Mastering Windows Server® 2012 R2

I am sure that as you make your way through this book, you have begun to realize the vast number of features that have been included in Windows Server 2012. Now we come to probably the single most important new feature, Dynamic Access Control. This is a groundbreaking new feature that will shake up file server administrators forever!

Let’s start with a short example. When you join a company and you get a user account for the computer, you can be almost sure you are part of a default group called Domain Users. Now as you require access to different resources, you submit the relevant forms to the resource owners and are granted access, which usually means you are placed in the security group that has already been granted access to these resources. (For example, if you want access to financial data, the Finance share gives anyone who is part of the Finance group read-write access to the financial data.) As you want access to more and more resources, you get added to more and more groups. As new resources come online, new groups are created to manage access to them.

Think about how many file servers are deployed around the world today and how many groups are created to control access to these shares, and then add the amount of administrative effort to not only create them but maintain everything afterward. This is the reality of file server administrators today.

Now let us introduce Dynamic Access Control (DAC). This truly is the next generation in securing information that needs to be secure and controlling access to resources to which only authorized people should have access.

Imagine that a not-so-tech-savvy financial director of a large corporation decides to record all the directors’ salaries in an Excel spreadsheet and doesn’t password-protect it or put it in a secured folder. A disgruntled employee gets hold of this document and publishes it to the world. How embarrassing would that be not only to the company but also to the financial director!

Now imagine a world where the financial director does the same silly thing but the data is automatically secured because it contains keywords that trigger a process to classify the data as sensitive and allow access only to certain groups. Wouldn’t that be simply amazing! This is one of the groundbreaking features within DAC. Hopefully, now you get a picture of what we are about to dive into and master!

The key thing to remember is that DAC is not a single piece of technology. It is a file-server solution. It brings together conditional expressions (for example, is this user part of a group, or does the computer a file is accessed from need to be domain joined?), file classification (such as high business importance, classified, and the like), and Central Access Policies (centrally manage all the authorization policies), and with the use of Kerberos it validates “claims” from users. In turn, these technologies come together to form DAC and allow you to create a centrally controlled governance policy across your file servers.

A New Way to Secure File Shares

As you can see, no major changes have happened there. The real power in securing file shares is through the security properties, as displayed in Figure 15.2.

This Security tab dictates the NTFS permissions to not only the folder but the files as well. But as you can see from this tab, it doesn’t look much different than in previous versions of Windows.

Since this is most definitely an advanced feature, it is rightly placed under the Advanced button located at the bottom of the Security tab; see Figure 15.2.

Figure 15.3 shows the Advanced Security settings for a file share, and it is where we can begin to configure the basics of DAC.

In this example we have a single folder called share. It is shared to everyone for read-only access via its share permissions and read-only via its NTFS permissions, and we also allow our administrators Full Control. As you can see from Figure 15.3, however, the Everyone principal has Read & execute access. Now you can start to see the granular control the Advanced Security settings offer, but this is still not DAC.

Click Add from the Advanced Security Settings screen, and you will be brought to the “Permission Entry for share” screen, as shown in Figure 15.4.

In order to progress, you must select a principal. A principal would be, for example, a user account or a group to which you want to assign privileges. If you don’t select a principal at this stage, all the elements will stay grayed out.

As you can see, quite a few options look familiar from previous versions of Windows. However, now there is a new section where you can add a condition. This is where the power of DAC begins: with conditional expressions.

When you click “Add a condition,” you will get the chance to create a condition, as shown in Figure 15.5.

The first condition to choose from is a device or a user. Now you can secure data not only down to the user account but also from the device from which they access the resource. You can ensure that they have to access the resources from a corporate device but not their home laptop. That way, you can ensure the security of the data because you control the corporate laptop/desktop.

In the example in Figure 15.6, we have allowed John McCabe (johm@contoso.ie) Read & Execute, List Folder Contents, and Read permissions, but we have now added a condition that in order to access the share he needs to be on a computer that is part of the Domain Computers group.

Now, returning to the “Advanced Security Settings for share” screen, you can see the new principal added but the Condition column for John McCabe is now populated, as shown in Figure 15.7.

If we re-edit the principal John McCabe (johm@contoso.ie), we can add additional conditions and apply Boolean logic to the conditions using “And” or “Or.” “And” ensures that all conditions are true. For example, we could set a device condition to be part of the Domain Computers group and a user condition to be part of the IT group. If both conditions are not met, access is not granted. In the “Or” case, if either condition is true, then access will be granted. See Figure 15.8 for a sample “And” condition.

Access Control Using Groups and User AD Attributes

As you saw in the previous section we could select a principal (and remember, a principal could be a user or a group) and assign a condition, and then based on the condition, access will be granted or denied. This leads back to an age-old problem of administration of groups.

Think about it. In an enterprise or even a small business, how often do groups in Active Directory get cleared out, and how often are privileges for the existing user base assessed to ensure they are still valid? Should someone really be part of the IT Admins group now that they are a truck driver? What if now you could, for example, change the Department field in the user account in Active Directory, and it would then change the access permissions?

Active Directory stores lots of information with different tags to identify the data, called attributes. For example, when you create a user account, the most basic information you enter would be the first name and last name of the person. This information is stored in an attribute in Active Directory. These attributes can be reviewed and edited (but do be careful because it is not pretty if you mess up). Figure 15.9 shows a sample of some attributes; in this case we are viewing the given name (first name) for the user David McCormick.

A very useful attribute you can use to help secure information is the Department attribute. As you see in Figure 15.9, our user David is part of the IT group. We know IT contains lots of sensitive information, and we certainly don’t want usernames and passwords or sensitive network information falling into the wrong hands.

If you review all the attributes available for a user, you will see it’s a very long list. In reality only a few fields may prove useful in controlling access to the data. Some examples of this would be EmployeeType (you may not want part-time staff to access certain types of data), Company (you don’t want a child company accessing data from Contoso), and PhysicalDeliveryOfficeName (you might not want employees in London accessing data in the New York office).

Don’t be limited by the options I mentioned; you can come up with your own options. If the attribute you want doesn’t exist, you can create it and use it. This is obviously not for the faint hearted, but it illustrates just how flexible DAC can be.

