i have a customer with loads of classic policy expressions / polcies that need converting to advanced. I have ran nspepi -f /nsconfig/ns.conf and had a look at the new_ns.conf (no warn_.ns.conf) and it has left the classic expressions for the session and authorization polices in the new_ns.conf. These are bound to AAA users/Groups/NS GW Vservers. I started to convert the policies one by one for example a session policy with nspepi -e "REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver && REQ.HTTP.HEADER Referer EXISTS" which then spits out the new advanced expression. I was hoping i could then unbind the corressponding classic session policy and then bind the new advanced session policy. This didnt work as it wont let you bind the new advanced session policy until all classic polices are unbound from all entities AAA users/groups/NS GW Vservers/Global ect. Because there is so many classic policies and they are bound to loads of entities (Multiple AAA groups) this would be a bit of a nightmare. Interested if anyone else have had to do this ? i am tempted to build them out new netscalers

I did that with CLI, unbind all classic policies from all vpn vservers / aaa groups with unbind commands and in the same second, bind the fresh advanced policies to the same destination. So there's almost no downtime.

I did this several times, just the way @Julian Jakob said: I write a script that unbinds all classic politics and binds the corresponding default ones. This script runs in way less than a second. You can run this script on the passive NetScaler and do a fail over if the time with no policies bound is a problem for you (I have seen this with WAF and security related responder/rewrite policies)