Defining Targets

Last Updated On: 13 Oct 2026|

24 minutes read |

Overview

After defining a configuration, it must be deployed to the target client workstations. Targets need to be defined individually for each configuration or collection of configurations. To deploy a configuration, the targets must be added to the Target List, where they can be added, removed, or modified as needed.

There are two types of configurations you can deploy in Endpoint Central MSP:

Computer Configuration
User Configuration

Note

The targeting options described in this document apply to standard Computer and User Configurations. Custom Groups are the supported target source for policy deployment. To deploy a policy to computers in a specific Remote Office, create a Dynamic Custom Group with the criteria Remote Office equal to the required remote office name, and deploy the policy to that group.
When a configuration is deployed immediately, only 200 computers are processed at a time because immediate deployment is resource intensive. The note displayed in the Select Target window about this limit is not an error. The remaining computers receive the configuration within the next 90-minute refresh cycle or at the next system startup.

Computer Configurations

This type of configuration is applied at the system level and affects the computer regardless of which user is logged in. Examples include installing software, deploying patches, or modifying system-level settings.

Selecting Targets from a Domain

To add target computers and users from an Active Directory-based domain, follow the steps below:

In the Target 1 tab, select a Domain from the list.
You can now proceed to narrow down your targets using the Filter Computers based on drop-down, which allows you to specify the second-level targets after choosing the Domain.
You can deploy the configuration to any of the following:
- Site - to deploy the configuration to all the users/computers of that site.
- Remote Office - to deploy the configuration to all the users/computers of that Remote Office.
- Organizational Unit - to deploy the configuration to all the users/computers of that OU.
- Group - to deploy the configuration to all the users/computers of that Group.
- User/Computer - to deploy the configuration to the specified users/computers.
- IP Addresses - to deploy the configuration to the specified IP Addresses.
- Custom Group - to deploy the configuration to all the users/computers of the selected Custom Group.
- Dynamic Custom Group - to deploy the configuration to all the computers of that dynamic custom group.
- IP Range - to deploy the configuration to all the computers belonging to that IP range.
- Processor Architecture - to deploy the configuration to all the computers having that Processor Architecture.
- Operating System - to deploy the configuration to all the computers with that Operating System.
- Device Friendly Name - to deploy the configuration to all the computers with the specified device friendly name.
- Machine Type - to deploy the configuration to all the computers with that machine type.
After adding the target computers, you can specify the filtering criteria to exclude certain types of users/computers from applying the configuration. Specify the criteria as required.
Click Add More Targets and repeat steps 1 to 3 for adding more targets.

Note

Selecting a second-level target is optional. If you select only the Domain and leave the Filter Computers based on field empty, the configuration is applied to all the computers in that domain, except the computers specified under Exclude Target.

Warning

When a Domain is selected as the target, a warning is displayed stating that the configuration data will be replicated to all the distribution servers. To avoid unnecessary replication, specify the required Remote Office as the target instead.

Selecting Targets from a Workgroup

To add target computers and users from a workgroup, follow the steps below:

Select a workgroup from the list.
You can deploy the configuration to any of the following:
- Remote Office - to deploy the configuration to all the users/computers of that Remote Office.
- Computer - to deploy the configuration to the specified users/computers.
- IP Addresses - to deploy the configuration to the specified IP Addresses.
- Custom Group - to deploy the configuration to all the users/computers of the selected Custom Group.
- Dynamic Custom Group - to deploy the configuration to all the computers of that dynamic custom group.
- IP Range - to deploy the configuration to all the computers belonging to that IP range.
- Processor Architecture - to deploy the configuration to all the computers having that Processor Architecture.
- Operating System - to deploy the configuration to all the computers with that Operating System.
- Machine Type - to deploy the configuration to all the computers with that machine type.
After adding the target computers, you can specify the filtering criteria to exclude certain types of users/computers from applying the configuration. Specify the criteria as required.
Click Add More Targets and repeat steps 1 to 3 for adding more targets.

Selecting Targets in Remote Offices

To add target computers and users from remote offices, follow the steps below:

In the Target 1 tab, select a Remote Office from the list.
You can now proceed to narrow down your targets using the Filter Computers based on drop-down, which allows you to specify the second-level targets after choosing the Remote Office. For example, to target a single computer, select Computer from the drop-down and choose the required computer after defining the first level of target with remote office.
You can deploy the configuration to any of the following:
- Domain - to deploy the configuration to all the users/computers of that domain.
- Site - to deploy the configuration to all the users/computers of that site.
- Organizational Unit - to deploy the configuration to all the users/computers of that OU.
- Group - to deploy the configuration to all the users/computers of that Group.
- Computer - to deploy the configuration to the specified computers.
- Device Friendly Name - to deploy the configuration to the computers with the specified device friendly name.
- IP Addresses - to deploy the configuration to the specified IP Addresses.
- Custom Group - to deploy the configuration to all the users/computers of the selected Custom Group.
- Dynamic Custom Group - to deploy the configuration to all the computers of that dynamic custom group.
- IP Range - to deploy the configuration to all the computers belonging to that IP range.
- Processor Architecture - to deploy the configuration to all the computers having that Processor Architecture.
- Operating System - to deploy the configuration to all the computers with that Operating System.
- Machine Type - to deploy the configuration to all the computers with that machine type.
After adding the target computers, you can specify the filtering criteria to exclude certain types of users/computers from applying the configuration. Specify the criteria as required.
Click Add More Targets and repeat steps 1 to 3 for adding more targets.

