Tranquil IT Forum

Hello,

is there a way to create an exception for a dependency of a unit package? (while keeping the machine under the unit package)

For example, for a unit package that depends on base packages deploying certificates, I want to prevent these certificates from being deployed on one or more machines dependent on the unit package (without modifying their OU or the unit package itself).

I've tried several configurations, such as creating a conflict between one of these packages and the machine package, but without success...

Hi Steven,

this approach would be similar to what you find in the AD GPO management interface, where you can disable GPO inheritance for a specific branch. For now, we've decided against doing this because it adds considerable complexity and it's easy to accidentally do things we didn't intend.

One way to address your use case, I think, is to create a "meta-package" that will install a package or not, depending on specific parameters [1].

This methodology offers great flexibility but can cause problems with the package downloads themselves. For example, if you're dealing with a user on a VPN, 802.1x, or Wi-Fi connection, and package installation occurs when the workstations are shut down, installing the meta-package won't be able to initiate the download and installation of the package because there will no longer be a network connection. We're currently looking into how to better handle this scenario.

Regards,

Denis

[1] https://www.wapt.fr/fr/doc/wapt-create- ... a-packages

Okay, thank you for that answer. This situation corresponds to very common use cases.
I'll look into it.

Hi again Steven,

if the use case is for deploying a user certificate (or other things that don't impact the user on the machine, like a Thunderbird update that will break their Thunderbird), then we can force the package to install as soon as it's detected by the agent (so there's still a network connection).

Regards,

Denis

Okay, thanks for the clarification.
In theory, defining a "virtual" OU on the machines to be excluded could also work, but that would exclude all software from the unit package, not just those selected as exceptions.
In my opinion, the ability to prioritize exceptions on a machine would be a plus (via wapt-get.ini, for example).