Creating Policies

Policies enable you to organize computers running the Carbon Black App Control Agent into groups with common security requirements.

For example, you can create policies based on departmental affiliations like sales, marketing, or other organizational relationships. You might also create policies specific to a computer’s purpose, such as a special domain controller policy. A single policy may be appropriate if you want a single, company-wide operating standard for all computers, but typically you create multiple policies.

Usually, you assign policies to computers, not users, but you can use Active Directory data to assign policy by user. Each computer has only one policy at a time, regardless of the number of users currently logged on.

Once you create a policy, you can assign computers to it through a variety of methods, including automatic assignment based on Active Directory group. For more information on policy assignment, see Managing Computers.

When you create a policy, Carbon Black App Control attempts to create an agent installer that assigns the policy to computers that use the installer. If you have not yet uploaded agent installer packages and a rules file to your server, or if agent installer creation is disabled for all operating systems, creating a policy generates error events indicating that the agent installers for that policy cannot be created. You can still create the policy, but to avoid populating the Events log with errors each time you create a policy, the best practice is to upload agent and rule installers before creating policies. For information on uploading agent installers and rules to the server, see Carbon Black App Control Agent Installation Guide.