Agent groups defined by Endpoint servers do not show up in Change Group tasks

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Enforce

Issue/Introduction

When attempting to change the agent group assigned in the Agent Overview screen, not all agent groups defined are listed:

Cause

This is working as designed. 

Resolution

Agent groups can be defined by User Attributes or an Endpoint server.  Think of the agent group as a filter.  As long as the filter matches, they will be assigned that group.  Priorities do come into play, please review this article: Viewing and managing agent groups in DLP. <https://knowledge.broadcom.com/external/article?articleNumber=174254>

Endpoint server:  You CANNOT move users to an Agent group setup for Endpoint server.  It's specified in the agent configuration and it's tied to the server connection attribute.  If you have explicitly set up your agent to connect to a particular endpoint server, they will automatically show up in this group.  

User Attributes:  You CAN move users to agent groups setup for user attributes.  The reason for this is these are controlled by user attributes and can be from AD or another source.  These attributes can be dynamic and is pulled from the host itself.  For example, like hostname or Office location or City etc.  For this reason, you can actively move users from one agent group to another as they are dynamic.

 

 

Additional Information

Overview of the Agent Group Deployment Process <https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/data-loss-prevention/16-0-1/about-discovering-and-preventing-data-loss-on-endp-v98548126-d294e27/overview-of-the-agent-group-deployment-process-v97217467-d228e67.html>