In Figure 15.5 we had only the User and Device options. Now we have a new option called Resource; see Figure 15.10.

The Resource option gives you the claim types (essentially the attributes you publish to present as authorization claims to access resources) you have published. In our example, once we select Resource, the Department option is displayed. Don’t worry for now how it got there; we will show you how later in the chapter.

The same logic conditions of Equals or Not Equals exist, but now the last options field automatically provisions a list of common departments to select from. See Figure 15.11.

This list is not pulled from a summary list of all users in your Active Directory. It is a default list provided by DAC when you publish an attribute as a claim type; you can modify it if needed.

Don’t jump ahead! In order for DAC to work, you need to build up the solution, and it is important that you understand the concepts before configuring the solution.

Securing Data by Machine Attributes

In recent years many companies have had to address the bring-your-own-device (BYOD) craze. It has become common for staff to use their own money to purchase the latest devices that suit their personal needs but will also allow them to access data on the corporate network. These include tablets and laptops and on rare occasions home desktop computers. From an IT administrator’s perspective, this can be frustrating when you are asked to tightly control access to information. You can see the problem: because the enterprise doesn’t own the asset, there is only so much they can do to control the security of the device. The big issue is how these devices can operate in an environment but be restricted to information that is not sensitive.

Take a few seconds to review Figure 15.5 again; you will see that we have a Device option. This option allows us by default to decide whether a computer is part of a group and whether to allow access to a resource. Imagine you create four groups: one group for desktop machines, the second group for laptops, the third group for Finance, and the fourth group for Engineering. Now you could create rules requiring that only the desktop computers and laptop computers that are also part of the Finance group can access all information contained within the Finance share. That way you can encrypt the Finance machines (desktop or laptop) so that if a user does copy data off the central share, the information is protected. It’s a simple example, but straight away you can see how much more control you can implement to protect your company’s information.

Centrally Control Permissions Using Templates

You now have a powerful tool to control access to resources, but if you had to manually implement this, it would obviously take a huge amount of time. Like most things in IT now, centralized is best! Could you imagine taking the power of DAC but having to implement it for every file server in your environment?

Windows Server 2012 has a management utility called Active Directory Administrative Center (ADAC). This utility can be found in Server Manager under Tools.

Once the ADAC is launched in the navigation section on the left side, you will see Dynamic Access Control listed. When you click Dynamic Access Control, it brings you to the core area, where you will centrally configure the DAC rules for your environment. Take a look at Figure 15.12, which shows the Active Directory Administrative Center.

We’ll take a minute to explain each of the items you see listed under the main Dynamic Access Control window. These will become important as we progress:

Later in this chapter we will show you examples of creating all these particular elements and bringing them all together.

Using Effective Permissions to Troubleshoot Access Control

Let’s say your company has applied a Central Access Policy to a test share on your file server. This share has several subfolders containing simple folder names based on three departments: Sales, Accounts, and Engineering. The administrator has already configured the policies to authorize access to the each individual folder only by the department.

The administrator wants to ensure that policies are working correctly. With the use of effective permissions you can achieve this, and you can also test individual user accounts without having to obtain their credentials and test their access.

Don’t worry if you don’t fully understand this right now. Later in this chapter we’ll show you how to use effective permissions, and we’ll include the appropriate screenshots.

Automatic File Classification

By now you’re aware of the considerable power Dynamic Access Control can bring. Think about all the information contained within the files that are hosted on the network shares within your company and then try to imagine how you are going to protect every one of them.

Traditionally, protecting data was a manual process, and what was worse, you had to ensure that the IT administrators and users understood how to manage their documents correctly.

Imagine if someone put the payroll Excel spreadsheet in the wrong place, which didn’t have the traditional permissions to protect it! Imagine if your company had intellectual property and it was not secured correctly! Finally imagine the stress of managing and trying to guarantee the security of the data.

In modern IT infrastructures, centralized management—where as many tasks as possible are automated—should be the minimum base for an organization. Applying this simple principle to the classification of data is extremely important.

Using the resource properties mentioned early in this chapter, you can do this! These resource properties allow you to manually set classifications, but when you combine these with the File Server Resource Manager (FSRM) in Windows Server 2012, you can automatically classify the documents. If an end user does misplace a document in a file share, you are confident that no sensitive information can be accessed by unauthorized parties. Later in this chapter we will give you a demonstration on how to complete this.

DAC Players: User, Device, Resources, and Claims

You now know the key players, and as you progress enabling DAC and configuring it for your environment, you will begin to put this information into context.

Enabling DAC

1. On your domain controller, open the Group Policy Management console located in Administrative Tools, or if you love the Search feature within Windows 2012, from the Start menu just start typing Group Policy and you will see the tool.

2. Click Group Policy to open it.

3. Under the Group Policy Management tree on the left side, expand Forest

Domains

yourdomain.com

Domain Controllers and locate the Default Domain Controllers Policy, as shown in Figure 15.14.

Figure 15.14 Group Policy Management Tool showing the Default Domain Controllers Policy

4. Right-click it and select Edit. This will open a new screen called the Group Policy Management Editor; see Figure 15.15.

Figure 15.15 Group Policy Management Editor

5. In the tree structure on the left, navigate to Computer Configuration

Policies

Administrative Templates

System, as shown in Figure 15.16.

Figure 15.16 Location of policy to edit to enable KDC support

You want to edit the policy in the right side of the screen called “KDC support for claims, compound authentication and Kerberos armoring.” Double-click the policy, and the policy editor will pop up and give you options to configure. See Figure 15.17.

Figure 15.17 Configuring “KDC support for claims, compound authentication and Kerberos armoring”

6. Select Enable (notice how the drop-down box gets populated with Supported) and click OK.

There are other options available in the drop-down box, and the Help window just to the right will give you further information about the options available.

7. Take some time to read through the Help screen, but to simply enable Supported just leave it in the drop-down box and click OK.

8. Close the Group Policy Management tool.

9. Open an elevated command prompt and type gpupdate/force to propagate the group policy you just configured, or you could just wait for standard replication and Group Policy refresh.

Earlier in this chapter we showed you the Active Directory Administrative Center. This is where you will configure Dynamic Access Control.

Pieces of an Access Policy

You have learned that in order for DAC to work you have several prerequisites to configure: the claim types, the resources, and the central access rules. We also mentioned that we want to minimize the management overhead. This is where Central Access Policies come into play. They bring all of our configuration work together to easily administer and control access to the information within our environments. In the following pages we will show you how to secure your file servers using DAC centrally and how this can be applied across your organization. The best way to really get to grips with this new technology is to dive right in. Let’s build a simple access policy.

Creating a Dynamic Access Policy

Open the Active Directory Administrative Center and click Dynamic Access Control, as shown in Figure 15.18.

At this point, if you try to create a Central Access Policy, you will not be able to. As we mentioned, you have to create resources, claim types, and central access rules to create a policy.

One thing to notice is the various options in the center window. When you click through them, the Tasks menu on the right changes to suit the option you have selected. First, you will create a new claim type:

1. In the center window click Claim Types, and notice how the Tasks menu changes to suit.

2. On the Tasks menu, under Claim Types select New

Claim Type, as shown in Figure 15.19.

Figure 15.19 Creating a new claim type

A new window will open for creating the new claim type.

3. Take some time to look at the options; you will see all the attributes that you can potentially select from to create a claim type. The different attributes are for both user and device claims.

For example, browse to the attribute dNSHostName, and you will notice that it belongs to Computer, as shown in Figure 15.20.

Figure 15.20 Displaying the dNSHostName property

4. In the Source Attribute list, select Department.

5. Modify the “Display name” field on the right to department_Contoso; see Figure 15.21.

Figure 15.21 Modifying the department attribute to create a claim type

6. Scroll down to Suggested Values; this is where you will put in the information relevant to Contoso; for example, Microsoft has already configured the Department claim type but has not listed any departments.

We are creating a Department claim for Contoso, which has four departments: Sales, IT, Accounts, and HR. You will use these later on to control access to the demo shares. For example, Sales will be allowed access only to Sales data, HR will be allowed access only to HR data, and so on.

7. Under “When a user assigns a value to this claim type,” select “The following values are suggested,” as shown in Figure 15.22.

Figure 15.22 Assigning values to claim types

8. Click the Add button; this will bring up the “Add a suggested value” window.

9. Enter Sales in both the Value and “Display name” fields, as shown in Figure 15.23, and click OK.

Figure 15.23 Adding a suggested value

10. Repeat these steps for IT, Accounts, and HR, and click OK when finished.

Your first claim type is finished. Well done.

1. Choose Resource Property, and as before select New from the Tasks menu.

You will see two options listed: the resource property and the reference resource property.

2. Since we’ve already created a claim type, we’re going to use a reference resource property. Select Resource Property if you do not have a claim type already created.

In Figure 15.24 you can see the claim type we created earlier. The “Display name” field is also populated, and you will have a choice under “Value type” between Single-valued Choice and Multi-valued Choice.

Figure 15.24 Create Reference Resource Property screen

Figure 15.25 Creating a new resource property

3. Choose Single-valued Choice in this case because in most companies “officially” you are supposed to work for only one department.

Because this ultimately will be used in Central Access Rules and Policies, you’ll want to use this field for authorization, so make sure it is checked.

4. Click OK when finished.

Side Task

For reference purposes, this task is the procedure for creating a resource property for which a claim type doesn’t exist, for example, if you don’t want to use the resource properties that Microsoft has provided or if they simply don’t meet your needs. Another example would be if you created a custom attribute in Active Directory and wanted to use it as a claim type.

When you’ve completed the previous exercise, the New Resource Property window will open. Then follow these steps:

1. On the Dynamic Access Control screen, under Active Directory Administrative Center, Select Resource Properties, and in the Tasks list select New

Resource Property.

2. In the Display name field enter department_contoso_test, and in the Value type field choose Single-valued Choice. You have different choices for value type and this is where your planning will come into play. Most companies allow an employee to be part of only one department at any one time, so in this case a single-valued choice is the most appropriate. See Figure 15.24.

3. Take time to browse the options in the Value type field; notice you have quite a few to select from.

4. Scroll down to the Suggested Values section and add the suggested values as you did previously in creating the new claim type.

5. Click OK. You have now created your new resource property.

At this point you will return to the Resource Properties screen, as shown in Figure 15.26.

Remember when we mentioned that Microsoft has already done a lot of work to allow companies to deploy Dynamic Access Control quickly? Part of the overall goal was to make Dynamic Access Control quick to deploy, and although you have to put some thought into what rules/properties/claims types you need to create you will see from the next guide that there are a lot already done for you and all you have to do is select them.

1. Browse through the Resource Properties list to see what is configured and what you could potentially reuse rather than creating new properties.

Now let’s do a quick check:

You’ve created a new claim type for Contoso departments.
You’ve created a referenced resource property based on the Contoso Department claim.

Next, you have to configure a resource property list. A resource property must be part of a resource property list. The resource property list will be downloaded by the file servers. As you can see in the main Dynamic Access Control window in Figure 15.27, the resource property list is of type Container.

Figure 15.27 Main Dynamic Access Control windows

2. Double-click Resource Property Lists, and you will see the screen shown in Figure 15.28.

Figure 15.28 Resource Property Lists showing the Global Resource Property List

The Global Resource Property List that is shown is the default list all file servers will receive.

3. For informational purposes, double-click the Global Resource Property List.

Notice all the resource properties that are there by default, as shown in Figure 15.29.

Figure 15.29 The Global Resource Property List screen

Let’s add our resource property to the Global Resource Property List.

4. Click the Add button.

5. From the Select Resource Properties window, navigate to department_contoso and click the arrows pointing to the right to add it, as shown in Figure 15.30.

Figure 15.30 Adding a new resource property to the Global Resource Property List

6. Click OK, browse the resource property list, and ensure that your resource property is now listed. Click OK on the main window to close it.

You have created a new claim type, a referenced resource property, and added it to the Global Resource Property List. Next, you need to create a Central Access Rule:

1. From the main Dynamic Access Control window again, click Central Access Rules, and in the Tasks menu select New

Central Access rule.

2. In the Create Central Access Rule window, enter Contoso_Demo_rule in the Name field, as shown in Figure 15.31.

Figure 15.31 Create Central Access Rule screen

Under Target Resources, you can be more selective if you need to about the resources you want to control access to. For this example, leave it set to All Resources so that you can set up read-access for all authenticated users to all resources.

