The Security Policy pane allows ControlUp users within the same organization to delegate administrative tasks by configuring a security policy. The Security Policy is a collection of settings that determine which actions can be performed by each ControlUp role.
These security settings are assigned per role and may also be assigned differently for every folder in the organization tree, which enables segmenting your environment into distinct areas of responsibility.
Note: If you are using an on-premises version below 8.1.5, see Security Policy Pane - Versions Below 8.1.5.
By default, Local Admins are granted permission to perform all management actions available in ControlUp. This means that before a ControlUp user can perform a management action, ControlUp checks whether this user’s current Windows account is a member of the local Administrators group on the managed computer. If this validation fails, the management action is not completed.
Organization members are allowed to perform organization-wide actions but not management actions. For example, they can see the folder tree, create or modify folders, add or remove computers and connect to computers to see their performance information, however, they cannot perform any actions on the managed computers.
Configure Custom Roles and Restrict Actions
You can create custom roles for different teams or individuals on your network using the Manage Roles window. Active Directory users and groups from any domain or forest configured in ControlUp may be members of these custom groups.
Note: As a security precaution, you cannot modify the Security Policy if you have been disconnected from the Central Configuration Store for more than 24 hours. Should you wish to limit your organizations maximum offline period even further, please contact email@example.com
Organization Ownership and User Roles
Each ControlUp Organization has a designated owner record, which initially contains the identity of the user who first created the organization. The Organization Owner is a Windows user or group account that permanently possesses the ability to change permissions. Regardless of the changes to the Security Policy, the Organization Owner can always reset the Security Policy to the default settings.
You can view the current owner for your organization by clicking the Manage Roles button on the Home ribbon of the Security Policy pane:
Upon initial configuration of the ControlUp Security Policy, it is recommended to configure a restricted Active Directory group with more than one user as an organization owner. This enables you to reset the Security Policy to factory settings, even if the user who originally created the organization cannot be contacted any longer.
ControlUp evaluates administrative permissions according to your currently logged-on Windows account. Every ControlUp organization contains a list of roles that determine the permitted actions for each role member. Every ControlUp role must include at least one Windows user or security group. By default, the Security Policy includes the following user roles:
- Local Admins - Windows users with local administrative permissions on the managed machines.
- Organization Members - all authenticated ControlUp users in your organization.
- ControlUp Monitors - comes with no preset permissions.
- Automation Admins - comes with only with the Create Automated Actions permission.
- Helpdesk - comes preset with connection, credential, and viewing related actions.
- ControlUp Admins - preset with all Management Actions.
These default roles cannot be deleted or have their membership modified using ControlUp, however each role can be granted some or all of the Management Actions, depending on the type of role.
Note: Aside from the above built-in roles, new roles can be created as described below.
The Security Policy pane features a permissions grid, which contains a column for every role and a row for every management action. The Management Actions contain various actions within them, which can be granted separately. Click the + next to a Management Action to display the actions within it.
New roles may be created by a Roles Manager, which is a built-in permission initially granted to the organization’s owner. Upon initial configuration of the ControlUp Security Policy, it is recommended to configure a restricted Active Directory group as a role manager.
To create a custom ControlUp role:
- Click Manage Roles screen from the Home ribbon in the Security Policy pane, and the Security Settings popup appears.
- Click Add New Role and the Add New Role popup appears.
Note: You must be logged in as a Roles Manager. If not, the button is grayed out and not clickable.
- Enter a name in the Role Name text box and click Add Users/Groups and the Account Browse popup appears.
- Select the appropriate users or groups from Active Directory domains available and click OK, and you are returned to the Add New Role popup with the selected roles and groups.
Note: By default, ControlUp only displays group accounts in the search box. In order to display individual user accounts, please select the Users and Groups radio button.
- Click OK, and you are returned tot he Security Settings popup.
- Click Apply, and the new role is created and shown in the Security Policy pane.
Permissions for Management Actions
The rows in the permissions grid correspond to management actions. For more details regarding particular permissions, refer to the Action Permissions section below.
Every ControlUp user may be either allowed or denied access to a management action, depending on their role membership and the location of the managed resource in the organization tree. Every cell in the permissions grid may be in one of the following states:
Allow – users in the current role are allowed to run the action, unless they are also members of another role which is configured with a Deny set.
Not Set (or blank) – users in the current role are not allowed to run the action, unless permitted by another role.
Deny – users in the current role are never allowed to run the action.
N/A - the said action does not apply to the role. This cannot be changed.
