Security Policy Overview

The Security Policy pane allows ControlUp users within the same organization to delegate administrative tasks by configuring a security policy. The Security Policy is a collection of settings that determine which actions can be performed by each ControlUp role.

These security settings are assigned per role and may also be assigned differently for every folder in the organization tree, which enables segmenting your environment into distinct areas of responsibility.

The Security Policy Pane is accessible by clicking on the Security Policy tab at the bottom of the Real-Time DX Console.

Default Permissions

By default, Local Admins are granted permission to perform all management actions available in ControlUp. This means that before a ControlUp user can perform a management action, ControlUp checks whether this user’s current Windows account is a member of the local Administrators group on the managed computer. If this validation fails, the management action is not completed.

Organization members are allowed to perform organization-wide actions but not management actions. For example, they can see the folder tree, create or modify folders, add or remove computers and connect to computers to see their performance information, however, they cannot perform any actions on the managed computers.

Configure Custom Roles and Restrict Actions

You can create custom roles for different teams or individuals on your network using the Manage Roles window. Active Directory users and groups from any domain or forest configured in ControlUp may be members of these custom groups.

Organization Ownership and User Roles

Each ControlUp Organization has a designated owner record, which initially contains the identity of the user who first created the organization. The Organization Owner is a Windows user or group account that has the permanent ability to change permissions. Regardless of the changes to the Security Policy, the Organization Owner can always reset the Security Policy to the default settings.

You can view the current owner for your organization by clicking Manage Roles button in the Home ribbon of the Security Policy pane:

Upon initial configuration of the ControlUp Security Policy, it is recommended to configure a restricted Active Directory group with more than one user as an Organization owner. This enables you to reset the Security Policy to factory settings, even if the user who originally created the Organization cannot be contacted any longer.

ControlUp evaluates administrative permissions according to your currently logged-on Windows account. Every ControlUp organization contains a list of roles that determine the permitted actions for each role member. Every ControlUp role must include at least one Windows user or security group. By default, the Security Policy includes the following user roles:

These default roles cannot be deleted or have their membership modified using ControlUp, however, each role can be granted some or all of the Management Actions, depending on the type of role.

The Security Policy pane features a permissions grid, which contains a column for every role and a row for every management action. Each management action includes a number of action elements, which can have permissions granted for them individually. Click the + next to a Management Action to display its action elements.

You can create new roles in the Roles Manager, which is a built-in permission initially granted to the organization’s owner. Upon initial configuration of the ControlUp Security Policy, we recommend to configure a restricted Active Directory group as a role manager.

To create a custom ControlUp role:

1. Click the Manage Roles screen from the Home ribbon in the Security Policy pane, and the Security Settings popup appears.
   

2. Click Add New Role and the Add New Role popup appears.

   Note

   You must be logged in as a Roles Manager. If not, the button is grayed out and not clickable.

3. Enter a name in the Role Name text box and click Add Users/Groups and the Account Browse popup appears.
   

4. Select the appropriate users or groups from Active Directory domains available and click OK, and you are returned to the Add New Role popup with the selected roles and groups.
   

5. Click OK and you are returned to the Security Settings popup.
6. Click Apply and the new role is created and shown in the Security Policy pane.

Permissions for Management Actions

The rows in the permissions grid correspond to management actions. For more details regarding particular permissions, refer to the Action Permissions section below.

Every ControlUp user may be either allowed or denied access to a management action, depending on their role membership and the location of the managed resource in the organization tree. Every cell in the permissions grid may be in one of the following states:

Allow – users in the current role are allowed to run the action unless they are also members of another role that is configured with a Deny set.
Not Set (or blank) – users in the current role are not allowed to run the action unless permitted by another role.
Deny – users in the current role are never allowed to run the action.
N/A - the said action does not apply to the role. This cannot be changed.

For example, by default, a member of the Local Admins is allowed to perform all computer actions on all machines in the organization. This permission is granted since the Local Admins role has an Allow permission on all computer actions for the root folder, and all subfolders inherit this permission.

Security Policy Inheritance

When a ControlUp organization is first created, the default Security Policy is configured on the root folder of the organization, which bears the organization’s name.

Configuring Security Policy for Subfolders

By default, all of the subfolders under the root folder in your organization tree inherit their Security Policy from the root folder. A marked Inherit checkbox near each permission in the grid signifies this. If you would like the Security Policy of a subfolder to be different from its parent folder, you must uncheck this checkbox for the selected permission row.

Once the Inherit checkbox is unchecked, a blue exclamation point icon on the folder, indicating that part of its Security Policy is no longer inherited from the parent folder:

In the above example, the Enable Maintenance Mode management action for the "Hypervisors” folder is not inherited from its parent folder, hence the blue exclamation point icon in the folder in the organization tree.

