I have 2 questions about Dynamic GroupsSolved

Participant
Discussion
3 weeks ago Jan 21, 2026

1.- How do i create a Dynamic group that displays all newly enrolled macs as of today. ( not a report, since i cant use that for a policy)
The idea is, to deploy a feature to newly enrolled devices 1 time via policy. Since i cant modify th epolicy to say run 1 time only. Since the policy will run 1 time, the device should clear the next day out of that group.

2.- A dynamic group that shows all my users with a bad Filevault recovery key. The Current 3 (N/a, Enabled,disabled)  options do not show the faulty ones. As you can see its set by the MDM but the MDM says its broken. Screenshot 2026-01-13 at 10.21.50 AM.pngScreenshot 2026-01-13 at 10.21.56 AM.png

Replies (3)

Marked SolutionPending Review
Hexnode Expert
3 weeks ago Jan 23, 2026
Marked SolutionPending Review

@jiggieman to answer the first question, you don’t need to create a Dynamic Group for this use case. The recommended approach is to configure an automation under the Automate tab, which allows you to automatically deploy policies to newly enrolled devicesHere, you can set an enrollment-based trigger that will cause the policy to be associated every time a new device enrolls in the portal. You can configure this by following the steps below, 

  1. In the Hexnode portal, go to Automate > Active Automations. 

  1. Click on New Automation and then select New Automation > macOS. 

  1. In Actions, select the action Associate Policy under Policy. Choose your policy from the list. 

  1. In Settings and Schedule, set the Trigger setting to Activity. Under Initiate > Enrollment, select Device Enrollment. 

  1. In the next steps, you can configure any filters if needed, and then review the automation settings and save them.

Regarding your second question, it is currently not possible to create a dynamic group to identify users with an invalid or broken FileVault recovery key. However, you can generate a custom report under the Reports tab, where you can view the FileVault recovery key of the users with FileVault enabled. If the recovery key is faulty or not retrievable, as in your case, it would show up as N/A in the corresponding column displaying the FileVault recovery keys. This way, you can identify the users with “faulty” FileVault recovery keys.  

Let me know if you have any other questions–happy to help! 

Marked SolutionPending Review
Participant
16 hours ago Feb 10, 2026
Marked SolutionPending Review

I guess this workaround would do.. 

Marked SolutionPending Review
Hexnode Expert
16 hours ago Feb 10, 2026
Marked SolutionPending Review

@jiggieman , glad it worked!

Save