Configuration management for co-management
Various examples for discovering policy bindings between group policy rules in a legacy management framework and unified endpoint management rules that are utilized in a modern mobile device management (MDM) device management framework. A configuration state view can allow an administrator to understand inconsistencies or conflicts between group policy rules and UEM rules.
1. A non-transitory computer-readable medium embodying program code executable in a computing device that, when executed by the computing device, causes the computing device at least:
identify at least one of a user or a device that is enrolled as a managed device with a remotely executed management service;
identify a plurality of group policy rules defined for the at least one of the user or the device, the group policy rules defined in a directory service;
identify a plurality of unified endpoint management (UEM) rules defined by the remotely executed management service for the at least one of the user or the device;
identify ones of the group policy rules that have at least one analog from the UEM rules;
build a configuration state view of the user and the device, the configuration state view identifying group policy rules and UEM rules that affect the same functionality of the device; and
identify inconsistencies between the group policy rules and the UEM rules.
2. The non-transitory computer-readable medium of claim 1 , wherein the program code identifies inconsistencies by determining that a UEM rule and a compliance rule specify a conflicting setting for the at least one of the user or the device.
3. The non-transitory computer-readable medium of claim 1 , wherein the UEM rules are enforced by a management component installed on the device, and the management component comprises an application installed on the device with elevated privileges and registered as a local device administrator with an operating system of the device.
4. The non-transitory computer-readable medium of claim 1 , wherein the group policy rules are defined in a directory service associated with the user or the device, and the group policy rules specify settings within an operating system of the device.
5. The non-transitory computer-readable medium of claim 1 , wherein the program code identifies ones of the group policy rules that have at least one analog from the compliance rules by inconsistencies by determining that the at least one analog from the compliance rules affects the same operating system setting as one of the group policy rules.
6. The non-transitory computer-readable medium of claim 1 , further comprising program code that, when executed by the computing device, causes the computing device to generate a plurality of policy bindings that link together the UEM rules and the group policy rules.
7. The non-transitory computer-readable medium of claim 1 , wherein program code identifies inconsistencies between the group policy rules and the UEM rules by identifying that at least one of a group policy rule or a UEM rule specifies a conflicting value for an operating system setting on the device.
8. A system comprising:
at least one computing device comprising a processor; and
program instructions executable in the computing device that, when executed by the computing device, cause the client device to:
identify at least one of a user or a device that is enrolled as a managed device with a remotely executed management service;
identify a plurality of group policy rules defined for the at least one of the user or the device, the group policy rules defined in a directory service;
identify a plurality of unified endpoint management (UEM) rules defined by the remotely executed management service for the at least one of the user or the device;
identify ones of the group policy rules that have at least one analog from the UEM rules;
build a configuration state view of the user and the device, the configuration state view identifying group policy rules and UEM rules that affect the same functionality of the device; and
identify inconsistencies between the group policy rules and the UEM rules.
9. The system of claim 8 , wherein the program code identifies inconsistencies by determining that a UEM rule and a compliance rule specify a conflicting setting for a feature of the at least one of the user or the device.
10. The system of claim 8 , wherein the group policy rules are defined in a directory service associated with the at least one of the user or the device, and the group policy rules specify settings within an operating system of the device.
11. The system of claim 8 , wherein the UEM rules are enforced by a management component installed on the device, and the management component comprises an application installed on the device with elevated privileges and registered as a local device administrator with an operating system of the device.
12. The system of claim 8 , wherein the program code identifies ones of the group policy rules that have at least one analog from the compliance rules by inconsistencies by determining that the at least one analog from the compliance rules affects the same operating system as one of the group policy rules.
13. The system of claim 8 , further comprising program code that, when executed by the computing device, causes the computing device to generate a plurality of policy bindings that link together the UEM rules and the group policy rules.
14. The system of claim 8 , wherein program code identifies inconsistencies between the group policy rules and the UEM rules by identifying that at least one of a group policy rule or a UEM rule specifies a conflicting value for an operating system setting on the device.
15. A method comprising:
identifying at least one of a user or a device that is enrolled as a managed device with a remotely executed management service;
identifying a plurality of group policy rules defined for the at least one of the user or the device, the group policy rules defined in a directory service;
identifying a plurality of unified endpoint management (UEM) rules defined by the remotely executed management service for the at least one of the user or the device;
identifying ones of the group policy rules that have at least one analog from the UEM rules;
building a configuration state view of the user and the device, the configuration state view identifying group policy rules and UEM rules that affect the same functionality of the device; and
identifying inconsistencies between the group policy rules and the UEM rules.
16. The computer-implemented method of claim 15 , further comprising identifying inconsistencies by determining that a UEM rule and a compliance rule specify a conflicting setting for a feature of the at least one of the user or the device.
17. The computer-implemented method of claim 15 , wherein the group policy rules are defined in a directory service associated with the at least one of the user or the device, and the group policy rules specify settings within an operating system of the device.
18. The computer-implemented method of claim 15 , wherein the UEM rules are enforced by a management component installed on the device, and the management component comprises an application installed on the client device with elevated privileges and registered as a local device administrator with an operating system of the device.
19. The computer-implemented method of claim 15 , wherein the program code identifies ones of the group policy rules that have at least one analog from the compliance rules by inconsistencies by determining that the at least one analog from the compliance rules affects the same operating system as one of the group policy rules.
20. The computer-implemented method of claim 15 , wherein program code identifies inconsistencies between the group policy rules and the UEM rules by identifying that at least one of a group policy rule or a UEM rule specifies a conflicting value for an operating system setting on the device.