select the group where you want to place the group. On the Edit menu, click Paste.
4.2.8 Delete a group
If you use role-based administration, you must have the Computer search, protection and
groups right to perform this task. For more information, see Managing roles and sub-estates
(page 18).
Any computers that were in the deleted group will be placed in the Unassigned group.
1. Select the group you want to delete.
2. Right-click and select Delete. When prompted, confirm that you want to delete the group and, if the group has any subgroups, its subgroups.
4.2.9 Rename a group
If you use role-based administration, you must have the Computer search, protection and
groups right to perform this task. For more information, see Managing roles and sub-estates
(page 18).
1. Select the group you want to rename.
2. Right-click and select Rename.
4.2.10 Check which policies a group uses
To see which policies have been assigned to a group:
■
In the Groups pane, right-click the group. Select View/Edit Group Policy Details.
In the group details dialog box, you can see the policies currently used.
31
