Chat now with support
Chat with Support

Identity Manager Data Governance Edition 8.0 - User Guide

Introduction Data Governance navigation node and views Administering Data Governance Edition Managing unstructured data access
Managing resource access Managing account access Working with security permissions Working with SharePoint security permissions Account access modeling Bringing data under governance
Classifying governed resources Managing governed resources using the web portal Data Governance Edition reports Troubleshooting Appendix: EMC, NetApp Filer, and SharePoint configuration details Appendix: PowerShell commands Appendix: Governed data attestation policies Appendix: Governed data company policies Appendix: Governed data risk index functions About us

Simulating the effects of group membership modifications on an account

Simulating changes to group membership enables you to see the access that would be gained or removed if a user or group had a change to their existing group membership.

Note: Account membership simulation is not supported for machine local trustees, well-known group accounts or built-in group accounts.

Once you have reviewed the results of the simulation, and before making any changes to the group membership, investigate the group membership on all managed hosts for the selected user or group. For details, see Viewing group membership and Managing account access.

To simulate changes to group membership

  1. Navigate to and select an account (through the Security Index node, Accounts view, Security editor, etc.)

  2. Select Account simulation in the Tasks view or right-click menu.

  3. The Account field displays the selected account. Click the browse button ( ) to locate and select a different account.
  4. Select the type of modification to be simulated:

    • Remove from Group(s)
    • Add to Group(s)
  5. The Resource Types field defines the types of resources and the managed hosts to be included in the simulation. By default, all resource types and all managed hosts are included.

    Click the Change button to limit your simulation to selected resource types or managed hosts. Clicking the Change button displays additional fields allowing you to make your selections:

    • Type: Click the arrow control to select one or more types from a list of available resource types. To exclude a resource type, click the selected check box to clear it.
    • Host: Click the arrow control to select one or more managed hosts from a list of available managed hosts. To exclude a managed host, click the selected check box to clear it.

    Note: Running an account simulation for all hosts and resource types could take a significant amount of time to process. It is recommended that you select the hosts and resource types you are interested in to speed up the simulation process.

  6. Click the Select Groups button to select the groups to be used in the simulation.
  7. On the Remove Groups/Add Groups dialog, click the Browse Groups button to launch the Select Objects dialog. Locate and select the groups to be included in the simulation and click OK.

    The selected group(s) appear on the Remove Groups/Add Groups dialog.

    Click the Simulate button.

  8. The results of the simulation appears, showing:
    • For an "Add to group(s)" simulation, the resources the selected account will have access to if added to the specified groups.
    • For a "Remove from group(s)" simulation, the resources the selected account would no longer have access to if removed from the specified groups.

    See Account simulation results for a more detailed description of the simulation results.

  9. Optionally, click the Export to CSV button to export the results to a file. The Save As dialog appears allowing you to select the location where the report is to be saved and to specify a file name.

    Note: The exported CSV file contains more information about the account simulation. For example, it contains the managed host ID which can be used to run scripts/commands against a particular managed host.

NOTE: You can use the Layout controls to select a predefined layout for displaying data. If you do not see the Layout field or buttons, use the Toggle layout options task to display these controls.

For more information, see Toggle layout options.

Account simulation results

The account simulation feature allows you to simulate changes to group membership before making any changes to the group membership.

  • For a "Add to Group(s)" simulation, you can see the resources the selected account will have access to if added to the specified groups.
  • For a "Remove from Group(s)" simulation, you can see the resources the selected account would no longer have access to if removed from the specified groups.

The results generated by an account simulation contain the following details:

Table 62: Account simulation results
Column Description
Simulation Type

The type of simulation performed:

  • Right Granted
  • Right Revoked
Resource Name The name of the resource, to which the account would be granted access or revoked access.
Resource Type The type of resource.
Right

The access rights that would be granted or revoked.

  • For a "Add to group(s)" simulation, the right to be granted is prefaced with a plus sign symbol.
  • For a "Remove from group(s)" simulation, the right to be revoked is prefaced with a minus sign symbol.
Via Group

The name of the group through which access would be granted or revoked.

Governed Resource

Indicates whether the resource is governed.

  • True: Resource is governed.
  • Blank: Resource is not governed.

Add groups dialog

Use the Add groups dialog to select the groups to be included in an add simulation. This dialog appears when you click the Select Groups button at the top of the Account Simulation view when performing an add to groups simulation.

This dialog contains the following controls:

Table 63: Select groups dialogs: Controls
Control Description
Groups list Once groups have been selected, this list displays the groups to be included in the simulation.
Browse Groups Click the Browse Groups button to launch the Select Objects dialog to locate and select the groups to be included in the simulation.
Simulate After selecting the groups to be used in the simulation, click the Simulate button to initiate the simulation process.
Cancel Use the Cancel button to close the dialog without saving your selections or launching a simulation.

Remove groups dialog

Use the Remove groups dialog to select the groups to be included in a remove simulation. This dialog appears when you click the Select Groups button at the top of the Account Simulation view when performing a remove from groups simulation.

This dialog contains the following controls:

Table 64: Select groups dialogs: Controls
Control Description
Groups list Once groups have been selected, this list displays the groups to be included in the simulation.
Browse Groups Click the Browse Groups button to launch the Select Objects dialog to locate and select the groups to be included in the simulation.
Simulate After selecting the groups to be used in the simulation, click the Simulate button to initiate the simulation process.
Cancel Use the Cancel button to close the dialog without saving your selections or launching a simulation.
Related Documents