A Peek Inside ConfigOS MPO’s Key Features – AutoSelect

Written by Jamie McCoard, Development Manager, SteelCloud

In modern enterprise environments, systems are constantly changing. New applications are installed, operating systems are upgraded, servers take on new roles, and endpoint configurations evolve over time. Managing compliance across these dynamic environments can quickly become challenging when administrators must manually determine which policies should apply to each system.

ConfigOS MPO AutoSelect solves this problem by automatically determining whether a policy should run on an endpoint before compliance scanning or remediation begins.

AutoSelect uses policy pre-check scripts to evaluate endpoint characteristics and determine policy applicability. Instead of applying every policy to every system, MPO intelligently selects only the policies that are relevant to the endpoint being evaluated.

For policy selection with pre-checks, MPO follows this workflow:

1. MPO runs a pre-check script on the endpoint that evaluates system characteristics such as:
   • Operating system and version
   • Installed roles and features
   • Registry values
   • Installed applications
   • Domain membership
   • Server type
2. Based on the results, MPO automatically determines whether the policy should run.

For example:

• If the pre-check detects Windows Server 2022 with IIS installed, MPO automatically selects and runs the IIS STIG policy.
• If SQL Server is not installed, SQL-related policies are automatically skipped.
• If Google Chrome is not present, Chrome compliance checks and remediation are not executed.

This intelligent policy selection helps ensure systems receive only the compliance content that applies to them.

Why Use AutoSelect?

AutoSelect provides several operational and administrative benefits:

• Reduced Policy Duplication

Organizations can maintain fewer policy collections by allowing MPO to dynamically determine policy applicability rather than creating multiple collections for different system types.

• Dynamic Infrastructure Support

AutoSelect adapts to changing endpoint configurations, making it easier to manage compliance across diverse Windows and Linux environments while reducing administrative overhead.

• Safer Automated Remediation

Running remediation against systems that do not meet policy prerequisites can introduce unnecessary risk. AutoSelect helps prevent incorrect remediation by ensuring policies execute only when appropriate conditions are met.

• Customization Flexibility

Organizations can encode institutional knowledge directly within pre-check scripts. For example, systems with hostnames beginning with “DEV-” may require different compliance requirements or approved exceptions than production systems. AutoSelect enables these custom business rules to be incorporated directly into policy selection.

• Improved Scalability

As environments grow from hundreds to thousands of endpoints, AutoSelect reduces manual administration and helps compliance programs scale more efficiently.

At its core, AutoSelect follows a simple principle: Run this policy only if the endpoint matches the pre-check rules.

How to Use AutoSelect

SteelCloud provides preconfigured pre-check scripts for all baseline policy adaptations included with MPO content. These scripts typically verify operating system versions, installed applications, or other environmental requirements. Customers can modify existing pre-check scripts or create custom pre-checks using MPO Forge.

To modify a policy pre-check:

1. In MPO Forge, open Policy Manager.
2. Right-click the baseline policy you wish to modify.
3. Select Edit Policy from the popup menu.
4. Click the Pre-Check button located in the policy information section.

The script editor opens.

1. • Windows policies use PowerShell.
   • Linux policies use Bash.

5. Modify the script as needed.
6. Click Accept Changes.
7. Save the baseline policy.
8. Build a collection using the modified policy.
9. Deploy the policy collection to Commander.

Understanding Pre-Check Script Syntax

Every pre-check script must return a response that MPO Shield can interpret.

For Windows policies:

return “{status}{:message}”

For Linux policies:

echo “{status}{:message}”

or

printf “{status}{:message}”

The supported status values are:

• SHOULDRUN – The policy is applicable and should execute.
• SHOULDNOTRUN – The policy is not applicable and should be skipped.
• ERROR – An error occurred during pre-check processing.

When SHOULDNOTRUN or ERROR is returned, messages are displayed to help administrators understand why a policy was skipped or failed.

Viewing AutoSelect Results

When AutoSelect determines that a policy should not run, the Job Runner displays a gray shield icon with a tooltip containing the message returned by the pre-check script.

For example, if Chrome or Firefox is not installed on the endpoint, MPO can skip those policies and display a message indicating that those applications do not require compliance scanning or remediation.

This visibility makes troubleshooting easier and helps administrators verify that policy selection is working as intended. 

Conclusion

AutoSelect transforms policy management from a static, manually maintained process into an intelligent, adaptive workflow. By automatically determining policy applicability before execution, MPO reduces administrative complexity, minimizes remediation risk, and improves scalability across diverse environments. Whether managing a small deployment or a large enterprise infrastructure, AutoSelect helps ensure that the right policies run on the right systems at the right time, creating a more efficient and reliable compliance management process.