https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215382#M41137 <P>Hi all,</P><P>I want to create a dynamic object that uses OUs (ie. containing AD-registered machines) rather than using a group of AD servers. What's the recommended way to do this? I have R81.20 on Maestro, and Identity Collector.&nbsp;</P> Tue, 28 May 2024 13:54:56 GMT jphwtx 2024-05-28T13:54:56Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215382#M41137 <P>Hi all,</P><P>I want to create a dynamic object that uses OUs (ie. containing AD-registered machines) rather than using a group of AD servers. What's the recommended way to do this? I have R81.20 on Maestro, and Identity Collector.&nbsp;</P> Tue, 28 May 2024 13:54:56 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215382#M41137 jphwtx 2024-05-28T13:54:56Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215409#M41141 <P>It sounds like you're describing an Access Role object. I've never used these directly, I've just seen them in my API work.</P> Tue, 28 May 2024 18:37:59 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215409#M41141 Bob_Zimmerman 2024-05-28T18:37:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215490#M41151 <P>It is an Access Role object. Does anyone have suggestions here?</P> Wed, 29 May 2024 12:42:32 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215490#M41151 jphwtx 2024-05-29T12:42:32Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215529#M41155 <P>An Access Role is correct:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25907iAB64DB33B369D2DC/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></P> <P>This implies creating an LDAP Account Unit and possibly one or more LDAP Groups.</P> Wed, 29 May 2024 15:13:06 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215529#M41155 PhoneBoy 2024-05-29T15:13:06Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215537#M41156 <P>The question is - can I do this based upon OU (ie. all machines in a given OU), or does it have to be group-based?</P> Wed, 29 May 2024 15:44:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215537#M41156 jphwtx 2024-05-29T15:44:33Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215541#M41157 <P>I suppose you could do "all identified machines" which would use any machine identity.<BR />Otherwise, it probably has to be done as a group.</P> Wed, 29 May 2024 16:26:25 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SmartConsole-OU-Based-object/m-p/215541#M41157 PhoneBoy 2024-05-29T16:26:25Z