3. Now navigate to Permissions, and click “Use following permissions as current permissions,” as shown in Figure 15.32.

Figure 15.32 Adding permissions for a central access rule

4. Click the Edit button.

This will open the Advanced Security Settings for Permissions window, as shown in Figure 15.33.

Figure 15.33 Advanced Security Settings for Permissions screen

5. Click Add.

This will open the Permission Entry for Permissions window.

6. Click Select a Principle, and type in Authenticated Users; leave the Read and Read and Execute permissions as is; see Figure 15.34.

Figure 15.34 Permission Entry for Permissions screen

Next, as you did earlier in this chapter, you are going to add conditions.

7. Click “Add a condition.”

This will bring up options for you to configure.

8. In the first box select User, in the second box select department_contoso, and in the final box select Accounts.

Notice that the drop-down list in the final box contains the options that you created earlier.

9. Repeat this step for the remaining departments. Use the “And” condition, as shown in Figure 15.35.

Figure 15.35 Adding conditions to a Central Access rule

10. Click OK when you’ve finished adding conditions, and click OK twice more to close all windows.

Great! You are nearly finished, now you need to create a Central Access Policy that you will then use to deploy to your file servers:

1. From the main Dynamic Access Control window, select Central Access Policies, and in the Tasks menu select New

Central Access Policy.

2. Enter Contoso Test CAP in the Name field when the new Create Central Access Policy window opens, as shown in Figure 15.36.

Figure 15.36 Create Central Access Policy window

3. You need to add the rule you created earlier, so click Add under Member Central Access Rules.

This will open the Add Central Access Rules window.

4. Select Contoso_Demo_rule, click the arrows pointing to the right, and click OK, as shown in Figure 15.37.

Figure 15.37 Adding a Central Access rule to a Central Access Policy

5. Click OK to finish creating the policy.

Appling Dynamic Access Control Policies

You have created a Dynamic Access Control policy, but you need to apply it to your servers in order for it to become effective. This is done via Group Policy. By deploying it via Group Policy you have amazing flexibility to start targeting specific server groups and roll it out further as necessary.

In Chapter 9 you would have become familiar with Group Policy; if not, skip back now and read it.

You need to use the Group Policy Management console to create a new group policy to roll out your Central Access Policy. To recap, the Group Policy Management console is located in Server Manager

Tools.

In our example, our Group Policy Management console is located on our domain controller. (We assume at this point that you are familiar with this tool.)

You are now going to create a group policy just under the root level of the domain contoso.ie and target it to just your file servers. But before you start, here’s some best practice advice:

1. Right-click contoso.ie, as shown in Figure 15.38, and select Create a GPO in this domain, and Link it here.

Figure 15.38 Creating a GPO for Central Access Policy deployment

2. In the New GPO window, give it a name.

In our scenario we’re using CAP-Contoso-Demo.

3. Click OK, as shown in Figure 15.39.

Figure 15.39 New GPO window

It should now appear in the list under contoso.ie.

4. Click the group policy, and under Security Filtering on the Scope tab of the Group Policy Management screen, as shown in Figure 15.40, select Authenticated Users and click Remove.

Figure 15.40 Removing Authenticated Users

5. When prompted “Do you want to remove this delegation privilege?” click OK.

6. Click Add.

This will bring up the Select User, Computer, or Group window.

7. Click the Object Types button and select Computer, since it is not checked by default, and click OK.

8. In the “Enter object name to select” field, type in the name of the file server you want to apply it to.

In the example, we are using contosofs01.

9. Click Check Names, ensure that it resolves, and click OK. See Figure 15.41.

Figure 15.41 Ensuring the name resolves in the search window

In the Security Filtering field, you will see the full name of the computer account listed; this simply means that the policy will apply only to this computer, even though it is located at the root of the domain. See Figure 15.42.

Figure 15.42 Computer account added to Security Filtering field

Next, you need to edit this group policy.

10. Right-click the CAP-Contoso-Demo group policy and click Edit.

This will open the Group Policy Management Editor window.

11. Navigate to Computer Configuration Policies

Windows Settings

Security Settings

File System

Central Access Policy, as shown in Figure 15.43.

Figure 15.43 Central Access Policy location in Group Policy Management Editor

Currently, nothing is configured.

12. Right-click Central Access Policy, and click Manage Central Access Policies, as shown in Figure 15.44.

Figure 15.44 Manage Central Access Policies

The Central Access Policies Configuration window will open, and you will see the Central Access Policies that you configured earlier listed.

13. Select the policy that you want to apply, and click Add. In this example, we are choosing Contoso Test CAP, as shown in Figure 15.45.

Figure 15.45 Selecting Central Access Policies to apply

14. Click OK.

15. Next, scroll down in the Group Policy Management Editor to Advanced Audit Policy Configuration

Audit Policies

Object Access, and double-click Audit Central Access Policy Staging, as shown in Figure 15.46.

Figure 15.46 Enabling Central Access Policy Staging

16. Select all the check boxes in the Audit Central Access Policy Staging Properties window, as shown in Figure 15.47, and click OK. Close the Group Policy Management Editor.

Figure 15.47 Configuring auditing

Now you need to ensure that the policy gets applied to the file server.

17. Log on to ContosoFS01 from our example, from an elevated command prompt run gpupdate/force.

This will apply the policy you have configured.

18. To confirm that it has been applied, look at a folder you have shared on ContosoFS01.

In our demo environment we have shared C:\share to \\contosofs01\share.

In Figure 15.48 and Figure 15.49 you can see that we have set up rules for NTFS security and share permissions.

Figure 15.48 NTFS permissions

Figure 15.49 Share permissions

Have you noticed the new tab? In Figure 15.49 you can see a new tab called Central Policy. By default, it applies no policy.

When you click on the Central Policy tab you will need to click the change hyperlink to access the drop-down list and you will find the policy we configured earlier that was assigned via Group Policy.

19. Select the policy Contoso Test CAP, and it will then display the Central Access rules you have configured for allowing/restricting access to resources.

20. Click the down arrow beside the Central Access rule, you will see the options you configured earlier.

Testing the New Policy

You have now applied a preconfigured Central Access Policy to your file server share. If you look at Figure 15.48 and Figure 15.49 again. For the permissions, you will see that the Everyone group has been given read-acess to the folder and share after the Central Access Policy has been applied. This isn’t really ideal, but it’s a common problem in most environments.

Technically speaking anyone should be able to access this share and retrieve the valuable information contained within. So let’s test it:

1. On Contosofs01 navigate to where your share is located.

In this example our share is located on C:\share.

2. Right-click C:\share and select Properties.

3. Click the Security tab, and then click Advanced to open the “Advanced Security Settings for share” window. See Figure 15.50.

Figure 15.50 “Advanced Security Settings for share” window

4. Click the Effective Access tab.

Effective access will allow you to test the permissions and Central Access Policies that are applied to a share for a user or device principal. For example, the Central Access Policy we have defined has one rule within, allowing only people from HR or Accounts access the share. In our lab environment we have two users configured: Tom, who is in the Accounts department, and Ken, who is in the IT department. Even though the NTFS permissions and share permissions allow Everyone to connect, the Central Access Policy will override this. The big question is, can you be sure?

Let’s test it to find out. In the screen shown in Figure 15.51 you can select either a user or a device. In our example we are selecting a user because the claim type we set up was based on the user’s department.

Figure 15.51 Effective Access tab

5. Click “Select a user” and type Tom in the Search field; click Check Names and then click OK. See Figure 15.52.

Figure 15.52 Selecting a user to test effective access

6. Now click “View effective access” at the bottom of the window.

We expect that Tom will get Read & Execute permissions. In Figure 15.53, you can see the results. As expected, Tom has Read and Read & Execute permissions as per the Central Access Policy we have configured.

Figure 15.53 Effective access results for Tom

7. Repeat the process for Ken.

Remember, Ken is part of IT, so according to our rules Ken should be denied access to the share completely. See Figure 15.54 for Ken’s results; as expected, he is denied access.

Figure 15.54 Effective access results for Ken

Try it out now on a Windows client, and see if you can access the share. For further fun, change your Department field in Active Directory. Then log off and log on and see if you have access.

Access Denied Assistance

On a daily basis in a large enterprise, the number of permissions that are being added and removed by help desk is astonishing. This is a manually intensive task, and it takes time to complete. Windows Server 2012 has introduced access-denied assistance to alleviate the burden and has put the responsibility of access control back on the data owner or requires the data owner at least give relevant information to the help desk to allow them to perform a quick turnaround on the access-denied problem.

First, we are going to show you how to configure it via Group Policy. Later in this chapter when we are dealing with classifications, we will demonstrate its configuration via File Server Resource Manager.

Let’s configure a new GPO for access-denied assistance, which will be applied organization-wide:

1. On the machine (in our case ContosoDC01) that has your Group Policy Management console, open the tool and create a new group policy called Global-Access-Denied-Assistance.

2. As before, right-click the newly created GPO and click Edit.

This will again bring you into the Group Policy Management Editor.

3. Navigate to Computer Configuration Policies

Administrative Templates

System

Access-Denied Assistance, as shown in Figure 15.55.

Figure 15.55 Group Policy Editor with Access-Denied Assistance selected

4. On the right side of the screen, double-click the setting “Customize message for Access Denied errors.”

The “Customize message for Access Denied errors” window will appear, as shown in Figure 15.56.

Figure 15.56 “Customize message for Access Denied errors” window

5. Click Enabled to configure the options in this new policy.

In the Options section of the screen there are five different areas you can configure. In this example we are going to leave “Add the following text to the end of the email” and the “Email recipients” settings as configured by default. We will modify “Display the following message to users who are denied access” and “Enable users to request assistance.”

6. Check the box for “Enable users to request assistance,” and then you’ll add a message that will be displayed when a user is denied access.

One great thing in this area is the ability to use predefined macros to produce a really informative message for the user. The four macro’s currently available are:

[Original File Path]
[Original File Path Folder]
[Admin Email]
[Data Owner Email]

An example would be “Access is denied to [Original File Path]. Please contact [Admin Email] or click request assistance and provide business justification to access resources.”

This obviously is only a sample, but we already have two points of contact, and we can provide the complete file path to aid users in their troubleshooting.

7. Click OK when you have finished creating your message.

8. Now double-click “Enable access-denied assistance on client for all file types” and enable it.

9. Click OK when finished.

10. Now refresh the policy on your file server and client by running gpupdate/force from an elevated command prompt.

11. On your client, check for the existence of a registry key to ensure the policy has applied correctly.

The key HKLM:\Software\Policies\Microsoft\Windows\Explorer should now exist and a new DWORD value called EnableShellExecuteFilestreamCheck with a Value of 1 should exist.

Now from a user account (Ken in my example) that does not have access, try to connect to the share; the user will get a more informative message and the ability to request assistance, as shown in Figure 15.57.

Figure 15.57 Access-denied custom message from client

Notice that the [Data Owner Email] macro was replaced with the folder owner’s email address and we have a nice customer-friendly message for the end user.

12. Click Request Assistance. The Request Assistance dialog is shown in Figure 15.58.

Figure 15.58 Request Assistance window

The user and the share they are trying to access are included in the message. They can now provide a business justification for the assistance if necessary.

13. Click “Send message” to send the request.

Claims—Using Different Attributes

Value	Display Name
Engineer	Engineer
Accountant	Accountant
Reception	Reception
Director	Director

However, there is no Active Directory attribute called Office. The actual Active Directory attribute for the Office field is physicalDeliveryOfficeName; see Figure 15.60.

Step 2: Create the Resource Property

1. From your Dynamic Access Control main window, select Resource Properties, and under Tasks choose New

Referenced Resource Property.

Can you remember the difference? Referenced resource properties are for claim types you have already configured.

2. Under the referenced resource property select physicalDeliveryOfficeName, set its value type as Single-valued Choice, and click OK.

3. Repeat this for title.

Step 3: Add to the Resource Property List

This step is kind of a trick, because title and physicalDeliverOfficeName are already known attributes. You will find that they already exist in the Global Resource Property List. Verify that they exist before creating your rules.

Step 4: Create Central Access Rules

1. From the main Dynamic Access Control window, select Central Access Rules, and under Tasks click New

Central Access Rule.

