Chat now with support
Chat with Support

Identity Manager Data Governance Edition 8.2 - User Guide

One Identity Manager Data Governance Edition User Guide Data Governance node and views Administering Data Governance Edition Managing unstructured data access
Managing resource access Managing account access Working with security permissions Working with SharePoint security permissions Account access modeling Bringing data under governance
Classifying governed resources Managing governed resources using the web portal Data Governance Edition reports Troubleshooting EMC, NetApp Filer, and SharePoint configuration details PowerShell commands Governed data attestation policies Governed data company policies Governed data risk index functions

Modifying discretionary access control list (DACL) permissions for NTFS resources

As the administrator, ensure that users and groups have the access they require to perform their day to day tasks. Using Data Governance Edition, you can determine the existing data access, add users and groups to the resource ACL, edit any existing access, and remove access as required.

Note: You can only modify access that has been explicitly granted, but you can change inheritance from the Control tab when you select to Edit Security for a resource.

Note: If you see a message in the list of issues that the forest or domain could not be contacted, this could be because the trusted domain has not been synchronized with One Identity Manager.

To add, edit or remove access DACL permissions

  1. In the Navigation view, select Data Governance | Managed hosts.

  2. Open the Resource browser using one of the following methods:

    • Double-click the required managed host in the Managed hosts view.
    • Select the required managed host in the Managed hosts view and select Resource browser from the Tasks view or right-click menu.
  3. In the Resource browser, use the top pane to locate and select the resource. Double-click through the resources to locate the required resource.
  4. Select the required resource to display the security for the resource in the lower pane.

    You can use the Location field, at the top of the tab, to view your current location. If you have navigated too far, you can move back by clicking the Up One Level button.

  5. Select the Folder Permissions tab or File Permissions tab.
  6. To give a user or group access to the selected resource, click in the lower pane and select Add rights in the Tasks view.
    1. Select the account to add and click Next.
    2. Select where to apply the permissions.
    3. Select the permissions to add.
    4. If applicable, select to limit the permissions to only objects and containers within the selected container.
    5. Click Finish.

    Back on the Folder Permissions or File Permissions tab, unsaved changes appear bold.

  7. To remove access, right-click the required account and select Remove selected permissions. Click OK on the confirmation dialog to confirm the remove operation.
  8. To alter the access, select the required user or group, and click in the Rights column.
    1. Alter the permissions as required.
    2. Click the Applies To column to select how you want the permissions applied.
  9. Click the Save toolbar button located above the Folder Permissions or File Permissions tab to save your selections. Click Yes on the confirmation dialog.

    You can now browse through the network to ensure that the proper access has been granted or removed.

To configure DACL inheritance settings

  1. In the Resource browser, select the Control tab.

  2. Select whether you want the settings to be inherited. The Inheritance from Parent options available include:

    • Allow inheritable permissions from the parent to propagate to this object and all child object.

    • Allow inheritable audit settings from the parent to propagate to this object and all child objects.

    Note: Clearing either of these check boxes cause inheritance to be blocked. Select the appropriate option on the Block Access Inheritance dialog before clicking OK to confirm this change:

    • Copy all permissions inherited from parent and make explicit (default)
    • Remove all permissions inherited from parent
  3. Click the Save toolbar button to save your selection.

Modifying auditing system access control list (SACL) permissions for NTFS resources

Adding, editing or removing these rights enables you to manage the auditing of data access success and failures.

To add, edit or remove SACL permissions

  1. In the Navigation view, select Data Governance | Managed hosts.
  2. Open the Resource browser using one of the following methods:
    • Double-click the required managed host in the Managed hosts view.
    • Select the required managed host in the Managed hosts view and select Resource browser from the Tasks view or right-click menu.
  3. In the Resource browser, use the top pane to locate and select the resource. Double-click through the resources to locate the required resource.
  4. Select the required resource to display the security for the resource in the lower pane.

    You can use the Location field to view your current location. If you have navigated too far, you can move back by clicking the Up One Level button.

  5. Select the Auditing tab.
  6. To add a SACL right to a user or group, click in the lower pane and select Add rights in the Tasks view.
    1. Select the account to add and click Next.
    2. Select where to apply the rights.
    3. Select the rights to monitor.
    4. If applicable, select to limit the auditing to only objects and containers within the selected container.

