Policy scope issue

[ImAMacGuy]

I seem to struggle with the criteria settings for policy scopes...

Currently I have a smartgroup setup to look for machines with teh following criteria

Computer name | like | ml
Packages installed by casper | does not have | Anyconnect

and | packages installed by casper | does not have | vpn.pkg
and | pacakges installed by casper | has | SOE3FF.pkg
or | packages installed by casper | has | SOE4FF.pkg

what I'm finding is that the anything with SOE4FF keeps getting our VPN re-installed. when I set SOE4FF to |and| then the smargroup count went to 0, but the machines wouldn't have both SOE3FF and SOE4FF (one is 10.7 one is 10.8). Is my logic flawed or is the logic of the smart group?

[mm2270]

Can you try reordering your criteria like this-

Pacakges installed by casper | has | SOE3FF.pkg
Or | Packages installed by casper | has | SOE4FF.pkg
And | Packages installed by casper | does not have | Anyconnect
Or | Packages installed by casper | does not have | vpn.pkg

Do you in fact have two separate VPN packages? We use AnyConnect here as well, so I can take a look in our receipts to see what shows up. I'm wondering if just having one or the other 'Does Not Have' criteria would be enough?

[ImAMacGuy]

I was just reading down the list of the criteria, hence the order.

the ML - signifies mac laptop in the naming convention.

when I set OR to SOE4FF then i get 8 installs to go, but then it keeps re-installing Anyconnect.

When I take out vpn.pkg there group jumps to 44 machines, so apparently some machines have it, they are technically the same package, just one was renamed.

Edit:

When I changed the actual order to SOE3FF
OR SOE4FF
And does not have Anyconnect
and does not have vpn

then the list jumps to 167...

[mm2270]

Your policy is running a recon at the end of the installation, right? you'd definitely want that since the Smart Group is relying on receipts and other info to determine which Macs need the software installed.

[ImAMacGuy]

yep, i just added the SOE4FF file to an existing policy which was working.
I also verified that it's still enabled (just in case).

I wonder if it will work if I set the Anyconnect to install at imaging time and just take the policy out of the equation.

[ImAMacGuy]

I ended up creating a seperate Smart Group for SOE4FF machines.. that seems to have worked.. for now :)