Enterprise Administration Guide › Managing Policies Centrally › Hosts and Host Groups › Assignment Paths

Assignment Paths

An assignment path describes a policy assignment to a specific host or host group. A policy can be assigned to a host by the following paths:

• A policy is directly assigned to a host.
• A policy is assigned to a host group of which a host is a member.
• A host is joined to a host group that has one or more policies assigned to it.

Assignment paths are important because when multiple assignment paths exist it impacts advanced policy management, as follows:

• If you remove an assignment path, CA ControlMinder does not undeploy the policy because the other assignment paths between the host and the policy still exist.
• If you add an assignment path, a deployment package and deployment tasks are created for tracking and administrative purposes. However, the deployment task has the status of No Action, and so does not initiate policy deployment on the endpoint.

Example: Multiple Assignment Paths for Policy IIS

The following illustration shows an example of multiple assignment paths for policy IIS. Host host1.comp.com is a member of the host group Servers. Path 1 shows the assignment path when you directly assign policy IIS to the host host1.comp.com. Path 2 shows the assignment path when you assign policy IIS to the host group Servers:

Example: Remove an Assignment Path

In the previous illustration, policy IIS is assigned to the host group Servers and to the host host1.comp.com. If you remove host1.comp.com from the Servers host group, you remove Path 2. However, CA ControlMinder does not undeploy policy IIS from host1.comp.com, because the policy is still directly assigned to the host (Path 1).