Video Screencast Help

How to set up automatic removal from a filter

Created: 04 Dec 2012 • Updated: 04 Dec 2012 | 2 comments
ckgsdad's picture
This issue has been solved. See solution.


The way we set up our software deployments is that we are tasked to install to a specific range of systems on a given day then add to it a day later and so on. What we've been doing is creating a master filter and sub filters for each deployment where the master is targeted by the MSD. This has worked just fine for us but what I would like to do is once the compliance check is done (successfully) that it automatically removes the client from the filter, this way the detetion check is not on-going until I disable the policy.

One of the reasons I'm looking to do this is that if that system goes offline for a few days the compliance reports note it as "Not Applied" which management always raises a fuss over even though it only means that the client didn't send a status for that particular event that day. I've also found a bunch of cases where the software is installed but the status comes back as "Not Compliant" or "Not Applied" (Our compliance check looks for a specific registry key that our packages create on install) so I think it may just be best to see if the software is there and if it is have it removed from the filter. Our reporting has always been "Start with 0 and go up" but this would just change it to "Apply to up and watch the number left go down" this would be akin to the way the plug-in filters work where the number starts big and gets smaller. 

If I'm overthinking it please tell me, and thanks for the advice in advance.

Comments 2 CommentsJump to latest comment

andykn101's picture

I often use the Policy's Target for this, the Symantec best practice being to keep filtersSsimple and Targets complex. So I will right click on the Software Resource > Actions > Create Installed Software Filter and create a Filter of "Computers with..." and then for my Target apply:

ECNI Windows Worksations (to make sure no servers are targeted)

ECNI My Filter

ECI Computers with... (filter created above)

Authorised Symantec Consultant (ASC) with Endpoint Management Limited, an Authorised Symantec Delivery Provider based in the UK.

Connect Etiquette: Please "Mark as Solution" posts that fix your problem.

ckgsdad's picture

That is exactly what I needed, thank you very much Andy!