A policy on a machine or a group
In the diagrams below, each numbered scheme illustrates the result of the respectively numbered action.
The container stands for a group; the colored circle stands for a machine with applied policy; the dark colored circle stands for a machine with two applications of the same policy; the white circle stands for a machine to which no policy is applied.
Policy on a machine
- A policy can be applied to a machine.
- A policy can be revoked from a machine.
Policy on a group
- A policy can be applied to a group.
- A policy can be revoked from a group.
- A policy applied to a group cannot be revoked from a machine.
- To revoke the policy from the machine, remove the machine from the group.
The same policy on a group and on a machine
- The same policy can be applied to a group and to a machine. Nothing changes on the machine at the second application of the same policy, but the server remembers that the policy has been applied twice.
- A policy, revoked from the group, remains on the machine.
- A policy, revoked from the machine, remains on the group and therefore on the machine.
- To completely revoke the policy from the machine, revoke it from both the group and the machine.
|