Identity Manager Data Governance Edition 9.1.1

A managed host is any network object that can host resources and can be assigned an agent to monitor security and resource activity. Currently supported hosts include Windows computers, Windows clusters, NetApp storage devices, EMC storage devices, DFS, and SharePoint farms.

You can also add generic managed hosts (Server Message Block (SMB) shares running on any Active Directory joined computer) to remotely scan their resources.

The following commands are available to you to deploy managed hosts. For full parameter details and examples, see the command help, using the Get-Help command or the One Identity Manager Data Governance Edition Technical Insight Guide.

Table 81: Managed host deployment commands
Use this command	If you want to
Add-QDfsManagedHost	Register a domain-based distributed file system root. This enables you to view and manage the access on resources that are physically distributed throughout your network.
Add-QManagedHostByAccountName	Add a managed host to your deployment and configure its settings. NOTE: This cmdlet does not support adding Cloud managed hosts.
Clear-QResourceActivity	Clear the resource activity for a given managed host. This enables you to remove activity data from the database on demand when it is no longer required. For scheduled activity cleanup, use the activity compression/deletion settings in the Data Governance server configuration file instead. NOTE: Once you clear the activity, it cannot be recovered.
Get-QHostsforTrustee	View a selected user or group’s access on all managed hosts in your environment.
Get-QManagedHosts	View a list of all the managed hosts in your deployment. NOTE: If you are interested in only one managed host, you can specify the host's name or the ID (GUID format) of the managed host. You can also specify all the managed hosts in a particular container.
Remove-QManagedHost	Remove a managed host from your deployment.
Set-QManagedHostProperties	Change the properties of a managed host. NOTE: You must know the managed host ID
Set-QManagedHostUpdated	Inform the Data Governance server that the managed host state should be updated.
Trigger-QDfsSync	By default the Data Governance server synchronizes the DFS structure into the One Identity Manager database every 24 hours. Use this cmdlet to force a DFS synchronization of a DFS managed host, making the DFS path immediately available within the Resource browser. NOTE: You must specify the ID (GUID format) of the managed host to be synchronized. To synchronize all of the DFS managed hosts in your deployment, set the ManagedHostID to All.

Account access management

PowerShell commands > Account access management

As people join, depart, and move through your organization, you need to change their data access. With Data Governance Edition, you can validate that users and groups have been granted access to all the resources they need, ensure that they do not have access to excess resources, and manage their access when problems arise.

The following commands are available to you to manage account access. For full parameter details and examples, see the command help, using the Get-Help command or the One Identity Manager Data Governance Edition Technical Insight Guide.

Table 82: Account access management commands
Use this command	If you want to
Get-QAccountAccess	View where users and groups have access on a managed host. NOTE: This PowerShell cmdlet does not support Cloud managed hosts.
Get-QAccountAccessOnHosts	View the resource access for a given account (Domain\SAMAccountName) across all available hosts. NOTE: This PowerShell cmdlet does not support Cloud managed hosts.
Get-QAccountActivity	View the activity associated with a user on a managed host. NOTE: This PowerShell cmdlet does not support Cloud managed hosts.
Get-QAccountAliases	View the group membership for a specified account. For example, if one of these groups (aliases) has access to a resource, the original account also has this access.
Get-QAccountsForHost	View all account access for a specific managed host.
Get-QADAccount	View the Active Directory objects from the One Identity Manager and QAM (Data Governance Edition) tables: ADSAccount, ADSGroup, ADSOtherSID, QAMLocalUser and QAMLocalGroup.
Get-QGroupMembers	View all the members of a group, including members of child groups. Because user and group access may be the result of several layers of nested groups, this helps you to assess how a specific account has gained access to a resource.
Get-QIndexedTrustees	View all of the entries from the QAMTrustee table who are also listed within the QAMSecurityIndex table, denoting an indexed trustee.

Resource access management

PowerShell commands > Resource access management

A key challenge in improving data governance is keeping track of permissions within your environment. To ensure that data is secured in a manner that meets your business needs, you must be able to easily identify who has been given access and manage that access appropriately.

The following commands are available to you to manage resource access. For full parameter details and examples, see the command help, using the Get-Help command or the One Identity Manager Data Governance Edition Technical Insight Guide.

