Relationship of User Policies to Users

Users are associated with user policies through associations with policies in any of three ways: 1) policies can be associated with the user object directly; 2) policies can be associated with a parent container of the user object; and 3) policies can be associated with a group to which the user is a member.

When a user logs into the tree, a ZENworks for Desktops 4 agent (Workstation Manager Service) walks up the tree looking for the first User Policy Package it can find that is associated with the user. Like all agents associated with ZENworks for Desktops 4, the order that the tree is searched is dependent on standard Novell Directory Services behavior and any search policies in the tree.

When a policy is being searched from the tree, the Workstation Manager agent walks the tree until it finds the root of the tree or a search policy that limits the searching. All of the applicable user policies are merged and then the culmination is applied to the workstation. If any policy conflicts exist (such as two user policies affecting the same parameter), the parameter setting in the first policy is applied.

The remote control policy can be created for both the user and the workstation. In the instances when a remote control policy exists for both the user and the workstation, the remote control subsystem takes the most restrictive combination of the policies. For example, if one policy says to prompt the user for permission and the other does not, the system prompts the user.