Determining the Resultant Set of Policies

Determining the Resultant Set of Policies

The final area to discuss regarding MetaFrame user policies is the way you can determine the effective policies being applied to an IP address, client name , user, or server. You perform this task by using the Search function of user policies. By right-clicking the Policies object and selecting Search, you are presented with the dialog box shown in Figure 7.8.

Figure 7.8. You can search user policies to determine whether one or more policies apply to a particular user connection.

By specifying the desired search criteria, you can retrieve a list of all policies meeting that criteria. For example, you could search on a particular user ID or group name and receive a list of policies that apply to that user or group . To determine the exact set of policies that apply in a given situation, you need to include all the appropriate criteria. For example, you need to include the IP address of the network the user is on, the name of the user's device, the MetaFrame server he or she is logged on to, and the user's actual username. If you omit any information from the query, you receive only a partial match. Providing all this information does not guarantee that a particular policy will apply in all situations, because, for example, it may have a Deny setting included for a particular server that would not be captured by the search.

To view the specific settings based on the resultant set, you must provide all necessary search criteria. Otherwise, when you calculate the resultant set, it will show the rules that may be affected but will not display the actual setting for that rule (enabled or disabled).

After you initiate a search, a list of matching policies is returned. There are a couple of different tasks that you can now perform. You can view the properties of the listed policies and edit rules directly, without having to load up the policy from the main Policies window. You can also calculate the resultant set of policies.

To perform these tasks, you must ensure that the Include check box appears beside each policy you want included in the resultant calculation and that the Partial column does not contain a warning exclamation mark. If it does, the resultant policy calculation will not be able to return the proper results. If this partial column is not flagged, you can click the View Resultant Policy button. A new dialog box opens showing only those policy rules currently in effect. Figure 7.9 demonstrates what this window may look like. As you can see, it displays only those policy categories and resulting rules in effect based on the search criteria provided.

Figure 7.9. After you provide all the necessary search criteria, you can view the resultant set of policies to determine which rules are in effect for a particular user.

If search criteria were omitted or produce ambiguous results, you cannot view the specific setting for a rule. Instead, a red question mark appears next to the property and, when clicked, text appears in the right pane explaining why the result cannot be calculated.