Granting Permissions

To grant ControlUp user permissions for management actions, you need the following details:

1. Folder name. The name of a folder in the organization tree, which contains resources you would like to grant permission. Select the root folder if you would like to grant permissions on machines in the entire organization, otherwise select a subfolder (e.g. Workstations)

   Note

   You may also grant permissions on individual machines by selecting them in the organization tree. However, for manageability reasons, it is recommended that you grant permissions on folders only.

2. Role name. The name of a built-in or custom role to which the user belongs. For example Help Desk Users.

3. Action name. The name of the management action which you would like to permit (e.g. Refresh Machine Policy). You can also grant permissions on an entire action group (e.g. Run Computer Actions).
   

Once you have obtained the details above, click on the desired folder name in the organization tree on the left and locate the row in the table with the desired action name in the row name.

If the Inherit checkbox for that row is selected, deselect it. If not, click on the cell with the desired Role name in the column header and select Allow from the drop-down list.

Click Apply on the Home ribbon to save the changes. As a result of the operations in the example above, members of the Helpdesk role have the ability to run the Refresh Group Policy action on machines located in the Workstation folder.

Denying Permissions

ControlUp’s Security Policy includes two approaches of preventing users from running management actions:

1. Implicit Deny. Not granting permissions in the first place, or setting the permission to Not Set.

2. Explicit Deny. Settings the permission to Deny.

The difference between these two methods is that Explicit Deny overrides any other permission, and the affected users will always be denied access to the action, even if they are members in additional roles that allow access to the same action. Implicit Deny (or Not Set) means that users are not allowed to run the management action unless permitted to another role they are also a member of.

Resetting Inheritance

There are several methods of restoring the default Security Policy in ControlUp, depending on your needs:

• If there’s a single permission entry currently set on a folder and you would like to reset this permission to inherit its parent folder settings, check the Inherit checkbox next to that permission and click Apply on the Home ribbon.
• If you have a folder with a complete Security Policy that you would like to extend to all its subfolders, select this folder and click Reset Inheritance on the Home ribbon, and then click Apply on the Home ribbon. You will need an Allow setting in the Change Permissions row for the selected folder in order to be able to perform this action.
• If your entire Security Policy is misconfigured and you would like to reset it to factory defaults, click Reset Defaults on the Home ribbon. Note that this operation will also remove any custom user roles you have created. In order to be able to perform this operation, your user account must be the Organization’s Owner OR a Roles Manager with sufficient permissions to change permissions on the root folder.

Action Permissions

This section describes all the permissions configurable in ControlUp.

Perform Organization-wide Actions

These actions are performed on objects in the ControlUp’s organization tree only, without affecting managed resources, such as machines or user sessions. They can also be referred to as 'tree actions' since they are executed using the ControlUp Real-Time Console and include the ability to add or remove machines, create and arrange folders, and change permissions.

Run Host Actions

Run Machine Actions

These actions are performed on the managed machines via the ControlUp Agent. Actions that have an asterisk after the action name are dependent on your currently logged-on Windows user’s rights because they use RPC to access the remote machines.

ControlUp Agent Management

These actions define how the user role can interact with the ControlUp Agent. All actions require RPC access and valid administrative credentials on the target machines.

VM Power Management

File System

Group Policy

Installed Software

Processes

Power Management

Registry

Services

Citrix Virtual Apps and Desktops

VMware Horizon

Azure Cloud

Script Actions

In this category, you see all installed Script actions in your environment. In here you can define which user role can execute a certain script.

Agent-based Actions

The rest of the Computer Actions are performed using the ControlUp Agent on the managed machines. A user that was granted access to agent-based actions is permitted to instruct the ControlUp Agent on the managed machines to perform these actions. The ControlUp Agent on a managed machine will use its Local System account to perform the action unless otherwise specified. For example, when using the “Processes > Run as…” action, the ControlUp user can execute any process accessible by the Local System account. As a side effect, you cannot run processes from the network unless you specify valid credentials since Local System cannot access network locations.
For a full list of agent-based actions, refer to the My Organization Pane article.

Run Session Actions

Actions in this group are invoked using the Sessions view and performed on the managed machines using the ControlUp Agent.
A user who is granted access to these actions can execute them only on user sessions hosted on managed machines affected by the Security Policy you are currently editing. Note the caption on top of the permissions grid that reads “Security Policy for …”
For more information regarding these actions, refer to the My Organization Pane article.

Get Session Screenshot

Group Policy

Installed Software

Processes

Registry

Remote Desktop Services

VMware Horizon

Run Folder Actions

Citrix Virtual Apps and Desktops

VMware Horizon

Run Processes Actions

Actions in this group act upon processes on managed machines and are executed using the ControlUp Agent.
A user granted access to these actions can execute them only on processes running on managed machines affected by the Security Policy you are currently editing. Note the caption on top of the permissions grid that reads “Security Policy for …”
For more information regarding these actions, refer to the My Organization Pane article.

CPU Throttling

Run Application Actions

Citrix Virtual Apps and Desktops

VMware Horizon