Security Policy Overview

The following article explains how to use the Security Policy pane in ControlUp Real-Time Hybrid Cloud. If you use ControlUp On-premises (COP), see here.

ControlUp users within the same organization can use the Security Policy pane to delegate administrative tasks by configuring a security policy. The Security Policy is a collection of settings that determine which actions can be performed by each ControlUp role.

You assign security settings per role, and can also assign them differently for each folder in the organization tree, enabling you to segment your environment into distinct areas of responsibility.

To learn more about the Security Policy, watch our video.

To access the Security Policy pane, click the Security Policy tab at the bottom of the Real-Time DX Console.

Organization Ownership and User Roles

Each ControlUp organization has a designated owner record, which initially contains the identity of the user who first created the organization, known as the Organization Owner. The Organization Owner is a Windows user or group account that has the permanent ability to change permissions. Regardless of any changes to the Security Policy, the Organization Owner can always reset the Security Policy to the default settings.

To view your current Organization Owner, in the Security Policy pane, click Manage Roles in the Home ribbon, and the Security Setting open.

During initial configuration of the ControlUp Security Policy, it is recommended to configure a restricted Active Directory group with more than one user as an Organization Owner. This enables you to reset the Security Policy to factory settings, even if the user who originally created the organization can no longer be contacted.

ControlUp evaluates administrative permissions according to your currently logged-on Windows account. Every ControlUp organization contains a list of roles that determine the permitted actions for each role member. Every ControlUp role must include at least one Windows user or security group.

By default, the Security Policy includes the following user roles:

You can't delete these default roles or modify their membership using ControlUp. However, you can grant each role some or all of the Management Actions, depending on the type of role.

The Security Policy pane permissions grid contains a column for every role and a row for every Management Action. Each Management Action includes a number of action elements, which you can grant permissions to individually. Click + next to a Management Action to display its action elements:

For versions 9.0.5 and higher, you can create new roles with SAML SSO groups. For details, see here.
For versions 9.0 and lower, you can create new roles in the Roles Manager, which is a built-in permission initially granted to the organization’s owner. For details, see here.

Configure Custom Roles and Restrict Actions

You can create custom roles for different teams or individuals on your network using the Manage Roles Collection window. Active Directory users and groups from any domain or forest configured in ControlUp can be members of these custom groups.

To create a custom ControlUp role:

1. Click Manage Roles. The Security Settings popup appears:
   

2. Click Add New Role. The Add New Role popup appears.

   

   Note

   You must be logged in as a Roles Manager.  If not, the Add New Role button won't display.

3. Enter a name in the Role Name text box and click  Add Users/Groups. The Account Browser popup appears. 

4. Select the appropriate users or groups from Active Directory domains available and click OK.

   

   You are returned to the Add New Role popup with the selected roles and groups.
   

5. Click OK and you return to Security Settings.

6. Click Apply and the new role is created and appears in the Security Policy pane.

Default Permissions

By default, Local Admins are granted permission to perform all Management Actions available in ControlUp. This means that before a user can perform a Management Action, ControlUp checks whether this user’s current Windows account is a member of the local Administrators group on the managed machine. If this validation fails, the Management Action isn't completed.

Organization Members are allowed to perform organization-wide actions, but not Management Actions. For example, they can see the folder tree, create or modify folders, add or remove machines and connect to machines to see their performance information. However, they can't perform any actions on the managed machines.

Permissions for Management Actions

The rows in the permissions grid correspond to Management Actions. For more details regarding particular permissions, see Action Permissions below.

Every ControlUp user can be either allowed or denied access to a Management Action, depending on their role membership and the location of the managed resource in the organization tree. Each cell in the permissions grid can be in one of the following states:

Allow. Users in the current role are allowed to run the action unless they are also members of another role that is configured with a Deny set.
Not Set (or blank). Users in the current role aren't allowed to run the action unless permitted by another role.
Deny. Users in the current role are never allowed to run the action.
N/A. The said action doesn't apply to the role. This can't be changed.

For example, by default, a member of the Local Admins is allowed to perform all machine actions on all machines in the organization. This permission is granted since the Local Admins role has an Allow permission on all machine actions for the root folder, and all subfolders inherit this permission.

Security Policy Inheritance

When a ControlUp organization is first created, the default Security Policy is configured on the root folder of the organization, which has the organization’s name.

Configuring Security Policy for Subfolders

By default, all of the subfolders under the root folder in your organization tree inherit their Security Policy from the root folder. A checked Inherit checkbox near each permission in the grid signifies this. If you require the Security Policy of a subfolder to be different from its parent folder, you must uncheck this checkbox for the selected permission row.

After you uncheck the Inherit checkbox, a blue exclamation point icon appears on the subfolder, indicating that part of its Security Policy is no longer inherited from its parent folder:

In the above example, the Enable Maintenance Mode Management Action for the "Hypervisors” folder isn't inherited from its parent folder, hence the blue exclamation point icon.

Granting Permissions

To grant user permissions for Management Actions, you require the following details:

1. Folder name. The name of a folder in the organization tree, which contains resources you need to grant permission. Select the root folder if you need to grant permissions on machines in the entire organization, otherwise select a subfolder (e.g. Workstations).

