Environment
App Control Console: All Versions (was CB Protection)
Question
Why are App Control Agents policies to the Default policy when using AD mapping rules based on AD users?
Answer
- The App Control Agent policy assignment is based on the most recent active user sessions present on the system
- The user session changes every time any user logs on/off, when the session connects/disconnects
- Thus, when the current user logs off or disconnects then their user session is removed and the agent is automatically assigned to the [all others] Default Policy
- To avoid the policy flipping behavior, CB recommends using AD Mapping rules with specific AD Computers instead of AD Users
Additional Notes
- In case of a Multi user login, the most recent logged in user's policy is used; the previously logged in users will move to the default policy and hence we recommend to have computer specific policy instead of user specific one
- The [all others] config on the Policies Mapping tab is a catch all policy where all agents with no matching AD User sessions are assigned to
- The current active user sessions on a system can be displayed with:
dascli logonsessions
