Defining conditions

The computer name must match the string “user1-ws”:

$comp["name"][0]=="user1-ws"

The string “OU=Domain control” must exist within the value of the variable $ADsPath:

%strlen(strstr($ADsPath,"OU=Domain Control"))>0
strcontains($comp["ADsPath"][0],"OU=Domain Control")

If the length of the computer name is greater than 5 characters and its operatingSystem is Microsoft Windows Server 2008, then return true, otherwise return false:

iif(((strlen($comp["name"][0])>5)&&($comp["operatingSystem"][0] == "Windows Server 2008")),"true","false")

This expression is useful for moving managed systems that are already known to be a member of another policy:

function MV() {for (var $i=0; $i< size($comp["attachedPolicies"][0]); $i++)  {if($comp["attachedPolicies"][$i]=="<managed system ID>") { return 1;}} return 0; } MV(); 

This rule must be evaluated twice in order for the necessary information to be gathered.

This expression would be useful, for example, in cases where systems must be placed in a default policy, or if a system is a member of a tombstone policy (grouping non-contactable systems) and should not be a member of any other policy.

To detect systems that Bravura Privilege has not been able to contact for the set time period:

Configure the COMP FAILURE THRESHOLD system variable to <N> (where N = number of days)

$comp["compFailurePastThtreshold"][0] == 1

To detect systems that Bravura Privilege has not been able to contact since a specified period (in this example, 2 months) past a certain date based on their last successful connection time:

function dateComparison() { var $certainDate; var $attributeDate; var $period = P2M; toDate($attributeDate, $comp["lastSuccessConnection"][0]); toDate($certainDate, "2012-07-15 13:48:00 (GMT-07:00)"); if($attributeDate > ($certainDate + $period)) { return 1;} return 0; } dateComparison();

To detect previously-discovered systems that Bravura Privilege has not been able to discover from the domain:

$comp["compDiscovered"][0] == 0

To detect the number managed systems that have not been discovered by Bravura Privilege in the last 10 days:

$comp[compNotDiscovered][0] > 10

This expression allows you to create import rules based on Active Directory structures, and place managed systems into dedicated managed system policies for structures like location or department:

strcontains(($comp["ADsPath"][0]|$comp["distinguishedName"][0]), <AD object organization object such as CN values, or OU>)

Or,

strlen(strstr(($comp["ADsPath"][0]|$comp["distinguishedName"][0]), <AD object organization object such as CN values, or OU>))>0

To determine if a discovered account is a domain account or not:

$acct["accountDomain"][0] == "<domain>"

If you are manually providing computer list files, you can also provide custom attributes:

$comp["<custom attribute>"][0] == "<custom value>"

To determine whether an attribute exists on a discovered object:

compAttrExists("<attribute_name>" , "<optional attribute value>" , "<1|0 multi-value or not>");

If the attribute value is empty, the expression simply determines whether the attribute exists or not. If the value is included, the attribute must exists and have the same value.

This expression is particularly useful when providing custom attributes for a set of specific discovered objects.

Conditions may also contain logical statements; for example:

(<condition 1>) && (<condition 2>) && (<condition 3>) && ...
(<condition 1>) || (<condition 2>) || (<condition 3>) || ...

These are useful when working with either a smaller set or conditions for specific systems, or if you want to add exceptions to the condition.