====== Group Policy ======
Group Policy is a feature in AhsayCBS for simplifying administration and reducing the effort required for managing groups of backup users, e.g. security settings and backup set settings. It allows administrator to tailor features and services for different user groups.

===== User Group =====

  * Many-to-Many relationship with Backup User.
  * Many-to-Many relationship with Policy Group.

==== Default User Group ====

  * Named as "**All Users**"
  * By default all backup users were assigned to the group "All Users" (Included backup users owned by [[Sub-Admin|Sub-Admins]])
  * Backup users **CANNOT** be removed from the group "All Users"
  * If a backup user belongs to more than 1 User Group, "All Users" group would always in the **BOTTOM** of the User Group List

==== Sub Admin's backup users ====

  * Sub Admin's backup users can only be assigned to their owner's owned User Group besides the default "All Users" group

----

===== Policy Group =====

  * Many-to-Many relationship with User Group

==== Default Policy Group ====

  * Named as "**Default settings**"
  * By default assigned to the Default User Group "All Users"
  * "Default settings" **CANNOT** be removed from "All Users"
  * If a User Group contains more than 1 Policy Group, "Default settings" group would always in the **BOTTOM** of the Policy Group List

==== Folder Location ====

  * The policy files are stored in $CBS_HOME/$Application Home/obs/policies

----

===== Effective Policy =====

Check **[CBS web console] > [Users, Groups & Policies] > [Backup User] > [Effective Policy]** for the Policy control taking effect for the Backup Users

==== Order of User Groups & Policy Groups ====

  * The order of User Groups and Policy Groups matters, determine which policy control would take effective
  * User Groups and Policy Groups can be re-order in CBS web console

==== Which Policy Control would take effective? ====

Consider the case that a Backup User is assigned to 2 User Groups, each User Group contains 2 Policy Group

These would be the Policy Control Priorities:

|   ^User Group 1 (Top)^User Group 2 (Bottom)^
^Policy Group 1 (Top)|  1st Priority  |  3rd Priority  |
^Policy Group 2 (Bottom)|  2nd Priority  |  4th Priority  |

  * If a specific Policy Control in the 1st Priority Policy Group is ENABLED, it would take effective
  * If NOT, then it would continue to check if the 2nd Priority Policy Group has that Policy Control ENABLED
  * So and so
  * If all specific Policy Control in all Policy Groups were DISABLED, the system default settings would take effective

Base on our design, the effective policy is based on the first applied modules found on the policies. Assume there are 2 policies for a user (Policy A & B , and policy A has higher priority) with the following setting :

Policy A's "default value" -> "destination" applied modules : \\
1.File \\
2.VMware \\

Policy B's "default value" -> "destination" applied modules : \\

1.Lotus Notes \\
2.VMWare \\

Then the resulting effective policy of "default value" -> "destination" will be : \\
-> "File" from policy A \\
"VMware" from policy A \\
"Lotus Notes" from Polcy B \\