Static Groups

[dstranathan]

I'm just curious as to how you are all using Static Groups.

Thus far, I have been alble to leverage dynamic Smart Groups in almost every situation. Im almsot 100% Dept driven here, so as long as a Mac has been assigned to a Dept Im good to go. I have very little horizontal movement in terms of my users moving from one Dept to another.

The only Static Groups that I have built thus far are:

-Common/shared Macs. Macs that dont have a speciifc Department or owner (conference rooms, auditoriums).
-Graduate students. These are users who may or may not be in a given Lab or Dept, but need specific resources. They tend to move around betwen Labs/Depts the most.

Chime-in and let me know how you are using Static Groups. Id like to hear more about your environment.

[mm2270]

We don't use them much here, even though we do have a decent number of Static Groups built over the years. Most are just there for legacy reasons and not used in many actual policies. The one that I would say we sometimes fall back on is a Static Group for some VIP Macs. We can then include that group in the Exclusions tab for certain policies that we may not want the JSS to hit.

[Aziz]

Pilot group for updates, that's really about it.

[millersc]

We stay away from Static Groups because if a computer is deleted from JSS for a re-image, hdd change, etc, it removes all associations.

Most are Smart Groups using special naming characteristics. Building#-Function-device#-platform (23-T-12-A). From these 4 octets we can scope and smart group darn near anything.

[psliequ]

They're most useful when you have to organizationally group a computer in a way that doesn't correlate with any aspect of it's hardware/software config or any of it's extension attributes.

For example, a computer might be a Macbook Pro, might have a department set in location, and might have a few extension attributes set that will put it into any number of smart groups you have. But the person using that machine needs to be considered a VIP or someone for whom normal policies don't apply. You can then put them in a static group and exclude them in whatever way you need to.

as @Abdiaziz said they're very good for pilot groupings of computers too. I even like to make a corresponding 'negative' smart group which finds all machines not part of the pilot group. Easier to exclude that group when testing new policies and then just remove it from scope when you're ready to go into production.