<?xml version="1.0" encoding="UTF-8"?><policy>
	<rule>
		<description>Set local variables to test existence of groups and for placement</description>
		<conditions>
			<or>
				<if-class-name op="equal">User</if-class-name>
			</or>
			<or>
				<if-operation op="equal">add</if-operation>
				<if-operation op="equal">modify</if-operation>
			</or>
		</conditions>
		<actions>
			<do-set-local-variable name="manager-group-dn">
				<arg-string>
					<token-text xml:space="preserve">Users\ManagersGroup</token-text>
				</arg-string>
			</do-set-local-variable>
			<do-set-local-variable name="manager-group-info">
				<arg-string>
					<token-dest-attr name="Object Class">
						<arg-dn>
							<token-local-variable name="manager-group-dn"/>
						</arg-dn>
					</token-dest-attr>
				</arg-string>
			</do-set-local-variable>
			<do-set-local-variable name="employee-group-dn">
				<arg-string>
					<token-text xml:space="preserve">Users\EmployeesGroup</token-text>
				</arg-string>
			</do-set-local-variable>
			<do-set-local-variable name="employee-group-info">
				<arg-string>
					<token-dest-attr name="Object Class">
						<arg-dn>
							<token-local-variable name="employee-group-dn"/>
						</arg-dn>
					</token-dest-attr>
				</arg-string>
			</do-set-local-variable>
		</actions>
	</rule>
	<rule>
		<description>Create ManagersGroup, if needed</description>
		<conditions>
			<and>
				<if-local-variable name="manager-group-info" op="available"/>
				<if-local-variable name="manager-group-info" op="not-equal">group</if-local-variable>
			</and>
		</conditions>
		<actions>
			<do-add-dest-object class-name="Group" when="before">
				<arg-dn>
					<token-local-variable name="manager-group-dn"/>
				</arg-dn>
			</do-add-dest-object>
		</actions>
	</rule>
	<rule>
		<description>Create EmployeesGroup, if needed</description>
		<conditions>
			<and>
				<if-local-variable name="employee-group-info" op="available"/>
				<if-local-variable name="employee-group-info" op="not-equal">group</if-local-variable>
			</and>
		</conditions>
		<actions>
			<do-add-dest-object class-name="Group" when="before">
				<arg-dn>
					<token-local-variable name="employee-group-dn"/>
				</arg-dn>
			</do-add-dest-object>
		</actions>
	</rule>
	<rule>
		<description>If Title indicates Manager, add to ManagerGroup and set rights</description>
		<conditions>
			<and>
				<if-class-name op="equal">User</if-class-name>
				<if-op-attr mode="regex" name="Title" op="equal">.*manager.*</if-op-attr>
			</and>
		</conditions>
		<actions>
			<do-set-dest-attr-value name="Group Membership">
				<arg-value type="string">
					<token-local-variable name="manager-group-dn"/>
				</arg-value>
			</do-set-dest-attr-value>
			<do-clone-op-attr dest-name="Security Equals" src-name="Group Membership"/>
		</actions>
	</rule>
	<rule>
		<description>If Title does not indicate Manager, add to EmployeeGroup and set rights</description>
		<conditions>
			<and>
				<if-class-name op="equal">User</if-class-name>
				<if-op-attr mode="regex" name="Title" op="not-equal">.*manager.*</if-op-attr>
			</and>
		</conditions>
		<actions>
			<do-set-dest-attr-value name="Group Membership">
				<arg-value type="string">
					<token-local-variable name="employee-group-dn"/>
				</arg-value>
			</do-set-dest-attr-value>
			<do-clone-op-attr dest-name="Security Equals" src-name="Group Membership"/>
		</actions>
	</rule>
</policy>
