Hello @Angela, you can modify the policy distribution method of an endpoint by modifying the registry, in particular the ‘PolicyEnabled’ value; please find further details below:
Deploy EPM policy
Certain types of deployment methods may be enabled or disabled. By default, all deployment types are enabled. To include or exclude a method of deployment from evaluation, edit the entries in the registry value below. If this key does not already exist, then the default behavior is to include all methods:
HKEY_LOCAL_MACHINE\Software\Avecto\Privilege Guard Client
REG_SZ PolicyEnabled = "EPO,WEBSERVER,GPO,LOCAL"
Where EPO,WEBSERVER,GPO,LOCAL are the available deployment methods.
Registry settings may be deployed using Advanced Agent Settings. To apply a configuration deployment method, the setting must be applied to a type of configuration that is already part of the configuration precedence order.
Ref: https://docs.beyondtrust.com/epm-wm/docs/epo-user-guide#deploy-epm-policy
So does this mean that I just need to add or remove items from the PolicyEnabled key?
For example, if I wanted to deploy using GPO but not the PMC website, would I just remove WEBSERVER from the key value?
Also, if I wanted to switch back from using GPO to using PMC, would I just add WEBSERVER back as a value and remove GPO?
And is there anything else I need to do to ensure that the endpoint then receives the policy from the correct deployment method?
Hi @Angela, essentially yes but some entries, such as EPO or WEBSERVICE (the PMC value), must have been enabled at time of install (installer command line) to function, simply updating the registry will not enable their connectivity.
Also, you can configure custom precedence for policy processing by creating the registry value ‘PolicyPrecedence’ manually or at time of install; please see the below link:
https://docs.beyondtrust.com/epm-wm/docs/gpo-deploy-epm-for-windows-policy#configuration-precedence
Finally, note the difference between WEBSERVICE and WEBSERVER; the former refers to PMC whereas the latter refers to an ability to download policy hosted upon a web server.
