Download - MCSA 70-412 Chapter 03
Module 3
Implementing Dynamic Access Control
Module Overview
•Overview of DAC
• Implementing DAC Components
• Implementing DAC for Access Control
• Implementing Access Denied Assistance
• Implementing and Managing Work Folders
Lesson 1: Overview of DAC
• Limitations of Current Access Management
Methods
•What Is DAC?
•What Is the Claim?
•What Is Resource Property?
•Accessing Resources with DAC
•Requirements for DAC Implementation
Limitations of Current Access Management Methods
• NTFS file system permissions and ACLs provide
access control that is based on a user’s SID or
group membership SID
• AD RMS provides greater protection for
documents by controlling how applications use
them, and also works with user or group SID
• NTFS file system permissions cannot use AND
between conditions
• In NTFS file system permissions, you cannot
build your own conditions for access control
What Is DAC?
• DAC in Windows Server 2012 is a new access
control mechanism for file system resources
• DAC uses claims in the authentication token,
resource properties on the resource, and
conditional expressions within permission and
auditing entries
• DAC is designed for four scenarios:• Central access policy for managing access to files
• Auditing for compliance and analysis
• Protecting sensitive information
• Access-denied remediation
What Is the Claim?
• A claim is something that AD DS states about a
specific object
• In the DAC infrastructure, claims are defined by
using specific attributes from a user or device
• In Windows Server 2012, the authorization
mechanism is extended to support conditional
expressions that includes claims
• In Windows Server 2012, you can create:• User claims
• Device claims
• You can deploy claims between trusted forests
User and Device Claims
• Pre-2012 Security Principals Only are:
• Restricted to making policies where decisions are based on the user’s
group memberships
• Shadow groups are often created to reflect existing attributes as groups
• Groups that have rules around who can be members of which types of
groups
• Not able to transform groups across AD trust boundaries
• Not able to control access based on characteristics of user’s device
• Windows Server 2012 considerations:
• AD DS user/computer attributes are included in the security token
• Claims can be used directly in file server permissions
• Claims are consistently issued to all users in a forest
• Claims can be transformed across trust boundaries
• Enables newer types of policies that were not possible before
What Is Resource Property?
• Resource properties define attributes of the
resource that you want to use
• Resource properties are grouped in resource
property lists
• When creating a resource property, you can
specify the property type and the allowed or
suggested values
Accessing Resources with DAC
NT access token
Contoso\Alice
User Groups:….
Claims:
Title=SDE
Kerberos Ticket
Contoso\Alice
User Groups:….
Claims:
Title=SDE
Enabledomain to
issue claims
Claim type
Display name
Source
Suggested
values
Value type
User attempts to log on
Receives a Kerberos ticket
Kerberos and a New Token
•DAC leverages Windows Kerberos
• Windows 8 Kerberos extensions
• Compound ID – binds a user to the device to be
authorized as one principal
•DC issues groups and claims
• DC enumerates user claims
• Claims delivered in Kerberos Privilege Account
Certificate
•NT Token has the following
sections:
• User & Device data
• Claims and Groups
• Tokens have same size
Pre-2012 Token
User Account
User Groups
(other data)
2012 Token
User Account
User Groups
Claims
Device Groups
Claims
(other data)
Requirements for DAC Implementation
To implement DAC, you need to have:
• Windows Server 2012 or newer with the FSRM
• Update AD DS schema, or at least one Windows Server
2012 domain controller
• Windows 8 or newer on clients to use device claims
• Enabled support for DAC in AD DS (default domain
controllers GPO)
Lesson 2: Implementing DAC Components
•Creating and Managing Claims
•Creating and Managing Resource Properties and
Resource Property Lists
•Creating and Managing Access Control Rules
•Creating and Managing Access Policies
•Demonstration: Configuring Claims, Resource
Properties, and Rules
• Implementing and Managing File Classifications
•Demonstration: Configuring Classification Rules
Creating and Managing Claims
• Use the AD CS to create attribute-based claims
• Use the Active Directory module for Windows
PowerShell to create certificate-based claims
• Claims are stored within the configuration
partition in AD DS
• Attributes are used to source values for claims
• Make sure that you configure attributes for your
computer and user accounts in AD DS with the
information that is correct for the respective user
or computer
Creating and Managing Resource Properties and Resource Property Lists
• Resource properties describe resources that you
protect with DAC
• Several resource properties are already
predefined in Windows Server 2012
• All predefined resource properties are disabled
• When creating a new resource property, you
have to set its name, and value type
• In Windows Server 2012 R2, you also can create
reference resource properties
• Resource properties are grouped in resource
property lists
Creating and Managing Access Control Rules
• A central access rule contains one or multiple
criteria that the Windows operating system uses
when evaluating access
• You create and configure central access rules in
the Active Directory Administrative Center
• To create a new central access rule, you should:
• Provide a name and description for the rule
• Configure the target resources
• Configure permissions
Conditional Expression Example
User claimsUser.Department =
Finance
User.Clearance = High
Access Rule
Applies to: @File.Impact = High
Allow | Read, Write | if (@User.Department = @File.Department) AND
(@Device.Managed = True)
Device claimsDevice.Department =
Finance
Device.Managed = True
Resource propertiesResource.Department =
Finance
Resource.Impact = High
AD DS
File
ServerUser
Creating and Managing Access Policies
• Central access policies enable you to manage
and deploy consistent authorization throughout
an organization
• The main component of a central access policy is
a central access rule
• Central access policies act as a security net that
an organization applies across its servers
• Group Policy is used to deploy a central access
