One careless click in the Scope of Management can put every PC in the company — including the director’s and the factory floor’s — under management in a single afternoon. Here is how to define the scope so it grows in controlled stages instead.
The Scope of Management (SoM) is the boundary of your authority inside Endpoint Central: computers inside it get agents, patches, configurations and reports; computers outside it do not exist as far as the product is concerned. Defining it sounds like a five-minute admin task, and that is exactly the trap. Import the entire domain at once and every experimental configuration, every test deployment and every mistake from your learning period lands on production machines. Define it in stages and the same learning period happens on five friendly PCs.
Discovered is not the same as managed. The server can see the whole directory while you deliberately manage only a pilot handful.
Seeing every computer in the directory is fine. Adding every computer to the scope on day one is not.
Exclusions are a decision, not an oversight. Write down which machines stay out and why.
A staged scope with named exclusions. Every stage earns the next one.
Open Admin → Scope of Management and connect your Active Directory domain (or define your workgroup). Let the product discover domains, OUs and computers. Discovery alone changes nothing on those machines — the boundary is crossed only when you add computers to the scope and install the agent. Keeping those two ideas separate is the whole secret of a calm rollout.
Add your own computer and three or four machines whose users will forgive a surprise reboot and tell you honestly what happened. Install the agent on just these. Run your first inventory, first patch scan and first test deployment here. Every configuration you invent gets proven on the pilot before it is allowed anywhere else — this group never stops being useful, even after full rollout.
Add one organisational unit at a time — Accounts this week, Sales next week. An OU-sized step is big enough to matter and small enough to support: if something misbehaves, you know exactly which group received it and roughly when. Announce each stage to that department before the agent arrives; users who were told are users who do not raise virus panics about the new tray icon.
Some machines should stay outside the scope, at least at first: production servers, factory and billing-counter PCs that cannot reboot in working hours, and any machine under another team’s administration. Endpoint Central also lets you mark a device as excluded from management while keeping it inventoried — useful for machines you want visibility on but must not touch. Record every exclusion and its reason in your own notes; 'we never added it' and 'we deliberately excluded it' look identical in the console and are completely different decisions.
Branch-office computers belong in the scope under their own remote office, not lumped into the head-office list — that structure is what lets the product use distribution servers and sensible bandwidth behaviour later. If you define remote offices lazily now, restructuring them after agents are deployed is possible but tedious. Ten minutes of structure today beats a re-organisation project next quarter.
Every setting on this page is shown live in the ManageEngine configuration video — watch it once and your own setup becomes easy.
▶️ Watch Full VideoUnder the Admin tab, in Global Settings, click Scope of Management. From there you connect your domain or workgroup, add computers to the managed scope, and install the agent on them.
No. Add a small pilot group first, prove your configurations there, then grow OU by OU. A configuration mistake can only affect computers inside the scope, so a staged scope limits the damage while you are learning the product.
Yes. A device can be added to the Scope of Management and marked as excluded from management, so it appears in inventory but receives no configurations or deployments.