For example, by default, a member of the Local Admins is allowed to perform all computer actions on all machines in the organization. This permission is granted since the Local Admins role has an Allow permission on all computer actions for the root folder, and all subfolders inherit this permission.
IMPORTANT: Once the changes have been made, you MUST click Apply on the Home ribbon of the Security Policy pane to submit your changes to the Central Configuration Store. Until this button is clicked, any changes to the Security Policy are not applied.
Security Policy Inheritance
When a ControlUp Organization is first created, the default Security Policy is configured on the root folder of the organization, which bears the organization’s name.
Configuring Security Policy for Subfolders
By default, all of the subfolders under the root folder in your organization tree inherit their Security Policy from the root folder. A marked Inherit checkbox near each permission in the grid signifies this. If you would like the Security Policy of a subfolder to be different from its parent folder, you must uncheck this checkbox for the selected permission row.
Once the Inherit checkbox is unchecked, a blue exclamation point icon on the folder, indicating that part of its Security Policy is no longer inherited from the parent folder:
In the above example, the Chat permission for the CU Lab”folder is not inherited from its parent folder, hence the blue exclamation point icon n the folder in the organization tree.
In order to grant ControlUp user permissions for management actions, you need the following details:
- Folder name – the name of a folder in the organization tree, which contains resources you would like to grant the permission. Select the root folder if you would like to grant permissions on machines in the entire organization, otherwise select a subfolder (e.g. Workstations)
Note: You may also grant permissions on individual machines by selecting them in the organization tree. However, for manageability reasons, it is recommended that you grant permissions on folders only.
- Role name – the name of a built-in or custom role to which the user belongs. (e.g. Help Desk Users).
- Action name – the name of the management action which you would like to permit (e.g. Refresh Machine Policy). You can also grant permissions on an entire action group (e.g. Run Computer Actions).
Once you have obtained the details above, click on the desired folder name in the organization tree on the left and locate the row in the table with the desired action name in the row name.
If the Inherit checkbox for that row is selected, deselect it. If not, click on the cell with the desired Role name in the column header and select Allow from the drop-down list.
Click Apply on the Home ribbon to save the changes. As a result of the operations in the example above, members of the Helpdesk role have the ability to run the Refresh Group Policy action on machines located in the Workstation folder.
Note: As with standard Windows permissions, Deny permissions always override Allow permissions. This means that any Allow permission applies only if the affected user is not a member of any other role which has a Deny permission entry in the same row.
ControlUp’s Security Policy includes two approaches of preventing users from running management actions:
- Implicit Deny – not granting permissions in the first place, or setting the permission to Not Set.
- Explicit Deny – settings the permission to Deny.
The difference between these two methods is that Explicit Deny overrides any other permission, and the affected users will always be denied access to the action, even if they are members in additional roles that allow access to the same action. Implicit Deny (or Not Set) means that users are not allowed to run the management action, unless permitted to another role they are also a member of.
Note: It is considered best practice to use the Explicit Deny approach only if you need to configure an exception for an existing rule.
For example, to enable all Local Admins to restart workstations, except for Helpdesk users, an Explicit Deny is recommended.
However, to ban Local Admins from restarting machines, it is recommenced to use an implicit Deny (Not Set) permission.
There are several methods of restoring the default Security Policy in ControlUp, depending on your needs:
- If there’s a single permission entry currently set on a folder and you would like to reset this permission to inherit its parent folder settings, check the Inherit checkbox next to that permission and click Apply on the Home ribbon.
- If you have a folder with a complete Security Policy that you would like to extend to all its subfolders, select this folder and click Reset Inheritance on the Home ribbon, and then click Apply on the Home ribbon. You will need an Allow setting in the Change Permissions row for the selected folder in order to be able to perform this action.
- If your entire Security Policy is mis-configured and you would like to reset it to factory defaults, click Reset Defaults on the Home ribbon. Please note that this operation will also remove any custom user roles you have created. In order to be able to perform this operation, your user account must be the Organization’s Owner OR a Roles Manager with sufficient permissions to change permissions on the root folder.
This section describes all the permissions configurable in ControlUp.
Perform Organization-wide Actions
These actions are performed on objects in ControlUp’s organization tree only, without affecting managed resources, such as machines or user sessions. They can also be referred to as 'tree actions' since they are executed using the ControlUp Console and include the ability to add or remove machines, create and arrange folders, and change permissions.
Change Permissions – modifies the Security Policy for the current folder or machine.
Note: The Organization Owner is always allowed to change permissions, regardless of other settings.
