Policy Types

Each policy in the Policy List is displayed with an icon to indicate its type or if it is in Edit Mode.

The policy icon can be any of the following:

  1. System Policy: Applies to all users and all searches on an endpoint. Users of the Agent software are not able to modify a setting if that setting is defined in this policy. A setting defined in a System policy overrides the value of a setting in any other policy type. For example, if a setting is defined in a User Default policy and the same setting is defined in System policy with a different value, the System policy value is used as it is authoritative. A System policy is the only policy type that allows Global Ignore Lists to be assigned.
  2. User Default Policy: Applies only the first time the Agent software is run on each endpoint (unless specific settings are configured in a System policy). The user is able to modify their configuration for any setting defined in this policy. These policies are most commonly used to specify settings that are different than the internal application defaults, but that still allow the user to change those settings. User Default policies do not support the use of Global Ignore Lists or Scheduled Tasks.
  3. Scheduled Task Policy: Applies only to the scheduled tasks defined within the policy itself. The policy is only effective during those scheduled searches that are part of this policy. If there is a System policy applied to the same endpoints as this policy, the System settings take precedence. Scheduled Task policies do not support the use of Global Ignore Lists.
  4. Edit Mode: When a policy is in edit mode, changes to the policy are not applied to the endpoints. When exiting edit mode, the option is presented to save or discard any changes. If the changes are saved, the endpoints receive those changes the next time they poll.