I’ve been working with @cstoneba a bit on this. After looking over 2 client logs captured just after client install and initial provisioning, there is definitely 10 minutes or more that is taken doing all of the management rights actions for all of the old and current opsites and similar. This is even with the WorkIdle set to the max, it would be much worse at the default WorkIdle setting.
I don’t think 10 minutes is terrible, but it really should be a lot faster if only the “real” operators had to be evaluated. It is hard to get around this problem without a way to reissue all of the management rights actions for just those that are current, but I think I might have figured out a possible way to get around this:
The idea is to pre-populate all of the possible opsite assignments with a false value set far in the past ( Thu, 01 Jan 1970 05:23:11 -0800 ) so that any rights assignments that would take away an operators rights would be skipped and only those that provide management rights would be run and change the pre-populated value.
This should work because the relevance for a client_role is:
(not exists setting "__Client_Role_###" of client) OR ((not exists effective date of it) OR ((effective date of it <= universal time "Fri, 30 Oct 2015 11:55:47 +0000") AND ((not exists value of it) OR (value of it does not equal (( if ( false ) then "1" else "0" ) as string))))) of setting "__Client_Role_###" of client
And the relevance for an operator is:
(not exists setting "__Group___AdminBy___op_###" of client) OR ((not exists effective date of it) OR ((effective date of it <= universal time "Fri, 30 Oct 2015 16:55:47 +0000") AND ((not exists value of it) OR (value of it does not equal (( exists (setting "__Client_Role_####" of client) whose (value of it = "1") ) as string))))) of setting "__Group___AdminBy___op_###" of client
An example /var/opt/BESClient/besclient.config on linux looks like this:
[Software\BigFix\EnterpriseClient\Settings\Client\__Client_Role_####]
value = 0
effective date = Mon,%2030%20Oct%202017%2016:57:45%20-0700
[Software\BigFix\EnterpriseClient\Settings\Client\__Group___AdminBy___op_###]
value = False
effective date = Mon,%2030%20Oct%202017%2017:08:46%20-0700
[Software\BigFix\EnterpriseClient\Settings\Administrators\__op_###]
effective date = Mon,%2030%20Oct%202017%2017:08:46%20-0700
The bummer is that this can’t be done with a clientsettings.cfg at install time because using one does not set an effective date and an effective date seems to be required, otherwise these would not be skipped. ( In this case, I’m not referring to linux since a clientsettings.cfg won’t work there anyway )
This should be the set of operators to set:
masthead operator names of bes users whose(not master flag of it)
This would be the format for in the besclient.config
("[Software\BigFix\EnterpriseClient\Settings\Client\__Group___AdminBy_" & it & "]%0d%0avalue = False%0d%0aeffective date = Thu,%252001%2520Jan%25201970%252005:23:11%2520-0800") of masthead operator names of bes users whose(not master flag of it)