Table 83: Resource access management commands
Use this command	If you want to
Export-QResourceAccess	Export the security information on a selected resource.
Get-QChildResources	View the resources contained in a specific root on a managed host. You can use this to enumerate the contents of remote folders and shares. In particular, it would be similar to the standard Windows PowerShell Get-ChildItems cmdlet but it functions using the Data Governance server as a proxy, so the client machine does not necessarily need direct access to the target machine. NOTE: This PowerShell cmdlet does not support Cloud managed hosts.
Get-QFileSystemSearchResults	Search an NTFS folder or share for files. Using this command, you can search multiple data roots at once.
Get-QHostResourceActivities	Retrieve a list of the operations, including the resource ID assigned to each operation, performed against a managed host during a given time frame. NOTE: This PowerShell cmdlet does not support Cloud managed hosts.
Get-QPerceivedOwners	Calculate the perceived owners for a resource. This information can help to determine the true business owners and custodian for data. NOTE: The perceived owner for data is calculated from the resource activity history or security information collected by Data Governance Edition. Activity is collected based on the aggregation time span settings and recorded in the Data Governance Resource Activity database.
Get-QResourceAccess	Retrieve the security information of selected resources from a specific managed host, and child objects whose security differs from the parent.
Get-QResourceActivity	Retrieve the activity associated with a resource. NOTE: Resource activity collection (and therefore this cmdlet) is not supported for the following host types: Windows Cluster/Remote Windows Computer Generic Host Type EMC Isilon NFS Device SharePoint Online OneDrive for Business
Get-QResourceSecurity	View the security on a given resource in the SSDL format.
Set-QResourceSecurity	Set security on a given resource. NOTE: The existing security descriptor is completely replaced.

Governed data management

PowerShell commands > Governed data management

Governing unstructured data allows you to manage data access, preserve data integrity, and provide content owners with the tools and workflows to manage their own data.

The following commands are available to you to manage governed data. For full parameter details and examples, see the command help, using the Get-Help command or the One Identity Manager Data Governance Edition Technical Insight Guide.

Table 84: Governed data management commands
Use this command	If you want to
Get-QDataUnderGovernance	View the data within your organization that has been placed under governance. Data is considered “governed” when it has been explicitly placed under governance or published to the IT Shop.
Get-QPerceivedOwnerPoI	View the name of the perceived owner for the specified governed resource. You can use the calculated perceived owners to identify potential business owners for data within your environment.
Get-QSelfServiceClientConfiguration	View the options that are available for self-service requests within the IT Shop.
Get-QSelfServiceMethodsToSatisfyRequest	View the group membership that is required to satisfy an access request. When employees request access to a resource, an approval workflow is put into action. Before the request for resource access can be granted, the business owner must select a group to which that employee could be added to fulfill their request. NOTE: This PowerShell cmdlet does not support NFS or Cloud resources (since these types of resources cannot be published to the IT Shop).
Remove-QDataUnderGovernance	Remove data from governance. NOTE: Removing a resource from governance, also removes it from the IT Shop.
Set-QBusinessOwner	Set the business owner on a governed resource to establish a custodian for data. The business owner should be an employee who understands the nature of the data and the list of authorized users. Ownership can be established for an individual employee or for all employees in an application role.
Set-QDataUnderGovernance	Place a resource under governance. Once data is “governed”, the Data Governance server periodically queries the agent responsible for scanning that data and retrieves detailed security information concerning it and any child data. The data is then placed in the central database to be used by policies and attestations. You can also use this command to set the business owner on governed resources to establish a custodian for data. The business owner should be an employee who understands the nature of the data and the list of authorized users. Ownership can be established for an individual employee or for all employees in an application role.
Set-QSelfServiceClientConfiguration	Set the options that are available for self-service requests within the IT Shop.
Trigger-QDataUnderGovernanceCollection	Trigger data collection for governed resources for a given managed host.
Upgrade-QDataUnderGovernanceRecords	Upgrade the format of existing governed data in the database after an upgrade from version 6.1.1 or earlier. NOTE: This is a requirement for upgrading to version 6.1.2 or 6.1.3.

Seleziona il prodotto:

Per una maggiore efficacia, compilare l'Obiettivo della chat:

Soluzioni consigliate per il problema

Identity Manager Data Governance Edition 9.1.1 - User Guide

Managed host deployment

Account access management

Resource access management

Governed data management