    5. Click Finish.

    Back on the Auditing tab, unsaved changes appear bold.

  7. To remove a SACL right, right-click the user or group, and select Remove selected permissions. Click OK on the confirmation dialog to confirm the remove operation.
  8. To edit the rights, select the required user or group, and click in the Rights column.
    1. Alter the permissions as required.
    2. Click the Applies to column to select how you want the permissions applied.
  9. Click the Save toolbar button to save your selections.

Managing security deviations

Through the Resource browser you can see how security has been applied on selected resources and implement changes as required. The Deviations view enables you to browse through a tree view and identify where subfolders and files of the identified resources have security that differs from the parent (for example, if inheritance is overridden or blocked).

Note: The Deviations view is not available for NFS managed hosts.

From this view you can also quickly address access issues and edit security where required. This helps you meet your compliance and audit goals by ensuring only authorized users can access the specific resources.

To manage security deviations

  1. In the Navigation view, select Data Governance | Managed hosts.
  2. Open the Resource browser using one of the following methods:
    • Double-click the required managed host in the Managed hosts view.
    • Select the required managed host in the Managed hosts view and select Resource browser from the Tasks view or right-click menu.
  3. In the Resource browser, double-click through the resources to locate and select the required resource.

  4. In the Tasks view, select View Deviations.

    A tree view displays all resources and all the sub-resources below the root that have explicit security applied to them. As you select resources in the tree, their security displays in the lower pane. To see the deviation warnings or errors encountered for the selected resource, click the Click here to see warnings and errors link.

  5. Select the Folder Permissions tab or File Permissions tab.
  6. To give a user or group access to the selected resource, click in the lower pane and click Add rights in the Tasks view.
    1. Select the account to add and click Next.
    2. Select where to apply the permissions.
    3. Select the permissions to add.
    4. If applicable, select to limit the permissions to only objects and containers within the selected container.
    5. Click Finish.

    Back on the Folder Permissions or File Permissions tab, unsaved changes appear bold.

  7. To remove access, right-click the required account and select Remove all explicit permissions. Click OK to confirm the remove operation.
  8. To alter the access, select the required user or group, and click in the Rights column.
    1. Alter the permissions as required.
    2. Click the Applies To column to select how you want the permissions applied.
  9. Click the Save toolbar button to save your selections.

    You can now browse through the network to ensure that the proper access has been granted or removed.

Assigning an owner to a resource

NOTE: This functionality is not available for NFS managed hosts.

The resource owner is an important security principle, as the owner can alter the permissions (both DACL and SACL) on any of their resources. This should not be confused with the business owner, which is not a security principle, but rather a concept where ownership is based on use and activity.

Data Governance Edition provides reports that suggest an appropriate resource owner for the data so that the IT department knows who to contact with questions regarding securing the associated resource. You can also access this information through the Resource browser. This information can help your organization clearly identify who owns resources within your organization to meet security and privacy compliance requirements.

For details, see Data owner vs. perceived owner report and Calculating perceived owner.

Note: If you see a message in the list of issues that the forest or domain could not be contacted, this could be because the trusted domain has not been synchronized with One Identity Manager.

To change the owner for a resource

  1. In the Navigation view, select Data Governance | Managed hosts.
  2. Open the Resource browser using one of the following methods:
    • Double-click the required managed host in the Managed hosts view.
    • Select the required managed host in the Managed hosts view and select Resource browser from the Tasks view or right-click menu.
  3. In the Resource browser, double-click the folder or container to locate the required resource.
  4. Select the required resource to display the security for the resource in the lower pane. The security for the resource displays in the lower pane.

    You can use the Location field to view your current location. If you have navigated too far, you can move back by clicking the Up One Level button.

  5. Select the Control tab.
  6. The Current Owner of this item field displays the resource's current owner. Click Change Owner to select a new owner for the resource.

  7. Use the Inheritance From Parent options to select whether you would like the permissions and auditing settings to be inherited from the selected object.

    • Allow inheritance permissions from the parent to propagate to this object and all child objects.
    • Allow inheritable audit settings from the parent to propagate to this object and all child objects.
  8. Click the Save toolbar button to save your selections.

Note: This is for the NTFS resource owner only. It does not reference the One Identity Manager's concept of Business Owner.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating