{"id":3144,"date":"2026-02-20T10:48:08","date_gmt":"2026-02-20T10:48:08","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/remote-script-execution\/script-deployment-policy\/"},"modified":"2026-02-20T11:45:22","modified_gmt":"2026-02-20T11:45:22","slug":"script-deployment-policy","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/remote-script-execution\/script-deployment-policy\/","title":{"rendered":"Deployment Policy for Scripts"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p>A <strong>Deployment Policy<\/strong> in Zecurit defines <em>how<\/em>, <em>when<\/em>, and <em>in what context<\/em> a script runs on target endpoints. While the Script Repository stores your scripts, the Deployment Policy is what actually controls script execution, including scheduling, retry logic, logging, and network conditions.<\/p>\n\n\n\n<p>Every script you want to deploy needs an associated Deployment Policy. Once created and published, the policy can be distributed to individual devices or device groups.<\/p>\n\n\n\n<p>Navigate to <strong>Manage \u2192 Deployment \u2192 Deployment Policy \u2192 Add<\/strong> to create a new policy.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step-by-Step: Creating a Script Deployment Policy<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1 : Policy Details<\/h3>\n\n\n\n<p><strong>Policy Name<\/strong> <em>(required)<\/em> Enter a clear, descriptive name. Recommended format: <code>[Platform]-[Script Purpose]-[Frequency]<\/code><br>Example: <code>WIN-DiskCleanup-Weekly<\/code>, <code>MAC-SecurityAudit-Monthly<\/code><\/p>\n\n\n\n<p><strong>Category<\/strong> Select <strong>Script<\/strong> (not Software). This tells Zecurit you&#8217;re deploying a script from the repository rather than a software package.<\/p>\n\n\n\n<p><strong>Add Description<\/strong> <em>(optional)<\/em> Click &#8220;Add Description&#8221; to document the policy&#8217;s purpose, affected systems, change ticket reference, or approval details.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 : Script Selection<\/h3>\n\n\n\n<p><strong>Select Script<\/strong> Choose a script from the dropdown list, which pulls from your Script Repository. Only scripts that match your environment will appear.<\/p>\n\n\n\n<p>If the script you need doesn&#8217;t exist yet, click <strong>Add Script<\/strong> to open the script creation panel inline without leaving the policy creation flow.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Tip:<\/strong> Each Deployment Policy references one script. To run multiple scripts in sequence, either combine them into a single script or create separate policies and distribute them in order.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3 : Execution Context<\/h3>\n\n\n\n<p><strong>Run As<\/strong> : Choose how the script runs on the endpoint:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Option<\/th><th>Description<\/th><th>Best For<\/th><\/tr><\/thead><tbody><tr><td><strong>System<\/strong><\/td><td>Runs with full system\/SYSTEM account privileges<\/td><td>Maintenance, patching, registry changes<\/td><\/tr><tr><td><strong>Logged-in User<\/strong><\/td><td>Runs as the user currently logged in<\/td><td>User-specific settings, mapped drives<\/td><\/tr><tr><td><strong>Run as User<\/strong><\/td><td>Runs as a specified user account<\/td><td>Service account scenarios, delegated tasks<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Security note:<\/strong> System context provides maximum privileges but cannot access user-specific resources (mapped network drives, user registry hives). Use &#8220;Logged-in User&#8221; when user context is required.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4 : Logging<\/h3>\n\n\n\n<p><strong>Capture Script Output<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Yes<\/strong> <em>(default)<\/em> \u2014 Captures stdout and stderr from the script for review in the device&#8217;s Deployments tab.<\/li>\n\n\n\n<li><strong>No<\/strong> \u2014 No output is captured. Use this if the script output contains sensitive data you don&#8217;t want stored.<\/li>\n<\/ul>\n\n\n\n<p><strong>Max Output Size<\/strong> Set the maximum size of captured output. Default is <strong>10 MB<\/strong>. Adjust downward for lightweight scripts generating short output, or upward for diagnostic scripts with verbose logs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5 : Deployment Handling Rules<\/h3>\n\n\n\n<p><strong>Network Conditions<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Any Network<\/strong> <em>(default)<\/em> : The script deploys whenever the device is online, regardless of network type.<\/li>\n\n\n\n<li><strong>LAN Only<\/strong> : Restricts script deployment to devices connected via local network. Useful for large payload scripts where bandwidth is a concern.<\/li>\n<\/ul>\n\n\n\n<p><strong>Retry on Failed Targets<\/strong> Toggle <strong>ON<\/strong> to automatically retry script execution on endpoints where it failed.<\/p>\n\n\n\n<p>When enabled, configure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Retry Count<\/strong> \u2014 Number of retry attempts (e.g., <code>1<\/code>, <code>2<\/code>, <code>3<\/code>). Default is <code>1<\/code>.<\/li>\n\n\n\n<li><strong>Retry Interval<\/strong> \u2014 Time between retry attempts in minutes (e.g., <code>15<\/code>, <code>30<\/code>, <code>60<\/code>). Default is <code>15 minutes<\/code>.<\/li>\n\n\n\n<li><strong>Retry After Reboot<\/strong> \u2014 Toggle <strong>ON<\/strong> to retry execution after the device reboots. Particularly useful for scripts that require a reboot to complete (e.g., Windows Update application).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6 : Schedule<\/h3>\n\n\n\n<p>Choose when the script should execute:<\/p>\n\n\n\n<p><strong>Deploy Immediately<\/strong> The script runs as soon as the device contacts the Zecurit server. The device does not need to be online at the moment of policy publication \u2014 it will execute on next check-in.