   Note

   You can also grant permissions on individual machines by selecting them in the organization tree. However, for manageability reasons, it is recommended that you grant permissions on folders only.

2. Role name. The name of a built-in or custom role to which the user belongs. For example Help Desk Users.

3. Action name. The name of the Management Action which you would like to permit (e.g. Refresh Machine Policy). You can also grant permissions on an entire action group (e.g. Run machine Actions).
   

4. After you provide the details above, click on the required folder name in the organization tree on the left and locate the row in the table with the required action name in the row name.

5. If the Inherit checkbox for that row is selected, deselect it. If not, click on the cell with the required Role name in the column header and select Allow from the drop-down list.

6. Click Apply on the Home ribbon to save the changes. Members of the Helpdesk role now have the ability to run the Refresh Group Policy action on machines located in the Workstation folder.

Denying Permissions

ControlUp’s Security Policy includes two approaches of preventing users from running management actions:

1. Implicit Deny. Not granting permissions in the first place, or setting the permission to Not Set.

2. Explicit Deny. Setting the permission to Deny.

The difference between these two methods is that Explicit Deny overrides any other permission, and the affected users will always be denied access to the action, even if they are members in additional roles that allow access to the same action. Implicit Deny (or Not Set) means that users aren't allowed to run the Management Action, unless permitted to another role they are also a member of.

Resetting Inheritance

There are several methods of restoring the default Security Policy in ControlUp, depending on your needs:

• If there’s a single permission entry currently set on a folder and you need to reset this permission to inherit its parent folder settings, select the Inherit checkbox next to that permission and click Apply on the Home ribbon.

• If you have a folder with a complete Security Policy that you would like to extend to all its subfolders, select this folder and click Reset Inheritance on the Home ribbon, and then click Apply. You will need an Allow setting in the Change Permissions row for the selected folder to perform this action.

• If your entire Security Policy is misconfigured and you would like to reset it to factory defaults, click Reset Defaults on the Home ribbon. Note that this operation will also remove any custom user roles you have created. To perform this operation, your user account must be either the Organization’s Owner or a Roles Manager with sufficient permissions to change permissions on the root folder.

Action Permissions

This section describes all the permissions configurable in ControlUp.

Perform Organization-wide Actions

These actions are performed on objects in the ControlUp’s organization tree only, without affecting managed resources, such as machines or user sessions. They can also be referred to as 'tree actions' since they are executed using the ControlUp Real-Time DX Console and include the ability to add or remove machines, create and arrange folders, and change permissions.

Run Application Actions

Citrix Virtual Apps and Desktops

VMware Horizon

Run Folder Actions

Citrix Virtual Apps and Desktops

Script Actions

View all installed Script-based Actions (SBA) in your environment. Here you can define which user role can execute a certain script.

VMware Horizon

Run Host Actions

Run Machines Actions

These actions are performed on the managed machines via the ControlUp Agent.

Azure Cloud

Perform Azure related actions.

Azure Virtual Desktop

Citrix Virtual Apps and Desktops

Perform Citrix Virtual Apps and Desktops related actions.

ControlUp Agent Management

These actions define how the user role can interact with the ControlUp Agent. All actions require RPC access and valid administrative credentials on the target machines.

File System

Perform all file-system related actions in this category.

Group Policy

Perform all group policy-related actions in this category.

Installed Software

View information about the software package currently installed.

Power Management

Perform all power management tasks in this category.

Processes

Execute processes on the managed machine.

Registry

Perform all registry-related actions in this category.

Services

Perform all service-related actions in this category.

VM Power Management

Control power management of virtual machines.

VMware Horizon

Perform all Omnissa Horizon (formerly VMware Horizon) related actions in this category.

Run Processes Actions

Perform all of the actions in this category on process objects in the current container. A user granted access to these actions can execute them only on processes running on managed machines affected by the Security Policy you are currently editing. See “Security Policy for folder: …” on the top of the permissions grid.
For more information regarding these actions,  see My Organization Pane.

CPU Throttling

Run Session Actions

Actions in this group are invoked using the Sessions view and performed on the managed machines using the ControlUp Agent. Users granted access to these actions can execute them only on user sessions hosted on managed machines affected by the Security Policy that you are currently editing. See “Security Policy for folder: …” on the top of the permissions grid.
For more information regarding these actions, see  My Organization Pane.

Get Session Screenshot

Retrieves the active user session desktop screenshot.

Group Policy

Perform all Group Policy related actions in this category.

Installed Software

View information about software packaged currently installed.

Processes

Execute processes on the managed machine

Registry

Perform all registry-related actions in this category.

Remote Desktop Services

Perform all Terminal Services - related actions in this category.

VMware Horizon

Agent-based Actions

You can perform the rest of the machine actions with the ControlUp Agent on the managed machines. A user must be granted access to agent-based actions to perform these actions on the managed machines. Agents on a managed machines use its Local System account to perform the action, unless otherwise specified.

For example, when using the Processes > Run as… action, the user can execute any process accessible by the Local System account. As a result, you can't run processes from the network unless you specify valid credentials, since the Local System can't access network locations.
For a full list of agent-based actions, see  My Organization Pane.