Enterprise Administration Guide › Managing Policies Centrally › Troubleshooting Policy Deployment

Troubleshooting Policy Deployment

When you assign a policy to a host, the policy is not deployed on the assigned endpoint until policyfetcher retrieves the deployment task and runs the policy script. As a result, deployment errors may occur for different reasons when the policy is transferred or deployed at the endpoint.

To resolve policy deployment errors, advanced policy management provides you with troubleshooting actions. You can perform these actions using either CA ControlMinder Enterprise Management or the policydeploy utility. In CA ControlMinder Enterprise Management, the troubleshooting actions are located in the Policy sub-tab of the Policy Management tab.

The troubleshooting actions are as follows:

• Redeploy—Creates a new deployment task that contains the policy script and deploys the task to the endpoint.

  Use this option when the policy deploys on the endpoint with errors. That is, selang policy script execution failed. You need to manually fix the reason for the script error on the endpoint before you can redeploy the policy.

  Note: This option is only available in CA ControlMinder Enterprise Management, and is not supported in the policydeploy utility.

• Undeploy—Undeploys the policy from the specified endpoint without unassigning the policy from the corresponding host.

  Use this option to remove any policies from the endpoint that are not assigned to the host on the DMS.

• Reset—Resets an endpoint. CA ControlMinder resets host status, undeploys all effective policies, and deletes all GPOLICY, POLICY, and RULESET objects.

  Use this option to clean an endpoint, and its status on the DMS, from all policy deployments.

  Note: This option does not remove DEPLOYMENT or GDEPLOYMENT objects from the endpoint or from the DMS, because you may need these objects for auditing purposes. You can use the dmsmgr -cleanup function to remove the DEPLOYMENT and GDEPLOYMENT objects after you reset the endpoint. After you reset an endpoint, you can assign policies to the endpoint as normal.

• Restore—Undeploys any policies on the specified host, then restores all the policies that should be deployed (assigned or directly deployed) on the host by creating new deployment tasks and sending the tasks to the host for execution.

  Use this option when you re-install CA ControlMinder or the operating system on the endpoint, or when you restore an endpoint from a backup, to redeploy all the policies that the DMS indicates are effective on that endpoint.