<\/p>\n\n\n\n<p><strong>Schedule Deployment<\/strong> Sets a specific start date and time for execution. If the device is offline at the scheduled time, execution begins when the device next contacts the server.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Start Date<\/strong> \u2014 Set the date and time using the date picker.<\/li>\n\n\n\n<li><strong>Time Zone<\/strong> \u2014 Select the appropriate time zone (e.g., <code>GMT +05:30 Asia\/Kolkata<\/code>).<\/li>\n<\/ul>\n\n\n\n<p><strong>Execute at Every Startup<\/strong> When checked, the script runs every time the device boots up. Useful for scripts that enforce configurations, check health on login, or collect startup metrics.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Tip:<\/strong> For scripts that should run once (e.g., one-time migrations), use <strong>Schedule Deployment<\/strong> with a specific date. For recurring maintenance (e.g., weekly cleanup), consider <strong>Execute at Every Startup<\/strong> or use recurring scheduling.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7 : Notification<\/h3>\n\n\n\n<p><strong>Notify administrators about deployment status<\/strong> Toggle <strong>ON<\/strong> to send email notifications to administrators when the deployment completes or fails. Off by default.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8 : Save or Publish<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Action<\/th><th>Effect<\/th><\/tr><\/thead><tbody><tr><td><strong>Save as Draft<\/strong><\/td><td>Saves the policy without activating it. Useful for work-in-progress policies pending review.<\/td><\/tr><tr><td><strong>Publish<\/strong><\/td><td>Activates the policy and makes it available for distribution to devices and groups.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Note:<\/strong> Only <strong>Published<\/strong> policies can be associated with devices or groups. Draft policies are not distributed.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Use Case: Scheduled Weekly Disk Cleanup Policy<\/h2>\n\n\n\n<p><strong>Scenario:<\/strong> Run a disk cleanup script every Monday at 2:00 AM across all Windows workstations.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Deployment Policy \u2192 Add<\/strong>.<\/li>\n\n\n\n<li><strong>Policy Name:<\/strong> <code>WIN-DiskCleanup-MondayAM<\/code><\/li>\n\n\n\n<li><strong>Category:<\/strong> Script<\/li>\n\n\n\n<li><strong>Select Script:<\/strong> <code>WIN-Cleanup-TempFiles-Weekly<\/code> (from Script Repository)<\/li>\n\n\n\n<li><strong>Run As:<\/strong> System<\/li>\n\n\n\n<li><strong>Capture Script Output:<\/strong> Yes | <strong>Max Output:<\/strong> 10 MB<\/li>\n\n\n\n<li><strong>Network Conditions:<\/strong> Any Network<\/li>\n\n\n\n<li><strong>Retry on Failed Targets:<\/strong> ON | Count: 1 | Interval: 30 min | Retry After Reboot: OFF<\/li>\n\n\n\n<li><strong>Schedule:<\/strong> Schedule Deployment \u2192 Set to next Monday 02:00 AM \u2192 Time Zone: your local zone<\/li>\n\n\n\n<li>Click <strong>Publish<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p>Now associate this policy with your Windows device group (see Associate Policy to Devices\/Groups \u2192).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Use Case: Security Audit Policy (Run at Every Startup)<\/h2>\n\n\n\n<p><strong>Scenario:<\/strong> Enforce a baseline security check every time a device boots.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Policy Name:<\/strong> <code>WIN-SecurityBaseline-OnBoot<\/code><\/li>\n\n\n\n<li><strong>Category:<\/strong> Script<\/li>\n\n\n\n<li><strong>Select Script:<\/strong> Your security audit script<\/li>\n\n\n\n<li><strong>Run As:<\/strong> System<\/li>\n\n\n\n<li><strong>Capture Script Output:<\/strong> Yes | <strong>Max Output:<\/strong> 5 MB<\/li>\n\n\n\n<li><strong>Network Conditions:<\/strong> Any Network<\/li>\n\n\n\n<li><strong>Retry:<\/strong> ON | Count: 2 | Interval: 15 min<\/li>\n\n\n\n<li><strong>Schedule:<\/strong> Check <strong>Execute at Every Startup<\/strong><\/li>\n\n\n\n<li>Click <strong>Publish<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Editing and Versioning Policies<\/h2>\n\n\n\n<p>After publishing a policy, you can edit it at any time. Each edit creates a new <strong>Version<\/strong> of the policy. When you re-distribute an updated policy to devices, the new version is pushed automatically. You can track which version is installed on each device in the device&#8217;s <strong>Deployments<\/strong> tab.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/zecurit.com\/help\/endpoint-management\/remote-script-execution\/script-repository\/\" data-type=\"docs\" data-id=\"3143\">Script Repository<\/a> \u2192<\/li>\n\n\n\n<li><a href=\"https:\/\/zecurit.com\/help\/endpoint-management\/remote-script-execution\/associate-script-deployment-policy\/\">Associate Policy to Devices\/Groups<\/a> \u2192<\/li>\n\n\n\n<li><a href=\"https:\/\/zecurit.com\/help\/endpoint-management\/remote-script-execution\/script-best-practices\/\">Script Best Practices<\/a> \u2192<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"featured_media":0,"parent":3019,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-3144","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3144"}],"version-history":[{"count":2,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3144\/revisions"}],"predecessor-version":[{"id":3161,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3144\/revisions\/3161"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3019"}],"prev":[{"title":"Script Repository","link":"https:\/\/zecurit.com\/help\/endpoint-management\/remote-script-execution\/script-repository\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3143"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3144"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}