2. For its name enter Contoso-Title-Office-Secure.

Leave the target resources as is, because you’ll want to apply it to all resources that you will target later.

3. Under Permissions click Edit, and then click Add Users.

4. Click Select a Principal and type in Authenticated Users.

5. Click Check Names and then click OK.

6. Under Basic Permissions grant Full Control for this example.

7. Add the conditions shown in Figure 15.61, and click OK.

Figure 15.61 Securing conditions

8. Click OK to close the Advanced Security Settings for Permissions window, and click OK again to finish creating your Central Access rule.

Step 5: Create a Central Access Policy and Deploy It via Group Policy

1. From the main Dynamic Access Control window select Central Access Policies, and under Tasks choose New

Central Access Policy.

2. Type Contoso Secure By Title / Office in the Name field.

3. In the Central Access Rules section click Add, and select the rule you created earlier.

4. Click OK to complete the policy.

5. Go to your machine that has the Group Policy Management console.

6. Open the Group Policy Management console. Right-click the CAP-Contoso-Demo group policy you created earlier, and click Edit.

7. Navigate to Computer Configuration

Policies

Windows Settings

Security Settings

File System.

8. Right-click Central Access Policy and click Manage Central Access Policies.

9. Add your new policy and click OK, and close the Group Policy Editor.

10. Run Gpupdate/force on your file server to receive the new policy.

Step 6: Apply the Policy to the Engineering Folder

1. Navigate to the share, right-click it, and select Properties.

2. Click the Security tab and then click Advanced.

3. Click the central policy on the Advanced Security Settings for Engineering window.

4. Click Change and select the Contoso Secure By Title/Office policy.

5. Review the rules to ensure they are the correct rules.

Step 7: Test with Effective Access

1. Click the Effective Access tab.

2. Click Select a User and type Tom in the search field.

3. Click Check Names and then click OK.

4. Click View Effective Access.

Since Tom is an engineer and is located in the Empire State Building, he should get Full Control.

5. Now retry with Ken.

Since Ken is an engineer but is not located in the Empire State Building, he should have no access to the folder.

The permissions are set as Central Access Policies logical “And” NTFS permissions.

Classification

1. Right-click a file (in our case Finance.rtf) and click Properties.

You will see the Finance Properties screen with five tabs, as shown in Figure 15.62.

Figure 15.62 Finance Properties screen

2. Click the Classification tab, and you will notice that it has some information already populated; see Figure 15.63.

Figure 15.63 Classification tab

Do you notice something about the data? It’s the resource properties we published earlier on in this chapter from Dynamic Access Control.

3. Click department_contoso and select Accounts.

Congratulations! You have just classified your first document.

As already mentioned, this would be a painful approach if you had to do this to all your documents. Windows Server 2012 includes a tool called File Server Resource Manager (not installed by default), located in Server Manager under Tools.

Take a quick look around the File Server Resource Manager for 2012. To open from Server Manager

Tools

Click File Server Resource Manager; this will open the MMC, as shown in Figure 15.64.

Figure 15.64 File Server Resource Manager MMC

The left side lists Quota Management, File Screening Management, Storage Reports Management, Classification Management, and File Management Tasks. In this case we are interested in Classification Management.

Click the arrow beside it to show the sub-options, which are:

Classification Properties

Classification properties can be inherited via Dynamic Access Control or locally set. You can configure Authorization, File Classification, and Folder Management. You can also configure Access-Denied Assistance from here for the local file server only.

Note that you can’t modify items with a scope of Global in this console because they are inherited from DAC.

Classification Rules

Classification rules allow you to set up conditions that will automatically classify documents for you. We are going to be diving deeper into this in our example. Over the next few steps we will show you how to create the appropriate rules to allow you to classify your documents and folders. We will walk you through all the steps required and demonstrate how automatic classification works.

To classify documents automatically you need to create a classification rule. First, to aid in the configuration and explanation of some items later on, you need to map your folders using Folder Usage:

1. In the File Server Resource Manager MMC, click Classification Properties.

2. Locate the Folder Usage property, as shown in Figure 15.65, and double-click it.

Figure 15.65 File Server Resource Manager showing the Folder Usage property

This will open the Edit Local Classification Property window, in the bottom part of the screen.

3. Scroll down to the bottom, click in an empty field, and type Accounts.

4. Repeat step 3 but enter Engineering, and click OK when you have finished, as shown in Figure 15.66.

Figure 15.66 Adding values to the Folder Usage property

1. In the Action menu on the right side of the MMC, click Set Folder Management.

This will bring up the Set Folder Management Properties window.

2. In the Property box, select Folder Usage, as shown in Figure 15.67.

Figure 15.67 Set Folder Management Properties screen

3. Click Add, browse to the path for the Accounts folder, and check the box for Accounts, as shown in Figure 15.68. Then click OK.

Figure 15.68 Adding a value to Accounts

4. Repeat step 3 for the Engineering folder, as shown in Figure 15.69.

Figure 15.69 Adding a value to Engineering

5. Click Close.

This work will aid you later when creating your classification rules, because the properties that you have just confirmed will be available for selection during the building of a classification rule.

1. Click Classification Rules on the left side of the MMC.

2. Now on the right side in the Actions pane, click Create Classification Rule.

This will open the Create Classification Rule window, as shown in Figure 15.70.

Figure 15.70 Create Classification Rule

3. In the “Rule name” field, enter File Classification.

4. Next, click the Scope tab.

This is where the work you have performed on folder usage in the earlier steps comes into play.

5. Check the Accounts and Engineering check boxes.

Notice in Figure 15.71 that the folders in this scope are automatically populated.

Figure 15.71 Scope classification rule

6. Next, click the Classification tab.

In the Classification tab the first thing you need to choose is the classification method. There are three methods by default:

Content Classifier Content Classifier allows you to set up patterns that you can detect within a file to autoclassify the document.

Folder Classifier Folder Classifier automatically classifies all folders to the configured value.

Windows PowerShell Classifier The PowerShell classifier allows you to write your own detection agent in PowerShell and execute it here. It’s extremely powerful for advanced users.

7. In this exercise, select Content Classifier.

8. Next, in the Property field, select department_contoso and specify Accounts for its value, as shown in Figure 15.72.

Figure 15.72 Classification configuration

9. Click the Configure button under Parameters.

This will open the Classification Parameters window, as shown in Figure 15.73. In the Expression Type drop-down menu there are three options:

Figure 15.73 Classification Parameters screen

Expression Types

Regular expressions are used to identify patterns in data, similar to the Find option in Notepad, where you can press F3, type in a string to search for, and Find will find it. Regular expressions do the exact same thing. Traditionally, they are used in the programming world or in the telephony world for detecting patterns in data or manipulating telephone numbers. An example is that you can create a regular expression to detect a credit card number.

We are going to provide a quick primer on regular expressions in the next few pages because they are extremely powerful. But first, we are going to show you how to detect a simple string pattern called Finance and how upon detection of the Finance string within a document the regular expression will classify it appropriately:

1. For the purposes of this example, select String in the Expression Type field of the Classification Parameters dialog, because we are going to detect a string pattern within a document.

2. In the Expression field, type Finance and click OK.

Creating Multiple Rules

You can have multiple evaluation parameters of different types. However, the file you are evaluating must match all the criteria specified, and evaluation happens only once per file at runtime. If you need to search for and match multiple different patterns, you will need to create multiple rules.

3. Now select the Evaluation Type tab, as shown in Figure 15.74.

Figure 15.74 Evaluation Type tab

Here you have the ability to reevaluate the existing properties and when a conflict occurs either overwrite the previous value or merge values.

4. In our case we will reevaluate and overwrite the existing value.

5. Click OK when finished.

Your classification rule is complete. All you have to do now is either manually run it by selecting the rule, and in the Actions menu click Run Classification Rule or wait for the Task Scheduler to execute it.

When you manually run the classification you are prompted to choose to either run the task in the background or wait for it to complete, as shown in Figure 15.75.

We’ll choose the automatic option, which allows the Task Scheduler to execute the task on a scheduled basis. First, however, we need to configure the options for automatic file classification:

1. On the left side of the File Server Resource Manager MMC, navigate to the top of the tree to File Server Resource Manager (Local).

2. Right-click it and select Configure Options, as shown in Figure 15.76.

Figure 15.76 Configure Options for automatic file classification

3. When the Options window opens, select the Automatic Classification tab.

As you will see, it is disabled by default.

4. Click Enable Fixed Schedule.

5. Set the “Run at” time to 01:00:00 AM.

6. Choose Weekly and Sunday.

7. Check “Allow continuous classification for new files,” and leave the rest of the options at their default. See Figure 15.77.

Figure 15.77 Options to configure for scheduling automatic file classification

8. Click OK when you have finished.

1. Open the Task Scheduler, and navigate to Task Scheduler Library

Microsoft

Windows

File Server Resource Manager.

Here you will see a new task named FciClassification with the options you configured.

2. Check what the task is running under Action—that’s right, it’s running PowerShell.

Since you want to run this right away and not wait until 1:00 a.m., you will want to run the manual classification and select Complete as a background task, but not yet.

1. First, you need to check the document for which you want to test if file classification is working correctly. Open the file that you want to use as a test.

In our lab environment we have under C:\share\accounts a single file called Private Data.rtf. The contents of the file are shown in Figure 15.78.

Figure 15.78 Contents of Private Data.rtf

Remember that our classification rule is configured to classify on Content and on finding one instance of the expression Finance. This should classify the document as an Accounts document.

2. Next, check the existing classification of the document by right-clicking it and selecting Properties and then clicking the Classification tab.

As you can see in Figure 15.79, our file currently has no classification.

Figure 15.79 Private Data.rtf classification

3. Return to the File Server Resource Manager and run the file classification rule by selecting the rule you want to execute and then in the right-hand side of the mmc under Actions select Run Classification With All Rules now. When prompted select Run Classification in the background.

4. Wait until it completes, and then recheck the file classification. As shown in Figure 15.80, the classification of department_contoso has been set to Accounts.

Figure 15.80 Private Data.rtf classification set

Before you start thinking that I am mad and that I also included the Engineering folder, let’s check its contents and file classification. In our lab we included a file under C:\share\engineering called Engineer Scope.rtf, and as you can see in Figure 15.81, even after the File Classification Wizard has run, the classification of the file is not set. Why? Because we set no rules specifically for it.

Try out different combinations and create new rules yourself now to really embed the principles of what we have covered so far.

Understanding Regular Expressions

I promised to give you a quick demonstration of regular expressions. This is something you should ask experienced programmers or telephony engineers about because they are wizards at this stuff and usually have a great ability to construct exceptionally complex but useful expressions.

Also, in your favorite search engine search for “Regular Expression Cheat Sheets.” There are a few really cool links available that you can use as a reference.

As with most things, regular expressions won’t make sense until you use them for something. So let’s look at a basic example. Say you want to detect a credit card number. First, you should look at what characteristics a credit card number has, and to my thinking the simplest one to start with is that it always has 12 numbers. We’ll start with that.

In order to detect a 12-digit number with regular expressions you would have a query like this:

If you break this down, very simply the \d means “detect a digit” and the {12} means “exactly 12 characters long.”

Another way of writing this if the credit card number is stored like 1234-1234-1234-1234 is:

Simple, eh! Hopefully you won’t have too many 12-digit numbers that are not credit cards in your environment that get classified unnecessarily with this basic rule. However, we can get a bit more focused. For example, let’s say Visa cards start with the number 4 and then use a combination or 11 other digits. What would the regular expression for that look like?

Now let’s look at a different example. Two things that come to mind that companies often do not want leaked to the public are intellectual property and payroll information. Hopefully you agree! To my mind these pieces of information need to be protected, and on that note let’s build another regular expression. We will also reuse the following example later on when integrating this into our Dynamic Access Control configuration.

But first, what would a regular expression look for detecting the words intellectual property?

Been able to detect patterns like this and even more complex ones can give you great flexibility in the enterprise to classify data in the correct way so that you can secure it automatically with a range of other tools like Rights Management Server.

Securing Data Using DAC and File Classification

For the final piece of this chapter let’s examine a real example you’ll come across in the workplace. Most businesses now deal with credit card numbers at some point. And it is the company’s responsibility to ensure that this data is secure. Hopefully these numbers are stored in encrypted databases in the real world, but in our example company, Contoso, they have been storing them in a Word document.

