Adding, editing or removing these rights enables you to manage the auditing of data access success and failures.
To add, edit or remove SACL permissions
You can use the Location field to view your current location. If you have navigated too far, you can move back by clicking the Up One Level button ( ).
Click Finish.
Back on the Auditing tab, unsaved changes appear bold.
Through the Resource browser you can see how security has been applied on selected resources and implement changes as required. The Deviations view enables you to browse through a tree view and identify where subfolders and files of the identified resources have security that differs from the parent (for example, if inheritance is overridden or blocked).
|
Note: The Deviations view is not available for NFS managed hosts. |
From this view you can also quickly address access issues and edit security where required. This helps you meet your compliance and audit goals by ensuring only authorized users can access the specific resources.
To manage security deviations
In the Tasks view, select View Deviations.
A tree view displays all resources and all the sub-resources below the root that have explicit security applied to them. As you select resources in the tree, their security displays in the lower pane. To see the deviation warnings or errors encountered for the selected resource, click the Click here to see warnings and errors link.
Back on the Folder Permissions or File Permissions tab, unsaved changes appear bold.
You can now browse through the network to ensure that the proper access has been granted or removed.
|
NOTE: This functionality is not available for NFS managed hosts. |
The resource owner is an important security principle, as the owner can alter the permissions (both DACL and SACL) on any of their resources. This should not be confused with the business owner, which is not a security principle, but rather a concept where ownership is based on use and activity.
Data Governance Edition provides reports that suggest an appropriate resource owner for the data so that the IT department knows who to contact with questions regarding securing the associated resource. You can also access this information through the Resource browser. This information can help your organization clearly identify who owns resources within your organization to meet security and privacy compliance requirements.
For details, see Data owner vs. perceived owner report and Calculating perceived owner.
|
Note: If you see a message in the list of issues that the forest or domain could not be contacted, this could be because the trusted domain has not been synchronized with One Identity Manager. |
To change the owner for a resource
You can use the Location field to view your current location. If you have navigated too far, you can move back by clicking the Up One Level button ( ).
Use the Inheritance From Parent options to select whether you would like the permissions and auditing settings to be inherited from the selected object.
|
Note: This is for the NTFS resource owner only. It does not reference the One Identity Manager's concept of Business Owner. |
As with NTFS resources, SharePoint resources must be properly secured to ensure that users have the appropriate access. For information on the configuration necessary to ensure you can properly manage access, see, Working with security permissions.
Using Data Governance Edition, you can determine who has access to a SharePoint resource, what permissions make up the permission levels that have been assigned, and then manage that access, including the inheritance setting of a resource. If the right permission level does not exist, you can also use Data Governance Edition to create one.
When you change security settings using Data Governance Edition, you are using the One Identity Manager delegation model. This model bypasses native SharePoint to apply the permission changes but the security changes that result use the SharePoint security for enforcement.
SharePoint security can either be inherited or unique. If it is inherited, you cannot modify any security settings, as they are defined by a parent resource. A well-structured site can reduce the number of inheritance breakages required to effectively secure your SharePoint resources. When you need to change the setting at a particular point in the hierarchy, you create new unique permissions at that point. By default, all items below the uniquely-permissioned object inherit the settings of its parent.
When you break inheritance, all current permission levels and security settings are copied, and you can then modify them as needed. Although it is easy to change to unique permissions using Data Governance Edition, care should be taken when doing this, as it requires more administration to manage unique permissions.
To change the inheritance on a SharePoint resource
Open the Resource browser using one of the following methods:
Select the required SharePoint farm in the Managed hosts view and select Resource browser from the Tasks view or right-click menu.
The web applications for the selected farm display. From here you can browse the SharePoint hierarchy.
When a resource is selected, the security settings for the resource display in the Permissions pane (lower pane).
One of the following messages appear across the top of the tab indicating whether permissions are inherited or unique:
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy