When targeting “By Retrieved Propteties” I can hold ctrl and select multiple selections and see the count increase in the right pane, suggesting that it is going to target all of the selections. (it’s doing an OR on the properties)
However when I deploy the action, it appears that it’s doing an AND on the properties and none of the machines are actually targeted.
If I wanted to AND them, I would just go deeper in the tree… like
By OS
± WinXP…
± By Subnet Address
±
10.1.1.0
This would give me
OS = WinXP AND Subnet = 10.1.1.0
.
So why doesn’t ctrl+clicking multiple properties result in an OR action as I would expect:
By OS
± WinXP…
± By Subnet Address
±
10.1.1.0
±
10.1.2.0
This should give me _OS = WinXP
AND
(Subnet = 10.1.1.0
OR
Subnet = 10.1.2.0) _ shouldn’t it?
I have tried it a few times and it never seemed to work… even though while I am making my selections, the count displayed seems to reflect that is what it is doing.
The selection does work like you want it to ( OS = WinXP AND (Subnet = 10.1.1.0 OR Subnet = 10.1.2.0). However when you do this type of “by retrieved property” targeting, you have to wait for the agents to gather the action and evaluate, and report that its relevant back to the console to see it in the applicable computer counts. This means that when you take the action, you will see its applicable computer count start at 0/0, and slowly build in count as agents figure out htat they are relevant.
Likely your computers just haven’t reported back yet (maybe they are off, or behind a firewall).
There is a good reason for this behavior (even if its poorly explained). Normally when you target with the “specific computers select” option, you are basically the action should only ever be relevant to those computers. This means the console knows the set of computers the action will run against (so you will see things like “0 of 10 applicable computers” have run the action).
However targeting by property is different. Since properties results can change, you dont really know the set of computers that will have those specified property values. For example, it could be that, at the time you issued the action, 10 computers were in those subnets, but then shortly after, another computer was added, so the action will actually run against 11 computers. There is also the other side, where the computer leaves the subnet before it received the action, so the action would only run against 9 computers.
I have left them open for quite a while and never had it work. Are their any restrictions on what will and will not work; as my selections are not quite as simple as described? I assume that it sends a “gather” signal to all workstations when the action is created this way, same as targeting all workstations right?
For example, here is the cooresponding releavance for the one I did last week. I selected various subnets, and locations by subnet under the OS selection.
(
name of operating system = "WinXP"
)
AND
(
(
exists subnet addresses
whose
(
set of
(
"10.57.4.64" ; "10.57.40.0" ; "10.57.5.128"
)
contains it as string
)
of adapters of network
)
OR
(
set of
(
"FFR" ; "FTR" ; "GQR" ; "MFL" ; "MIA" ; "VMQ"
)
contains
(
value of setting "Location by subnet" of client
)
)
)
I usually end up targeting all computers and adjust the action relevance to suit my needs as I did above… I typically start seeing computers within a couple of minutes doing it this way; I have never seen a machine appear relevant doing it the other way.