[GH-ISSUE #2269] Policy Agent Exclusions Not Honored When Policy Applied to Site #3352

New issue

Closed

opened 2026-03-14 07:11:30 +03:00 by kerem · 2 comments

kerem commented

2026-03-14 07:11:30 +03:00

Owner

Originally created by @guilhermemilekalfatransportes on GitHub (Jul 30, 2025).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2269

Server Info (please complete the following information):
- OS: Ubuntu 24.04.2 LTS
- Browser: Microsoft Edge Version 138.0.3351.109 (Official build) (64-bit)
- RMM Version (as shown in top left of web UI): v1.2.0

Installation Method:
- [x] Standard
- [ ] Standard with --insecure flag at install
- [ ] Docker

Agent Info (please complete the following information):

Agent version (as shown in the 'Summary' tab of the agent from web UI): Agent 2.9.1
Agent OS: Windows 11 Pro, 64 bit v24H2 (build 26100.3476)

Describe the bug
Policy-level agent exclusions are not honored when the policy is applied directly to a Site, causing the policy's tasks/checks to execute on agents that are explicitly marked as excluded within that policy.

To Reproduce

Create a new Policy (e.g., "Software - LembretePonto").
In this policy, go to "Show Policy Exclusions" and add one or more specific agents (e.g., "RH-11686") to the "Excluded Agents" list.
Go to "Show Relations" for this policy.
In the "Sites" tab, add a Site (e.g., "01 - CDR - Caçador/SC (Matriz)") that contains the excluded agent(s).
Ensure the policy is active and has assigned checks/tasks.
Observe that the policy's tasks are executed on the agent(s) listed in the "Excluded Agents" list (e.g., "RH-11686" task status shows "Synced with agent"), despite being excluded.

Expected behavior
When an agent is listed in the "Excluded Agents" for a policy, that agent should not receive or execute any tasks/checks from that policy, regardless of whether the policy is applied to "All Agents", individual agents, Clients, or Sites that the agent may belong to. The exclusion should take precedence over broader inclusions.

Screenshots

Additional context
Through code analysis, this behavior appears to be related to the logic in automation/models.py within the Policy model, specifically the related_agents method.

When a policy is related to a Site (via self.workstation_sites or self.server_sites), the related_agents method generates the list of target agents. The Agent.objects.filter calls within these branches (e.g., those using site_id__in or site__client__in) do not explicitly exclude agents based on excluded_agents_ids within that specific query chain. The exclude(id__in=excluded_agents_ids) logic seems primarily applied only when agents are directly associated with the policy (self.agents) or when evaluating "Default Server/Workstation Policies."

This suggests that the current implementation treats Site-level policy application as a strong inclusion that bypasses agent-specific policy exclusions. This design makes granular exclusions difficult when policies are applied broadly to organizational units (Sites/Clients).

Workaround implemented:
To achieve the desired exclusion, we had to restructure the organizational hierarchy. We created a separate Site (e.g., "01 - CDR - Caçador/SC (Matriz - Gerência)") for the agents that needed to be excluded. The policy was then removed from the original broader Site and reapplied only to the original Site (now containing only the non-manager workstations). This effectively excludes agents by explicit inclusion/exclusion of Sites, rather than relying on policy-level agent exclusions.