Filter the selected target

You can exclude certain parts of the network which does not require the configuration to be deployed. This is optional when defining the targets. Endpoint Central MSP provides the option to exclude the parts of the Windows network. Select the Exclude Target check box to view the available options:

Note

Any target added under Exclude Target is skipped during deployment. If a group that is meant to receive the configuration, such as a Dynamic Custom Group, is placed under Exclude Target, its computers will not receive the configuration. Move such groups to the target list instead.
Only one exclusion criterion can be selected at a time. To specify a different exclusion criterion, remove the existing exclusions and select the required criterion. For example, when an Operating System exclusion is set, a specific computer cannot be added as an exclusion until the Operating System exclusions are removed and the exclusion type is changed to Computer.

Exclude if Target Type is

Select the type of target you want to exclude from configuration deployment using the Select the target type and define field. The target types can be excluded which are in a lower hierarchy than the target selected, meaning select the required domain/remote office. Define the required targets and then define the exclusions. The target type can be excluded using the Browse button. Click the Browse button next to the required target types under the Exclude if Target Type is field to launch Network Browser window. Select the target type to be excluded for configuration deployment and click Select button. This field is mandatory. The target type can be any of the following (varies based on the target options selected):

Branch - The branch offices to be excluded
Domain - The domains to be excluded
Organization Unit - The OUs to be excluded
Group - The groups to be excluded
Computer - The computers to be excluded.
IP Range - The range of IP Addresses to be excluded
Custom Group - The custom groups to be excluded.
Operating System - Exclude computers running the selected Windows operating systems from configuration deployment.
Machine Type - Exclude computers based on their machine type, such as Notebook, Tablet PC, Desktop, Member Server, TermServClient, or Domain Controller.

User Configurations

This configuration is applied at the user level and is specific to individual user profiles. It comes into effect when the targeted user logs into any computer within the defined scope. Examples include setting desktop wallpaper, configuring Outlook profiles, or configuring desktop shortcuts.

Computer-based exclusion and inclusion in user configuration:

When configuring user-based settings, there may be scenarios where certain computers need to be either excluded from or included in applying these configurations during user login. Endpoint Central MSP allows you to set both computer-based exclusions and inclusions to fine-tune which computers should or should not receive the configurations based on different criteria. The exclusion feature helps prevent configurations from being applied to specific computers, while the inclusion feature ensures that configurations are applied only to the desired systems. This flexibility helps ensure that configurations are precisely applied as intended.

Target Categories:

You can filter users using a second-level filter and further include or exclude specific computers for configuration deployment. This will ensure the configuration is applied only when users log in to the included computers, and it will be ignored on excluded computers.

To facilitate this, Second level targets are split into two:

User targets - Allows you to select users from a specific remote office or domain main target.
- Domain
- Organizational Unit
- Group
- User
- User Custom group - see User Custom Group to create one.
Computer targets - where selected users login to specific computers criteria can be added.
- Computer
- Domain
- Custom Group
- Dynamic Custom Group
- IP address
- IP range
- Processor Architecture
- Operating System
- Machine Type

Note

User targets are specified using the Filter Users based on field, and computer targets are specified using the Filter Computers based on field. Leaving Filter Users based on empty applies the configuration to all users who log in to the targeted computers (the "User Target empty" column in the table below).
Computer-specific attributes, such as Operating System, Machine Type, and Processor Architecture, are available as filtering criteria only under Filter Computers based on. Use this filter to include or exclude computers based on the required criteria.
Once an Entra ID domain is integrated, it can be selected as the Domain in Define Target, and Entra ID users can be targeted in the same way as Active Directory users.

Configuration Scenarios

Various scenarios where user and computer filters can be applied are mentioned in table below

To implement computer-based exclusions, there are several configuration scenarios you can use when setting the inclusion and exclusion targets for users and computers. Below are the scenarios in which these exclusions can be applied.

	User Target Include	User Target Exclude	User Target Empty
Computer Target Include	The configuration applies when a user from the selected user group logs in to a computer in the selected computer group.	The configuration applies when any user other than those in the excluded user group logs in to a computer in the selected computer group.	The configuration applies when any user within the target scope logs in to a computer in the selected computer group.
Computer Target Exclude	The configuration applies when a user from the selected user group logs in to any computer except those in the excluded computer group.	The configuration applies when any user other than those in the excluded user group logs in to a computer outside the excluded computer group.	The configuration applies when any user within the target scope logs in to a computer outside the excluded computer group.
Computer Target Empty	The configuration applies when a user from the selected user group logs in to any computer within the target scope.	The configuration applies when any user other than those in the excluded user group logs in to any computer within the target scope.	The configuration applies when any user within the target scope logs in to any computer within that scope.

Note for Professional edition: User can be selected as Main Target itself.

Configuration Summary Page

The Configuration Summary page displays the selected targets, filters, and exclusions defined for the configuration. The details displayed vary based on whether it is a Computer Configuration or a User Configuration.

Computer Configuration Summary

For Computer Configurations, the Summary page displays the following details:

Target Scope - Displays the main target selected for deployment.
Filter By - Displays the second-level filter selected to narrow down the targets.
Apply To - Displays the computers included for configuration deployment.
Excluded Items - Displays the computers or groups excluded from configuration deployment.

Note

If Apply To is empty, the configuration applies to all computers within the Target Scope, except those listed under Excluded Items.

User Configuration Summary

For User Configurations, the Summary page displays the selected user and computer targeting criteria, including the filters and exclusions defined for deployment.