policy
• Manually apply the policies to all Windows
Server 2012 file servers
Demonstration: Configuring Claims, Resource Properties, and Rules
In this demonstration, you will learn how to
configure claims, resource properties, and access
rules
Implementing and Managing File Classifications
• Resource property
definitions are defined in AD
DS
• Resource property
definitions can be used
during file classifications
• File classifications can be
run automatically
Demonstration: Configuring Classification Rules
In this demonstration, you will learn how to classify
files by using a file classification mechanism
Lesson 3: Implementing DAC for Access Control
• Planning Central Access Policies for File Servers
•Demonstration: Creating and Deploying Central
Access Policies
•How Does Access Check Work When DAC Is in
Use
•Managing and Monitoring DAC
•Demonstration: Evaluating and Managing DAC
Planning Central Access Policies for File Servers
When planning deployment of central access
policies, you should:• Identify the resources that you want to protect
• Define the authorization policies
• Translate the authorization policies that you require
into expressions
• Identify attributes for access filtering
Demonstration: Creating and Deploying Central Access Policies
In this demonstration, your instructor will show you
how to create and deploy central access policy
How Does Access Check Work When DAC Is in Use
File/Folder
security descriptor
Central access policy
reference
NTFS file system
permissions
AD DS
(cached in local registry)
Cached central access policy definition
Access control decision is calculated by using following checks:
1. Access check – Share permissions if applicable
2. Access check – File permissions
3. Access check – Every matching central access rule in central access policy
Share
security descriptorShare permissions
Cached central access rule
Cached central access rule
Cached central access rule
Managing and Monitoring DAC
• DAC allows you to test a central access policy update by
staging it
• Windows Server 2012 staging:
• Is implemented by deploying proposed permissions
• Compares the proposed permissions against the current
permissions
• Causes audit-log events to appear in the security log on the file
server
Current Central Access policy for high impact data
Applies to: @File.Impact = High
Allow | Full Control | if @User.Company=Contoso
Staging policy
Applies to: @File.Impact = High
Allow | Full Control | if (@User.Company=Contoso) AND
(@User.Clearance =High)
Sample Staging Event (4818)
Demonstration: Evaluating and Managing DAC
In this demonstration, you will learn how to
evaluate and manage DAC
Lesson 4: Implementing Access Denied Assistance
•What Is Access Denied Assistance?
•Configuring Access Denied Assistance
•Demonstration: Implementing Access Denied
Assistance
What Is Access Denied Assistance?
Data Owner
User
File Server
On file server:
• Specify troubleshooting text for
access denied
• Specify owner’s email for share or
folder
Access attempt:
• User is denied access, sees
troubleshooting text or device-state
troubleshooting
• User can request access via email
Data owner or help desk:
• Owner receives user’s request
• Use effective permissions UI to
decide appropriate actions
• Can forward request to IT admin
Configuring Access Denied Assistance
•When implementing Access Denied Assistance:
• Define messages that users will receive when they
attempt to access resources
• Determine whether users should be able to send a
request for access
• Determine recipients for the access-request email
messages
• Consider target operating systems
•Use Group Policy to enable and configure Access
Denied Assistance
•Decide about the method for remediation
Demonstration: Implementing Access Denied Assistance
In this demonstration, your instructor will show you
how to configure and implement Access Denied
Assistance
Lesson 5: Implementing and Managing Work Folders
•What Are Work Folders?
•Configuring Work Folders
•Demonstration: Implementing Work Folders
What Are Work Folders?
•Work Folders enable users to access business data
securely at any location and on any device
•Work Folders are managed by administrators
•Currently supported on Windows 8.1 devices, and
support also is planned for iOS-based devices
Configuring Work Folders
To use Work Folders, you should:
• Have at least one Windows Server 2012 R2 file server
• Have at least one Windows Server 2012 R2 domain
controller
• Install Work Folders functionality on file server
• Provision a share where users’ data will be stored
• Run New Sync Share Wizard to create Work Folders
structure
• Configure clients to use Work Folders by using Group
Policy or manually
Demonstration: Implementing Work Folders
In this demonstration, you will learn how to
implement Work Folders
Lab: Implementing Secure Data Access
• Exercise 1: Preparing for DAC Deployment
• Exercise 2: Implementing DAC
• Exercise 3: Validating and Remediating DAC
• Exercise 4: Implementing Work Folders
Logon InformationVirtual machines: 20412C-LON-DC1,
20412C-LON-SVR1,
20412C-LON-SVR2,
20412C-LON-CL1,
20412C-LON-CL2
User name: Adatum\Administrator
Password: Pa$$w0rd
Estimated Time: 110 minutes
Lab Scenario
You are working as an administrator at A. Datum
Corporation. The company has a wide and complex file
server infrastructure. It manages access control to folder
shares by using NTFS file system ACLs, but in some cases,
that approach does not provide the desired results.
Most of the files used by departments are stored in shared
folders dedicated to specific departments, but confidential
documents sometimes appear in other shared folders.
Only members of the Research team should be able to
access Research team folders, and only Executive
department managers should be able to access highly
confidential documents.
Lab Scenario
The Support department reports that a high number of calls
are generated by users who cannot access resources. You
must implement a feature that helps users understand error
messages better and will enable them to request access
automatically.
Many users use personal devices such as tablets and
laptops to work from home and while at work. You have to
provide them with an efficient way to synchronize business
data on all the devices that they use.
Lab Review
•How do file classifications enhance the usage of
DAC?
•Can you implement DAC without central access
policy?