A user is covered by the wrong policy
Policies are evaluated from top to bottom alphabetically with the default ALWAYS being first. Each user gets the first policy that covers them. If a broad policy (for example, all of Domain Users) sits above a narrower one (for example, administrators), the broad policy catches those users first.
Fix: order your policies from most specific to least specific.
Users you removed are still monitored or alerted
- The daily scan uses a cached list of monitored users that is refreshed once per scan cycle. To check the current state, open Reporting → Protected Users and click Refresh.
- When recursive monitoring is on, users in child OUs/Containers/Groups are included. Turn it off on the Monitored Entities page to include only users directly in the selected OU.
- Make policy and entity changes in the Enzoic console, not by editing Enzoic objects directly in AD.
- If alerts are going out to users who shouldn't be monitored, switch the policy to notification only and turn off end-user notifications until the Protected Users report looks right.
Moving a user to a different policy
An existing compromise resolves only if the new policy doesn't also find the password compromised. The user is checked against the new policy in the next daily scan.
The default (Primary) policy
The default policy can't be removed, and another policy can't be made the default. If you don't want it to cover anyone, point it at an empty group or OU. System Health will then report that the policy has no entities, which you can safely ignore.
Several domains: the picker shows the wrong domain's groups and OUs
The group and OU picker browses the domain of the user signed in to the console. Being a Domain Admin in another domain doesn't change this. Sign in to the console as a user from the domain you want to configure. Groups and users from a trusted domain can't be monitored. If, for example, the domain's user count shows 0, check that the monitored Domain Users group is the one from the local domain.