Build and apply a policy

Applying configuration to a device in NetLock RMM is a two-stage task. First you build a policy that describes what should be enforced. Then you create an automation — a condition → policy rule — that routes the policy to the devices that should receive it. Policies are never attached to groups, locations, or devices directly; there is no "Apply Policy" button anywhere in the Console. The two stages are always distinct, and this guide walks through both.

At the end you will have one device running one policy, with evidence of the assignment in the device detail view and in Events.

Before you start

• At least one tenant, location, and group exists (see Guide H.3).
• At least one authorised device is online in a group you intend to target (see Guide H.1 and Guide H.2).
• Required permissions: policies_enabled, policies_add (or equivalent), automation_enabled, and automation_add.

Note: A device receives at most one policy at a time. Policies do not layer, merge, or inherit. If two automations match the same device, the rule with the lower priority number wins.

Stage 1 — Build the policy

1. Open Policies from the navigation.
2. On Manage Policies, click Add. In the Add Policy dialog enter a Name (for example Starter Workstations) and an optional Description. Save.
3. Click Manage on the new row to open the Policy Settings editor.
4. Step through the tabs you care about and tune settings. For a first pass the defaults on the Agent tab are usually fine — they set the sync interval and remote-control capabilities. See the full tab reference in Chapter 6 for everything you can configure.
5. Save.

Warning: Policies have no templates, no versioning, and no rollback. Edits apply in place. Before making risky changes to an in-use policy, duplicate it first from the Manage Policies page and edit the copy.

Stage 2 — Route the policy with an automation

1. Open Automations from the navigation.
2. Click Add. In the automation dialog fill in:
   • Name and Description.
   • Under If … — keep the condition type Group for the simplest case and pick the group this policy should apply to (for example Workstations). Add further conditions only if the policy should reach part of the group, for example Platform = Windows.
   • Under Then … — pick the policy you created in stage 1.
   • Priority — leave the proposed value (400 for a group rule). Check matching devices shows which devices the conditions match right now.
3. Confirm.

The server immediately re-evaluates the affected devices against the updated automation list and pushes matching policies. You do not need to wait for the next scheduled poll.

Tip: When several automations match a device, the one with the lower priority number wins; at the same number the rule with more conditions, then the older one. The dialog proposes a priority from the rule's most specific condition (device 100, internal IP 200, domain 300, group 400, location 500, tenant 600, otherwise 700), so a rule for a single machine beats a group rule by default. To reorder rules, change their priority numbers on the Manage Automations page — there is no drag-and-drop.

Verify it worked

• Open Devices and select a device in the target group. Its detail view shows Assigned policy: <your policy name>.
• Open Events and filter by the device. Look for entries that mark the policy deployment and any follow-on actions triggered by the policy.
• Optionally open Audit for an immutable record of when and by whom the policy was created and the automation added.

Troubleshooting

• Device shows no_assigned_policy_found. No enabled automation matched the device and no default policy is set. Open the rule and use Check matching devices to see whether its conditions match the device; every condition of the rule has to hold. Alternatively, mark a default policy on the Policies page; it applies to every device that no automation reaches.
• Wrong policy is assigned. Another matching automation has a lower priority number, or the same number with more conditions or an older creation date. Raise its number, narrow it, or give the rule you want a smaller number — a Device rule for the single machine gets 100 by default.
• Policy saved but no events appear. Confirm the device is online in Devices. A device that is offline picks up the policy on its next sync. For persistent offline devices, see Troubleshooting.

Related

• Chapter 5 — Automations — the policy-routing layer, the condition types, and priority resolution.
• Chapter 6 — Policies — complete reference for every tab in the Policy Settings editor.
• Guide H.5 — Configure Windows Defender via policy — a worked example of tuning the Windows tab.