## Assigning policies to clients

Symantec Endpoint Protection policies are assigned to groups of clients. A group can inherit its policies from a parent group. By default, all groups inherit policies from the root group that is created when Symantec Endpoint Protection Manager is installed. If you try to assign a policy to a group that inherits its policies from a parent, the policy assignment fails. Policy inheritance is enabled or disabled on a group in the Symantec Endpoint Protection Manager console.

Remote management of Symantec Endpoint Protection policies by means of web service calls provides the following functionality:

- Import a policy to a Symantec Endpoint Protection Manager site.

  The policy must first be exported by using the Symantec Endpoint Protection Manager console. After the policy is exported, web service calls can be used to import the policy to any other management sites in a customer's network.

- Assign a policy to a specified group. If the policy already exists in the local Symantec Endpoint Protection Manager policy library, it does not need to be exported or imported.

Changes to policy settings must be made in the Symantec Endpoint Protection Manager console.

See Managing the Symantec Endpoint Protection client with web services.