Feature request: "Excluded" verb

[homebysix]

It would be great to have an excluded verb to detect whether a given group is used in any policy or configuration profile exclusions, similar to how the scoped verb is used to detect whether a given group is used in policy scoping.

You may also want to consider a batch_exclude verb that excludes a list of policies from a group.

[sheagcraig]

I suppose batch_exclude should actually take both computer and computer group arguments. Which probably means that batch_scope should too.

That gets hairy, since an ID could be ambiguous; with a name you can at least check to make sure there's one but not the other.

[homebysix]

If it's easier, you could start with batch_exclude taking groups only (like batch_scope does). I don't often add individual computers to policy scopes/exclusions. I'd much rather create a static group and then add individual computers to that.

[sheagcraig]

One could argue that this demonstrates a best-practice kind of principal which could be promoted through the lack of support for an individual computer option.

I've implemented an excluded verb which works great.

The next question, however, is, even if we don't provide options for the many different types of possible exclusions (computer, computer_group, buildings, departments, users, user_groups, network_segments, ibeacons), do we need to provide any (easy) access to the limitations side of scope?

And furthermore, what about scope itself? (I still have to add code to handle the all_computers tag; but there's also computers, buildings, and departments there!

[homebysix]

It seems to me that the main benefit of jss_helper (and Spruce) is the ability to see how the various objects on the JSS interact with each other, and weed out those objects that don't have any useful interactions.

Eventually it would be fantastic to be able to input any type of object at all and find out where it's referenced. But for now, I think focusing on computer groups will address a big pain point.

[sheagcraig]

Agreed

When it gets more complicated, I'll need to really research the most efficient way to use argparse!