Active Roles 7.2 - Administration Guide

Checking for policy compliance

Checking for policy compliance provides information on directory data that is out-of-compliance with the policies, such as user or group naming conventions, defined with Active Roles. If you define some policies when data has already been entered, you can check the data, and modify it accordingly, in order to ensure that the data meets the policy requirements.

Although with Active Roles business rules and policies normally cannot be bypassed once they have been configured, there are situations where the actual directory data may violate some of the prescribed policies or business rules. For example, when applying a new policy, Active Roles does not automatically verify the existing directory data in order to determine whether that data conforms to the new policy. Another example is a process that automatically creates new objects, such as user or group objects, by directly accessing Active Directory without the use of Active Roles.

The Active Roles Report Pack includes a number of reports that help detect policy violations in directory data by collecting and analyzing information on the state of directory objects as against the prescribed policies. However, as retrieving such information may take much time and effort, the reports on policy compliance sometimes do not allow policy-related issues to be resolved in a timely fashion.

In order to address this problem, Active Roles makes it possible to quickly build and examine policy check results on individual objects or entire containers. The policy check results provide a list of directory objects violating policies, and describe the detected violations. From the policy check results, you can make appropriate changes to objects or policies:

• Modify object properties in conformity with policies.
• Prevent individual objects from being affected by particular policies.
• Modify Policy Objects as needed.
• Perform an administrative task—for example, disable or move user objects that violate policies.

In addition, you can save policy check results to a file, print them out, or send them to an e-mail recipient.

To check an object for policy compliance, right-click the object and click Check Policy. For a container object, this displays the Check Policy dialog box. Review the options in the Check Policy dialog box and click OK.

The Policy Check Results window appears and the operation starts. The check results are displayed in the right pane of the window. The objects that violate a policy are displayed in the left pane. When you click an object in the left pane, the right pane describes the policy violation in detail.

By default, the right pane in the Policy Check Results window only displays basic options. You can display more choices by clicking the Details column heading.

By using links in the right pane, you can perform the following tasks:

• Modify the property value violating the policy: click the edit link next to the Property value label.
• Remove the object from the policy scope: click the block policy inheritance link next to the Policy Object label. If you do so, the policy no longer controls the object.
• Modify the policy: click the properties link next to the Policy Object label. This displays the Properties dialog box for the Policy Object, described in Adding, modifying, or removing policies earlier in this chapter.
• Administer the object violating the policy: click the Properties button in the upper-right corner of the right pane.
• Administer the object to which the Policy Object is applied: click the properties link next to the Applied to label.

You can use the following instructions to see how checking for policy compliance works in the Active Roles console:

1. Create and configure a Policy Object with the property validation and generation policy for the Department property of user objects, specifying the policy rule as follows: Value must be specified and must be Sales or Production.
2. Apply (link) that Policy Object to an organizational unit that already holds some user objects with no department specified.
3. Right-click the organizational unit and click Check Policy. In the Check Policy dialog box, click OK.

   Once you have performed these steps, the Policy Check Results window is displayed. Its left pane lists objects violating the policy.

4. Wait while the list in the left pane is being populated. Then, select a user object from the list.

   The right pane, next to the Violation label, displays the prompt “You must specify a value for the property ‘department’.”

5. In the right pane, click the edit link next to the Property value label.
6. In the Properties dialog box, select one of the acceptable values (Production or Sales) from the Department combo-box.

Steps to check for policy compliance

Checking for policy compliance provides information on directory data that is out-of-compliance with the policies, such as user or group naming conventions, defined with Active Roles. If you define some policies when data has already been entered, you can check the data, and modify it accordingly, in order to ensure that the data meets the policy requirements.

To check an object for policy compliance

1. Right-click the object, and click Check Policy.
2. If the object is a container or Managed Unit, select the appropriate combination of these check boxes to specify the scope of the operation, and then click OK:
   • This directory object  The scope includes the container or Managed Unit you have selected (this option does not cause the scope to include any child objects or members of the container or Managed Unit).
   • Child objects of this directory object  The scope includes all the child objects (or members, as applied to a Managed Unit) in the entire hierarchy under the container or Managed Unit you have selected.
   • Immediate child objects only  The scope includes only the child objects (or members, as applied to a Managed Unit) of which the container or Managed Unit that you have selected is the direct ancestor.

   The progress and results of the policy check operation are displayed in the Policy Check Results window. The left pane of the window lists the objects for which a policy violation has been detected.

3. Click an object in the left pane of the Policy Check Results window.

   When you click an object in the left pane, the right pane describes the policy violation in detail. By default, the right pane in the Policy Check Results window only displays basic options. You can display more choices by clicking the Details column heading.

4. Use hypertext links in the right pane to perform the following tasks:
   • Modify the property value violating the policy: Click the edit link next to the Property value label.
   • Remove the object from the policy scope: Click the block policy inheritance link next to the Policy Object label. If you do so, the policy no longer controls the object.
   • Modify the policy: Click the properties link next to the Policy Object label. This displays the Properties dialog box for the Policy Object. For instructions on how to add, modify, or remove policies in the Properties dialog box, see Adding, modifying, or removing policies earlier in this document.
   • View or modify the properties of the object that violates the policy: Click the Properties button in the upper-right corner of the right pane.
   • View or modify the properties of the object to which the Policy Object is applied (linked): Click the properties link next to the Applied to label.

Deprovisioning users or groups

The Active Roles user interfaces, both Active Roles console and Web Interface, provide the Deprovision command on user and group objects. This command originates a request to deprovision the selected objects. When processing the request, Active Roles performs all operations prescribed by the deprovisioning policies.

Default deprovisioning options

Active Roles ships with two built-in Policy Objects that specify the operations to perform when deprovisioning a user or group. You can find those Policy Objects in the Active Roles console by selecting the Configuration | Policies | Administration | Builtin container.

The Built-in Policy - User Default Deprovisioning Policy Object determines the default effect of the Deprovision command on user accounts; the Built-in Policy - Group Default Deprovisioning Policy Object determines the default effect of that command on groups. Both objects are applied to the Active Directory container, taking effect in all domains that are registered with Active Roles.

The following tables summarize the default deprovisioning policy options. If you do not add, remove or change deprovisioning policies, Active Roles operates in accordance with these options when carrying out the Deprovision command on a user or group.

The following table summarizes the default deprovisioning policy options for users, defined by the Built-in Policy - User Default Deprovisioning Policy Object.

The following table summarizes the default deprovisioning policy options for groups, defined by the Built-in Policy - Group Default Deprovisioning Policy Object.