Managed groups vs Regular groups

AtanasT

Hello All,

I am new here and I am trying to understand how to organize our work most efficiently. After reading a lot of articles from the knowledge hub I still cannot answer some questions of mine and I would be glad if you can help me.

In our organization we have multiple administrators that need to able to perform remote support to our customers. We are managing the Host deployment centrally and in the end the computers get assigned to a single account and go in a regular group which then needs to be shared with all other administrators. The deployment is automated and uses single ConfigID and API token.

On the other hand we have managed groups which we may utilize by using the assignment to the company profile and add managers to the managed groups.

Basically the end result is more or less the same and I was wondering what is the main difference between the managed and regular groups? I assume that in large organizations maybe it is worth using the managed groups as they probably would be still manageable if the administrator account that created them is removed or disabled. However I would be glad to make me aware if I am on the right path.

Another thing that I have noticed related to the topic is that if a computer was already installed with a host agent and assigned to an account with the below command, then it cannot be updated via command line to get assigned to the company profile.

msiexec.exe /i "Path\To\TeamViewer_Host.msi" /qn
ping -n 31 127.0.0.1>nul
Path\To\TeamViewer.exe assign --api-token=YOURTOKEN

So in the end the below command is not leading to any results for computers assigned with the previous command in the console:

TeamViewer.exe assignment --id paste_your_assignment_id_here 

However it works ok when executed after a fresh install of the host agent without the assign parameters.

Would you please advise how can I easily convert via command line all the computers I am currently managing to company managed devices? Should I reinstall all the current installations to get to this result?

Best Regards,

Atanas

JeanK

Hello @AtanasT,

Thank you for your detailed post - I will try to help you as much as I can.

To understand the benefits (and therefore the difference between the regular groups) of the Managed Devices, I recommend reading this article:

https://community.teamviewer.com/English/kb/articles/106782-managed-devices-managed-groups-and-managed-users#what-are-the-advantages-of-managed-devices

Espacially, the part What are the advantages of Managed Devices?

Now coming to the second part of your post, for devices that already have the TeamViewer Host installed, you will need to use the following command line to assign them to your main TeamViewer account:

"C:\Program Files (x86)\TeamViewer\TeamViewer.exe" assign --api-token xxxxx --reassign --grant-easy-access --alias %ComputerName% 

However, if these device are already assigned to a different account, they must be unassigned first before using this command.

Let me know if this could help... looking forward to hearing from you!

All the best,

JeanK

AtanasT

Thanks for the reply, JeanK!

I have read the article before I have started the thread, however it does not clearly state when and why I should use managed vs regular groups. The listed advantages are more or less relevant for the regular groups:

Within the Managed groups you can:

• import existing managed devices - it can be done in regular groups too
• create managed groups - works the same for regular groups
• add devices to Managed Groups - works the same for regular groups
• add managers to Managed Groups and Devices - can be done with sharing permissions
• administer individual permissions of added managers - not possible in the regular groups
• apply policies to Managed Devices - works the same for regular groups

For the second part:

I have already used that command line to assign the computers to my account, but the issue is that these computers are now listed in a regular group and stated to be not managed by the company profile even when I manually move them to the managed groups.

My question was how can I make these computers managed by the company when they have been already assigned to my account without re-installing them? Is there a particular reason this command not to be taken in consideration by the management console for computers that already have been assigned to a particular account? It works for the newly installed computers that have been set only with the ConfigID but not with the api key and assign option.

start /wait MSIEXEC.EXE /I "TeamViewer_Host.msi" /qn CUSTOMCONFIGID=my_ConfigID DESKTOPSHORTCUTS=0
choice /C X /T 30 /D X > nul
TeamViewer.exe assignment --id paste_your_assignment_id_here 

Here is some example how it looks like for a computer that was assigned to my account with the command you suggested. Then it was moved to Managed devices with the import tool from the management console as the command line did not work, and in the end the device have to be manually associated to the company as the command line was not taken in account by the management console.

If I perform the same command on a new computer it would set the computer in the managed devices with the association to the company.

JeanK

Hey, it's me again.

I had a meeting where my colleague @TV_Benjamin showed me in a nutshell the main differences in detail about regulard groups and managed groups.

The biggest benefit you have from Managed groups is that devices are assigned to the company, and not to a user anymore.

With the regular groups, if the user that "owns" (=that created and shared) the groups gets deleted or deactivated, all users will lose access to the shared groups, which can lead to a major problem for you.

With the Managed groups, it does not matter who created the groups. The devices are assigned to the company and can centrally be managed by Managers and Roles can be granted. So you have a whole new level of granularity when it comes to managing your devices.

However, this is only one part of the benefits. There is a lot more that is not possible to summarize in a post. As you have a Tensor license, I would recommend to ask our customer support for an introduction into this new feature.

I hope you understand where I am coming from... 😊

Regarding the second part - a deeper investigation would be necessary, as our engineers think that this issue can be caused by many factors. the most efficient way would be to open a ticket.

➡Open a ticket

To save time, please attach the logs files of one impacted device to the ticket.

I hope our team will find the solution as soon as possible! ⛄❄

AtanasTodorov

Thanks JeanK,

The issue is now resolved and the command with the assignment id works now.

I have managed to associate the computers with the company profile and put them in managed groups.

One question still bothers me as it seems there are some efforts towards the managed groups and company profile but I still miss user groups that can be assigned with different permissions over the managed groups. Now I need to check all the administrators I have set for the groups one by one when I need to verify or change their permissions. It would be much easier to have a group and the permissions to be assigned to its members. Is there some plan to implement that?

JeanK

You're welcome! Happy that the command worked out.

If I understand you correctly, you want to verify or change permissions in the most efficient way.

I recommend using the bulk change feature. With this, you can target multiple users based and apply changes to their settings.

https://community.teamviewer.com/English/kb/articles/106150-bulk-user-change-in-management-console

Let me know if this is what you were looking for!