We need to safeguard not only the company but also the information so it isn’t leaked. We don’t want engineers logging on to the file share and being able to copy the credit card number file. That would be disastrous.

1. On your file server (using our example ContosoFS01) navigate to C:\share\accounts.

2. Right-click in the folder, and select New

Rich Text Document; see Figure 15.82.

Figure 15.82 Creating a rich text document

3. Type File1 for its name.

We are using a generic name to ensure that it actually detects the content and classifies the document correctly.

4. Double-click File1 to open it and type a 12-digit number.

5. Save the document and close it.

6. Repeat this procedure using the names File2 and File3.

7. In File2 put in random words and include the word payroll, and in File3 put in random words and then Intellectual Property.

8. Save all documents.

9. Quick test: Check the classification of each document and ensure that nothing is set.

Next, let’s create the classification rules to automatically classify the documents:

1. On ContosoFS01 open the File Server Resource Manager.

You will need to create three new rules, because you are looking for different patterns that won’t necessarily be all in one file.

2. Click Classification Rules, and in the Action menu on the right, click Create Classification Rule.

3. Under the General tab, in the Rule Name section, type Auto Classify For Credit Cards.

4. Now click the Scope tab and click Accounts.

Notice how the Accounts share gets autopopulated.

Quick test: How did you get the folders included in the Accounts scope?

5. Now click the Classification tab.

6. For the classification method, select Content Classifier.

7. Under Property, choose a property to assign to the files.

8. Select department_contoso, and for “Specify a value” select Accounts.

9. Under Parameters, click Configure.

Quick test: What does the regular expression look like for detecting a 12-digit number? Think of the pattern you are trying to match.

10. Click OK when you have finished.

11. Finally, click the Evaluation Type tab, check the “Re-evaluate existing property values” check box, and select “Overwrite the existing value.”

12. Click OK when you have finished.

13. Create two more rules using the method previously described with the following information:

14. After you’ve created these, run the classification rules manually and wait for completion.

15. Finally, check that the rules have worked and that they have classified the documents correctly.

Your file-classification rules are in place and you have now verified that they work. It would make sense now to build a policy so that only Accounts or HR people can access these types of documents.

Prep time first! To ensure this is done correctly and you understand the flow, take some time to remove all Central Access Policies already applied to your folder:

1. Right-click the folder and choose Properties

Security Advanced

Central Policy

Change

No Central Policy Applied, and click OK.

2. Log on to the client machine with a non-Accounts user (in our examples it has been Ken), and ensure that the user can browse the Accounts folder and access the files.

3. If you can’t access the files after removing the policy, check the permissions and assign the appropriate permissions, such as assigning the Domain Users group Full Control to the folder.

1. From the Active Directory Administrative center, choose Dynamic Access Control

Central Access Rules.

2. In the menu on the right, choose New

Central Access Rules.

3. In the Name field of the new Central Access rule, type Securing Auto Classified Accounts Data.

4. Previously we told you to leave Target Resources alone, but now click Edit in that area.

Target resources will work with the classification of the file to protect it. The screen shown in Figure 15.83 is very similar to the other condition-based screens you have created in previous tasks.

Figure 15.83 Resource targeting

5. In this rule, mirror what is displayed in Figure 15.83, and click OK.

This will now target all files that have been classified for Accounts.

Now you need to set the permissions; you want only HR and Accounts staff to have Full Control over the documents:

1. In the Permissions section, click Edit and then click Add.

2. Select the principle Authenticated Users, and give them Full Control.

3. In the condition section, add the values shown in Figure 15.84.

Figure 15.84 Permissions and condition logic

4. Click OK twice to close all the screens.

5. Click OK to finish creating the Central Access rule.

Next, you need to create a Central Access Policy so you can then deploy this to your file servers:

1. Click Dynamic Access Control in the menu on the left.

2. Right-click Central Access Policies, and choose New

Central Access Policies.

3. Type CAP-AutoClassify for the name, and add the one that you created in the preceding set of steps.

4. Click OK to finish creating the policy.

5. Open the Group Policy Management console.

6. Locate the CAP-Contoso-Demo group policy you created earlier to deploy Central Access Policies to file servers.

7. Right-click it and select Edit.

8. Navigate to Computer Configuration Policies

Windows Settings

Security Settings

File System

Central Access Policy.

9. Right-click and select Manage Central Access Policies.

10. Add CAP-AutoClassify, and close the Group Policy Editor.

11. On your file server now run gpupdate/force from an elevated command prompt.

12. Apply the CAP-AutoClassify policy to the Accounts folder under C:\share.

13. Now on the client machine as a user who is not in HR or Accounts, try to access the information in Accounts.

Can you see it?

14. If you can see it, try accessing it.

If you can’t see it, then you also have Access Based Enumeration turned on, and this hides files and folders for which it knows you don’t have permissions.

15. Try logging on with a user in Accounts or HR, and experience the difference.

16. Finally, create a new RTF file called file5 in the Accounts folder, and put any information inside that is not protected by your classification rules.

17. Now try to access it from the client with both an Accounts user and a non-Accounts user.

How cool is that!

Chapter 15

Dynamic Access Control: File Shares, Reimagined

A New Way to Secure File Shares

Access Control Using Groups and User AD Attributes

Securing Data by Machine Attributes

Centrally Control Permissions Using Templates

Using Effective Permissions to Troubleshoot Access Control

Automatic File Classification

DAC Players: User, Device, Resources, and Claims

User

Device

Resources

Claims

Enabling DAC

Pieces of an Access Policy

Creating a Dynamic Access Policy

Side Task

Appling Dynamic Access Control Policies

Testing the New Policy

Access Denied Assistance

Claims—Using Different Attributes

Step 1: Create the Claim

Step 2: Create the Resource Property

Step 3: Add to the Resource Property List

Step 4: Create Central Access Rules

Step 5: Create a Central Access Policy and Deploy It via Group Policy

Step 6: Apply the Policy to the Engineering Folder

Step 7: Test with Effective Access

Classification

Classifying a Document

Classification Properties

Classification Rules

Expression Types

Understanding Regular Expressions

Securing Data Using DAC and File Classification

The Bottom Line