Dynamic Access Control for File Server – Part 2

In the first part of this article, we created and enabled Dynamic Access control, configured claim types and also configured resource property list. In this part, we will continue with the configuration of Central Access Rule and configure Central Access Policy. Once Central Access Policy is configured, we need to create a new group policy to publish Central Access Rule and configure the shared folder with the necessary classifications. And then, finally verify the effective permission on the shared folder to make sure that only the right people have access to the shared folders.

Central Access Rule: These rules are set of conditions involving the above defined claims which provide access or deny permissions.

1. Connect to the Widows Server 2012 and connect to the Active Directory Administrative Center – > Dynamic Access Control
2. Right click on “Central Access Rules” -> new -> Central Access rule



3. Give the appropriate name on the “Create Access Rule” popup window -> Edit Target Resource -> Click on “Add condition”.
4. Select Target resource -> edit and update the resource condition as defined below.



5. Under Permissions in the Create Central Access Rule window, make sure that ‘Use following permissions as current permissions’ is checked and click ‘Edit’.
6. At ‘Permission Entry for Permission’ window -> click on ‘Select a principal’ -> search for
   ‘Authenticated Users’ -> click ‘OK’.
7. At Basic permission, Select Modify permission and keep other preexisting default permission
8. Click two times on ‘Add a condition’ and modify the condition as defined below.



9. Click on ‘OK’ at Permission entry for permission, then click on ‘OK’ at Advanced security settings for permission and click ‘OK’ at Central Access Rule Window to create a new Central Access Rule

Central Access Policy: It can be one or more central access rules applied to provide the necessary permissions. We need to add central access rule, before it is distributed to the file server.

1. Connect to Active Directory Administrative Center and select Dynamic Access control.
2. Right-click on Center pane and select new-> Central Access policy.
3. Provide the appropriate name and click on the ‘Add’ button to add the Central Access Rule which was just created.

Configure group policy to publish Central Access Rule: Configure group policy to publish the Center Access rule to the file server.

1. Connect to the Server Manager -> Start “Group policy management” console.
2. Expand the domain and right-click on “group policy objects” -> click new -> provide the name “GPO FileServer DAC” and click OK.



3. Edit the newly created GPO “GPO FileServer DAC”
4. Expand Computer Configuration -> Policies ->Windows Settings -> Security Settings -> File System -> right-click on Central Access policy -> click on Manage Central Access policies to mage the same.



5. Select the Central Access Policy from the list and click on the ‘Add’ button.



6. Click ‘OK’ at Central Access Policy and Click on ‘OK’ at Group policy manager editor window
7. Finally link the GPO to the domain. To do the same, right-click on the domain name ‘blue.com’ from the Group Policy Management console and select the newly created group policy object – “GPO Fileserver DAC”.



8. Click on ‘OK’ to apply the GPO and close the Group policy management console.

So, we are almost done with the configuration of Dynamic Access Control and GPO configuration. Now we need to configure ‘shared folders’ on the file server. Please see below steps:

1. Connect to the file server where File Server Resource Manager feature has been installed.
2. Right-click on the shared folder -> select properties -> click on ‘Classification’ tab.
3. Select ‘Country’ resource property in the top part of the window, and then select ‘India’ from the below.
4. Similarly, do the same for department. Select ‘Department’ and select ‘IT’ from the below value.



5. Select the ‘Security’ tab and click on ‘Advanced’ then select ‘Central policy’ tab.
6. Click ‘Change’ and select ‘Central Access Policy’ which we created from the drop-down menu and then click on ‘OK’ to apply the same.

Effective Access: Effective Access helps determine on who is provided with access and who is denied permission at the shared folder. Access permission is provided only if the condition matches the user property with country as India and department as IT. If the condition is not met, then the access permission is not granted. Below are the steps to validate the same:

1. Right-click on the shared folder and click on the ‘Security’ tab and click on ‘Advanced’
2. Select “Effective Access” tab and click on ‘select a user’ and search the required users.
3. Click on ‘View effective access’. If the user property matches the rule (Country = India and Department = IT), then it will display the list of permission provided to the user. Similarly, if the user property does not match the condition, then user access is denied. Below given snapshot is the example of denied access for the user Krishna kumar who does not meet the condition to access the shared folder.

With this, we are done with the configuration of Dynamic access control on the file server. Managing fileserver permission is very complex and securing some of the critical information is also challenging. It takes tons of administrative efforts when a new employee joins or his role changes within the organization to provide and remove necessary permissions on the file server. Dynamic access control simplifies the administration model and ascertains that the resource access is granted to the right person.

For auditing changes on windows file servers, you can use Lepide File Server Auditor software. This file server auditing tool keeps track of all changes made to files/folders, permissions, and shared resources on windows file servers.