I am using ZESM v3.5.0.144.

Questions #1 and #2

Let's assume that
- user Fred is member of group Newbies
- I have assigned policy A to user Fred
- I have assigned policy B to group Newbies

Which policy will be effective for Fred? [I assume that the policy assigned to the user will block the "inheritance" (i.e. it will override the policy assigned to the group) but I would like to get an authoritive answer for my question.]

How can I un-publish policy A from the user (so that -- according the assumption above -- Fred should really "inherit" the policy assigned to the group)?

Question #3

After installing the ZESM agent on a workstation (but before publishing any policies for the user/group), I have expected that the default policy (embedded into the MSI installation environment) should be effective. Instead, the ZESM agent seems to randomly choose (and make effective) one of my policies (published for other users/groups).

(As you have already figured out, my policies are assigned to users rather than to workstations.)

Did somebody else experience this?

Question #4

Is it possible to trace (log) the activity of the ZESM client while it tries to determine the effective policy for the logged in user (without performing an SQL analysis as described at p. 207 of the manual)?

The pseudo-log below illustrates what I would like to get:
- querying Active Directory for effective policy of user Fred
- reading group membership of Fred -> result: group Newbies
- checking if a policy is assigned to group Newbies -> result: no policy
- checking if a poliy is assigned to user Fred -> result: policy C
- calculating effective policy for user Fred -> result: policy C

This information seems not to be included in the most verbose log I am aware of (ZESM agent > About > Diagnostics > Logging > Select all).