Environment
- App Control Console: All Supported Versions
- App Control Agent: All Supported Versions
Objective
How to tell who, or what changed a device's policy
Resolution
In the Events page, filter on the Subtype "Computer Modified". This event contains multiple items which will help understand why a device moved policies.
- Computer was moved by a user:
Computer '$computer$' was moved into the Policy '$policyName$' by '$username$'.
- Computer was moved by automatic policy (such as Active Directory Policy Mapping)
Computer '$computer$' was modified by '$username$' to use automatic Policy assignment.
- Moved back to a policy from Local Approval Mode:
Computer '$computer$' was restored to its previous Policy by '$username$'.
Additional Notes
- If a device is being moved automatically it is generally because of an Event Rule or Active Directory Policy Mapping
- Check under Rules>Event Rules to see if there are any rules that have an action of "move computer" to another policy
Related Content
