Assistant Admins can manage services on computers that have been excluded via an Exclude rule to exc (NETIQKB13644)

fact
Directory and Resource Administrator 6.x

fact
Directory and Resource Administrator 7.x

fact
Directory and Resource Administrator 8.0

symptom
Assistant Admins can manage services on computers that have been excluded via an Exclude rule to exclude members of a particular group which the computer belongs to. 

cause
This is the correct behavior.  The cause of this issue is that the Exclude rule excludes the computer, however Directory and Resource Administrator treats each resource (share, services, open files, etc..) as a separate object. 

fix

This issue would appear in situations where the ActiveView was defined with rules similar to below:

• Included Services on all computers with name matching *
• Exclude computers that are part of a particular group

When creating an exclude rule to exclude resources, you can not filter by group membership.  However, if the computers are in the same OU container, then you can exclude the resource by an OU filter. 

To exclude services on computers in a specific OU container, perform the following:

1. Open the MMC logged in as the Built in Admin.
   
2. Expand ActiveView management node and select Activeviews.
   
3. Select the ActiveView that pertains to Services management.
   
4. Select Add object.
   
5. Select Custom rule and click Next.
   
6. Select Exclude and click Next.
   
7. Select Services and click Next.
   
8. Select In specific OU and specify the OU and click Next.
   
9. Select Any computer and click Next.
   
10. Select All Services and click Next.
    
11. Give the rule a name and click Finish.

An Enhancement request has been opened with Development for the ability to filter the resource rules (services, open files, shares, etc..) for computer by group membership.

Formerly known as NETIQKB13644