Originally created by @guilhermemilekalfatransportes on GitHub (Jul 30, 2025). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2269 **Server Info (please complete the following information):** - OS: Ubuntu 24.04.2 LTS - Browser: Microsoft Edge Version 138.0.3351.109 (Official build) (64-bit) - RMM Version (as shown in top left of web UI): v1.2.0 **Installation Method:** - [x] Standard - [ ] Standard with `--insecure` flag at install - [ ] Docker **Agent Info (please complete the following information):** - Agent version (as shown in the 'Summary' tab of the agent from web UI): Agent 2.9.1 - Agent OS: Windows 11 Pro, 64 bit v24H2 (build 26100.3476) **Describe the bug** Policy-level agent exclusions are not honored when the policy is applied directly to a Site, causing the policy's tasks/checks to execute on agents that are explicitly marked as excluded within that policy. **To Reproduce** 1. Create a new Policy (e.g., "Software - LembretePonto"). 2. In this policy, go to "Show Policy Exclusions" and add one or more specific agents (e.g., "RH-11686") to the "Excluded Agents" list. 3. Go to "Show Relations" for this policy. 4. In the "Sites" tab, add a Site (e.g., "01 - CDR - Caçador/SC (Matriz)") that contains the excluded agent(s). 5. Ensure the policy is active and has assigned checks/tasks. 6. Observe that the policy's tasks are executed on the agent(s) listed in the "Excluded Agents" list (e.g., "RH-11686" task status shows "Synced with agent"), despite being excluded. **Expected behavior** When an agent is listed in the "Excluded Agents" for a policy, that agent should not receive or execute any tasks/checks from that policy, regardless of whether the policy is applied to "All Agents", individual agents, Clients, or Sites that the agent may belong to. The exclusion should take precedence over broader inclusions. **Screenshots** <img width="1238" height="573" alt="Image" src="https://github.com/user-attachments/assets/1c387466-59b3-47d5-a205-9eb6191f1be6" /> <img width="700" height="117" alt="Image" src="https://github.com/user-attachments/assets/951e3f28-0601-452a-9a96-fccc9e24dbd6" /> <img width="593" height="453" alt="Image" src="https://github.com/user-attachments/assets/638bd4a7-d5c7-4d54-b835-2b9456e5e4d6" /> <img width="699" height="413" alt="Image" src="https://github.com/user-attachments/assets/2ea9fd34-ac21-4a0c-ae08-e631235e69b7" /> <img width="978" height="316" alt="Image" src="https://github.com/user-attachments/assets/8281c6fa-8bc0-41ea-a720-70cfa0cbcb08" /> **Additional context** Through code analysis, this behavior appears to be related to the logic in `automation/models.py` within the `Policy` model, specifically the `related_agents` method. When a policy is related to a **Site** (via `self.workstation_sites` or `self.server_sites`), the `related_agents` method generates the list of target agents. The `Agent.objects.filter` calls within these branches (e.g., those using `site_id__in` or `site__client__in`) **do not explicitly exclude agents based on `excluded_agents_ids`** within that specific query chain. The `exclude(id__in=excluded_agents_ids)` logic seems primarily applied only when agents are *directly* associated with the policy (`self.agents`) or when evaluating "Default Server/Workstation Policies." This suggests that the current implementation treats Site-level policy application as a strong inclusion that bypasses agent-specific policy exclusions. This design makes granular exclusions difficult when policies are applied broadly to organizational units (Sites/Clients). **Workaround implemented:** To achieve the desired exclusion, we had to restructure the organizational hierarchy. We created a separate Site (e.g., "01 - CDR - Caçador/SC (Matriz - Gerência)") for the agents that needed to be excluded. The policy was then removed from the original broader Site and reapplied *only* to the original Site (now containing only the non-manager workstations). This effectively excludes agents by explicit inclusion/exclusion of Sites, rather than relying on policy-level agent exclusions.

kerem closed this issue

2026-03-14 07:11:35 +03:00

kerem commented

2026-03-14 07:11:40 +03:00

Author

Owner

@wh1te909 commented on GitHub (Aug 26, 2025):

thanks for the detailed report, we've just pushed a fix for this and it will be in the next release

@wh1te909 commented on GitHub (Aug 26, 2025): thanks for the detailed report, we've just pushed a fix for this and it will be in the next release

kerem commented

2026-03-14 07:11:46 +03:00

Author

Owner

@wh1te909 commented on GitHub (Oct 15, 2025):

released in v1.3.0

@wh1te909 commented on GitHub (Oct 15, 2025): released in v1.3.0