A computer-implemented method of quarantining a managed server within an administrative domain, wherein the administrative domain includes a plurality of managed servers (130A, 130B) that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules, so that the quarantined managed server is isolated from other managed servers in the plurality of managed servers in that the other managed servers block inbound network traffic that originated from the quarantined managed server, the method being executed by a global security module of a global manager based on security-related information received from the plurality of managed servers, the method comprising: modifying a description of the managed server to indicate that the managed server is quarantined, thereby specifying a description of the quarantined managed server; updating cached actor-sets to indicate the quarantined managed server's changed state, thereby specifying updated actor-sets, wherein an actor-set is a representation of descriptions of managed servers and unmanaged device groups; determining which updated actor-sets are relevant to an other managed server, thereby specifying currently-relevant updated actor-sets; determining whether the currently-relevant updated actor-sets differ from actor-sets previously sent to the other managed server; responsive to determining that the currently-relevant updated actor-sets do not differ from the previously-sent actor-sets, taking no further action; responsive to determining that the currently-relevant updated actor-sets differ from the previously-sent actor-sets, determining an updated actor-set that should be added, removed, or modified relative to the previously-sent actor-sets; and sending, to the other managed server, the updated actor-set and an instruction to add, remove, or modify the updated actor-set; and determining to quarantine the managed server comprising: determining that a network attack originated from the managed server or determining that the managed server has a vulnerability. modifying a description of the managed server to indicate that the managed server is quarantined, thereby specifying a description of the quarantined managed server; updating cached actor-sets to indicate the quarantined managed server's changed state, thereby specifying updated actor-sets, wherein an actor-set is a representation of descriptions of managed servers and unmanaged device groups; determining which updated actor-sets are relevant to an other managed server, thereby specifying currently-relevant updated actor-sets; determining whether the currently-relevant updated actor-sets differ from actor-sets previously sent to the other managed server; responsive to determining that the currently-relevant updated actor-sets do not differ from the previously-sent actor-sets, taking no further action; responsive to determining that the currently-relevant updated actor-sets differ from the previously-sent actor-sets, determining an updated actor-set that should be added, removed, or modified relative to the previously-sent actor-sets; and sending, to the other managed server, the updated actor-set and an instruction to add, remove, or modify the updated actor-set; and determining an updated actor-set that should be added, removed, or modified relative to the previously-sent actor-sets; and sending, to the other managed server, the updated actor-set and an instruction to add, remove, or modify the updated actor-set; and determining to quarantine the managed server comprising: determining that a network attack originated from the managed server or determining that the managed server has a vulnerability.