A computer group is a set of devices collected under one administrative rule, usually for targeting policies, scripts or configuration profiles. The grouping can be static or based on criteria such as operating system, hardware model or user assignment, so managed settings apply to the intended endpoints.
What a computer group actually is
A computer group is an administrative collection of devices that lets an organisation target settings, scripts, and policy enforcement to a defined endpoint set. The core idea is control at the group level, so administrators can apply the right configuration to the right machines without managing each device individually.
That makes the group a management boundary, not just a label. A device can belong because it fits a static list, or because it matches a rule such as operating system, hardware model, or assigned user, which is why group design matters for consistency and scope control.
How group membership drives policy targeting
Computer groups are most useful when policy needs to follow an operational pattern rather than a single endpoint. For example, a security baseline can be targeted to all laptops, a deployment script can be limited to a hardware family, or a configuration profile can be applied only to a business unit’s managed devices.
The practical value is precision. Good grouping reduces manual exceptions and helps prevent settings from landing on systems that should not receive them, which is especially important when a policy changes authentication, update behaviour, logging, or device hardening.
At the same time, group logic can create hidden dependencies. If the criteria are too broad, a change may reach endpoints that were never intended to receive it; if they are too narrow, managed devices can fall out of policy coverage and drift from the intended baseline.
Static groups and dynamic groups
Static groups are maintained by explicit device membership, so they are predictable and easy to understand. Dynamic groups use criteria to add or remove devices automatically, which scales better when the fleet changes frequently, but it also makes the rule logic itself a control point that must be reviewed carefully.
That distinction affects both administration and trust. Static membership is usually clearer for tightly controlled populations, while dynamic membership is better for large or fast-changing estates where the main requirement is that every matching endpoint is consistently captured.
In practice, the right model depends on whether the organisation values explicit curation or continuous classification. Either way, the group definition should remain aligned with the real management objective, such as patch distribution, baseline enforcement, or user-scoped device configuration.
Where computer groups fit in endpoint management
Computer groups sit inside broader endpoint management and configuration governance. They are often the mechanism that turns an abstract policy into an enforceable action across a fleet, which is why they are central to device administration even when the policy itself is written elsewhere.
For that reason, a group should be designed around a stable operational attribute, not convenience alone. If the grouping logic changes unpredictably, the same policy can behave differently over time, making troubleshooting and auditability harder.
Used well, grouping creates a repeatable path from device inventory to targeted control. Used poorly, it becomes a source of configuration drift, missed coverage, and accidental overreach.
Risk and Threat Considerations
Computer groups create a concentrated control plane, so a mistake in membership logic can propagate to many endpoints at once. A bad rule, stale inventory, or overbroad assignment can expose devices to the wrong configuration, while a missed membership condition can leave important machines unmanaged and inconsistent.
Failure mechanism: Incorrect grouping criteria or membership drift causes policies, scripts, or profiles to be applied to the wrong devices, or not applied to devices that need them.
Impact: The result can be misconfiguration at scale, uneven security posture, failed hardening, and gaps in visibility or control across the endpoint estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Computer groups depend on an accurate device inventory to target policies and profiles. |
| PR.PS-01 — Configurations are managed consistent with policies and procedures | Computer groups are a mechanism for applying configuration policy to defined endpoints. | |
| Recommendation — Keep endpoint inventory current so group membership and targeted policy scope stay accurate. Use controlled group membership to enforce approved device configurations consistently. | ||
| NIST SP 800-53 Rev 5 | CM-2 — Baseline Configuration | Group-targeted settings are a practical way to deploy and maintain baseline configurations. |
| CM-6 — Configuration Settings | Groups are commonly used to apply configuration settings to the intended endpoint population. | |
| Recommendation — Assign baseline configurations through well-defined device groups and review scope regularly. Apply configuration settings through groups that match the intended device population. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Computer groups help enforce secure configuration across selected enterprise assets. |
| Recommendation — Use device groups to distribute and verify secure configuration settings at scale. | ||
Practitioner Guidance
Why practitioners should care: A computer group is only as reliable as the inventory and criteria behind it. Treat the group definition as part of the control itself, not as a convenience layer, because it determines the real scope of every targeted action.
What to watch for: Revisit group rules whenever operating system mix, hardware standards, or device ownership patterns change. If membership becomes hard to explain, or if devices unexpectedly appear or disappear from a group, the policy outcome is probably no longer trustworthy.
Practitioner takeaway: Clear grouping logic is what makes endpoint targeting safe, repeatable, and auditable.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org