Saturday, April 20, 2013

Control of Sametime user policy using Managed Settings in Domino Policy

For the past few years I have advised against using Managed Settings in Domino Policy because of bad experiences using this particular way to manage the Sametime clients. For one thing, you can't managed the stand-alone client this way which means that unless you are 100% sure that users will use the embedded Notes ST client, you should always use the Managed-settings.xml file approach.
Having said that, I have clients that have used the Managed Settings in Domino Policy because that the way they manage their users Notes clients and no-one in their environment uses the stand-alone client. When I have worked with these clients on Sametime deployments, I have moved them to the XML-based way of thinking but in some cases we have had residual effects left behind by the attempted usage of Managed Settings in Domino Policy. These residual effects were left due to a misunderstanding of the way Managed Settings in Domino Policy works.
When you set a Managed Settings in Domino Policy, you set it in the Desktop Policy settings under the "Managed Settings" tab which is under the "Custom Settings" main tab i.e.
The most important thing to mention here is:
If you already set this in the policy, then the setting is saved to the desktop policy. If you delete this line, it DOES NOT remove this setting from the policy. This is "working as designed" by IBM and it is understandable if you think about it.
So if you want to change this setting, you set it to "off" or "false" or whatever you need it to be set to, to turn it off.... just remember, you don't delete the line.
Using this approach, you can rectify issues that may have set desktop policy in the past and there is no reference in the GUI to the setting - you can only find these settings by looking at the Policy using "Document - properties" on the Policy document (or by using a cool tool like the Ytria scanEZ tool)

To validate what I just stated above about the policy not being deleted, I removed the two lines you see in the screen shot above and saved the policy - here is a a screenshot of the policy with the two lines removed but with the document properties window open to show the actual settings STILL in the policy:

So the bottom line here is not to use Managed Settings in Domino Policy if at all possible and use Managed-Settings.xml in a web accessible form for providing Sametime user's with policy. However, if someone has dabbled previously with Managed Settings in Domino Policy, bear this in mind as there may be hidden policy settings that you cannot see through the GUI affecting the Policy that is pushed to the client.