Windows Group Policy creation issue

[MaxMyg]

Good day.
I'm trying to create Local Group Policy as well as Active Directory Group Policy and receive the message "Unable to detect ZCC Helper on this device". But ZCC Helper is installed and I can connect to devices via Remote Control. My OS is Windows Server 2012R2 with IE11. Any suggestions?

[MaxMyg]

Very strange. ZCC Helper works if I connect to ZENworks server via IP address but not via DNS name.

[thsundel]

MaxMyg;2477968 wrote:
Very strange. ZCC Helper works if I connect to ZENworks server via IP address but not via DNS name.

Are you connecting with the complete DNS name or a short one, see here: https://www.novell.com/support/kb/doc.php?id=7018704

Thomas

[MaxMyg]

Thanks! I've tried to connect with short DNS name.

[CRAIGDWILSON]

Note 1: Though the TID does not reflect it, This was fixed in ZCM 2017 Update 1. (Update 2 Is the Current Patch Level.)

Note 2: I would focus more on "Local Group Policies".
The "Active Directory Group Policy" option is a less used feature.

In either case, the Policies are processed using the Local Group Policy Processor, so the "AD" option does not extend the possible settings that can be controlled.
Further, once imported, they settings cannot be edited as the "Local Group Policy" settings can.
ADM or ADMx files can be used to extend available GPO settings beyond default options.

In General, Customers for whom most of their devices are in AD, tend to use Native AD Group Polices.
Customers tend to use the the GPO feature for devices for either Devices that are not in an AD Domain or perhaps for all of their devices (including Domain Joined) if only a moderate subset are in the Domain to allow for a consistent management option.

thsundel;2477981 wrote:
Are you connecting with the complete DNS name or a short one, see here: https://www.novell.com/support/kb/doc.php?id=7018704

Thomas

[MaxMyg]

Thanks for your explanation! I'm going to use Local Group Policies now.

[MaxMyg]

One question about ZENworks Agent Technician Application window. We can see Device-Assigned Policies and User-Assigned Policies. However when I assign Local Group Policy not to User but to Active Directory user's group I don't see that policy as User-Assigned or Device-Assigned. I can see just directly assigned Policies for user and device. Is it a correct behavior?
P.S.: policy works correctly.

[thsundel]

MaxMyg;2478063 wrote:
One question about ZENworks Agent Technician Application window. We can see Device-Assigned Policies and User-Assigned Policies. However when I assign Local Group Policy not to User but to Active Directory user's group I don't see that policy as User-Assigned or Device-Assigned. I can see just directly assigned Policies for user and device. Is it a correct behavior?
P.S.: policy works correctly.

Good question, I don't think I ever assigned to a group so I can't say but does it show if you run "zac pl --all" in cmd?

Thomas

[MaxMyg]

All policies became visible both in Agent's window and via "zac pl --all" after managed desktop reboot 🙂

[thsundel]

MaxMyg;2478070 wrote:
All policies became visible both in Agent's window and via "zac pl --all" after managed desktop reboot 🙂

Great, or maybe just a refresh of the agent might had aslo helped.

Thomas

[MaxMyg]

I always refresh agent after all deployments and changes ...and do it many times 🙂 Now I have strange notification for one of the managed desktops. I can see in ZCC red icon and message "Message status: Normal. Device status: Bundle and/or policy enforcement failed on one or more items". May be there is any way to clear that status?

[thsundel]

MaxMyg;2478072 wrote:
I always refresh agent after all deployments and changes ...and do it many times 🙂 Now I have strange notification for one of the managed desktops. I can see in ZCC red icon and message "Message status: Normal. Device status: Bundle and/or policy enforcement failed on one or more items". May be there is any way to clear that status?

Tried clearing the message log for the device?

Thomas

[MaxMyg]

Is it "Message Cleanup..." in ZCC? Yes. I've tried.

[thsundel]

MaxMyg;2478075 wrote:
Is it "Message Cleanup..." in ZCC? Yes. I've tried.

Okay, I just tried to acknowledge & delete the messages for one device and it turned "green" again. Maybe a refresh is needed 😉

Thomas

[CRAIGDWILSON]

In the ZCC, Try going to Configuration->Infrastructure Management->Assignment Optimization Settings and disable.

This can sometimes cause a delay in seeing assignments.
Generally it is only useful in the largest of organizations.
In smaller setups, it can just cause some confusion of what some assignments are not seen right away.

In short, When enabled, pre-calculated assignments for devices and hands those out instead of calculating on the fly.
Calculation usually only takes about 0.1 Seconds....so really does not help much.

If you had 10,000s of devices and all wanted them to update at the exact same time.....even saving 0.1 seconds could be valuable but in normal use case little value is added.