Manage ControlUp Insights Access Settings – modifies all settings on the Insights Access tab of the Settings window.
Manage User Permissions to ControlUp Insights – modifies the per-user permissions to access ControlUp Insights in the Organization Properties window.
Manage Data Upload Settings – modifies all settings on the Data Upload tab of the Settings window.
Edit Stress Settings – modifies the Stress Level settings for the current folder.
Manage Branch mapping settings - configures the subnet-to-name lookup table on the Branch Mapping tab of the Settings window.
Configure Incident Triggers – to view and change the configurations of incident triggers in the organization.
Add Computer – adds new managed machines to the current folder.
Add Folder – adds new folders to the current folder.
Change Folder Description – modifies the description field for a folder.
Remove Computer – removes machines from the current folder and removes the current computer.
Remove Folder – removes the current folder.
Run Shared Script-based Actions – globally permits execution of Script-based actions. In addition, the user needs an explicit permission to perform the Script-based Action of choice (see Script-based Actions below).
Run Draft Script-based Actions – permits the creation of new Script-based actions (drafts).
Download and Share Script-based Actions – permits downloading SBAs shared by the community and sharing user-created SBAs with the community.
Manage Script-based Actions – permits managing Script-based Actions for your organization.
View Folder – see the folder in the organization tree. The folder will be invisible to users lacking this permission (except for the root folder, which stays visible).
Launch Controllers – switch to the Controllers pane. Without this permission, users cannot launch any controllers. This is a user interface restriction, which can be configured on the root folder only.
View Incidents – uses the Incidents Pane to display entries recorded in the organizational incidents database. Applies to the entire organization and cannot be changed for subfolders.
View Events – uses the Events Pane to display event entries recorded on the managed machines. Applies to the entire organization and cannot be changed for subfolders.
View Hypervisors – to view all hypervisor-related objects in the organization (VMs, Hosts, and hypervisor connections). Applies to the entire organization and cannot be changed for subfolders.
Manage Hypervisors – to create, edit and delete hypervisor connections in the organization. Applies to the entire organization and cannot be changed for subfolders.
Manage XenDesktop Sites - to create, edit and delete XenDesktop site connections in this organization.
Manage NetScaler Appliances - to create, edit and delete NetScaler connections in this organization.
Manage Application Load Time - configure the parameters that ControlUp Agents use when measuring application load times.
Manage Browser URL - configure the parameters that ControlUp Agents use to monitor URLs of browser processes.
Connect to Data Source - collects data from an external data source, such as a Hypervisor, XenDesktop site, public cloud, or NetScaler appliance.
Manage Shared Credentials - to create, edit and delete shared credentials in the organization.
Use Shared Credentials - connects to an organization tree view connection with Shared Credentials.
Run Computer Actions
These actions are performed on the managed machines via the ControlUp Agent. Actions that have an asterisk after the action name are dependent on your currently logged-on Windows user’s rights because they use RPC to access the remote machines.
Monitor Computer – to connect to the ControlUp Agent and start gathering performance data.
Change Computer Description – to edit the Description field for a machine in ControlUp.
Event Viewer on Remote Computer – to open a new Event Viewer (eventvwr) window, attempting to connect to the remote machine.
RDP to Computer – to switch to the Remote Desktop pane and establish an RDP session to the managed computer.
The rest of the Computer Actions are performed using the ControlUp Agent on the managed machines. A user that was granted access to agent-based actions is permitted to instruct the ControlUp Agent on the managed machines to perform these actions. The ControlUp Agent on a managed machine will use its Local System account to perform the action, unless otherwise specified. For example, when using the “Processes > Run as…” action, the ControlUp user can execute any process accessible by the Local System account. As a side effect, you cannot run processes from the network unless you specify valid credentials, since Local System cannot access network locations.
For a full list of agent-based actions, refer to the My Organization Pane article.
Run Session Actions
Actions in this group are invoked using the Sessions view and performed on the managed machines using the ControlUp Agent.
A user who is granted access to these actions can execute them only on user sessions hosted on managed machines affected by the Security Policy you are currently editing. Note the caption on top of the permissions grid that reads “Security Policy for …”
For more information regarding these actions, refer to the My Organization Pane article.
Run Processes Actions
Actions in this group act upon processes on managed machines and are executed using the ControlUp Agent.
A user granted access to these actions can execute them only on processes running on managed machines affected by the Security Policy you are currently editing. Note the caption on top of the permissions grid that reads “Security Policy for …”
For more information regarding these actions, refer to the My Organization Pane article.