Extra Computers Showing Up In Scope

@carlito Are you using a Smart Computer Group to target your Policy? If yes, do the extra computers show up when you View the Smart Group?

@sdagley No, I'm scoping it to the particular computer(s) directly. Under scope I target it to Specific Computers and then I add the computer(s) directly.

I double-checked. One of the groups I did use a Smart Group for, targeting computers 10.9 and below (Operating System less than or equal to 10.9.5). And in that group there are some 10.14 and 10.15 machines that show up for some reason. But the rest of the policies are scoped to target computers specifically, not by Smart Group. The same extra computers do show up in all instances though.

@carlito If you're enabling a Policy for a static list of computers I'd recommend creating a Static Computer Group, and use the group as the policy's target. It's much easier to script, or use a tool like MUT, for modifying the membership of a Static Computer Group than it it to modify the target scope of a policy.

Thanks for the suggestion. I created a static group and added just 2 computers into it. I rescoped the policy to target that static group. It's still showing the extra 20 computers. Is that the expected behavior? Do I need to recreate the policy?

Also, I'm still trying to track down why those same 20 extra 10.14 and 10.15 machines would show up in a smart group targeted to 10.9 machines.

Ah, that was it. I had them set to All Users, not understanding how All Users works. I switched them to Specific Users and now they work as designed. (Those extra machines had users attached to them based on how they were enrolled, which I believe is why they showed up with All Users.) I did a little reading on how All Users/Specific Users works, and I think I'm set now. Thank you very much for your assistance @sdagley.