Dynamic Access Control: Beyond Classic NTFS Permissions

Abstract

If you've ever found yourself jumping through a series of ever-smaller hoops in order to design security groups and folder hierarchies that let you control file system access the way you want, Dynamic Access Control could be an eminently useful feature. The built-in Active Directory attributes and resource properties are a great start, and eventually, you can create your own and build access control rules that match your needs exactly. The promise of the File Classification Infrastructure that got our attention back in 2009 has evolved into a practical reality for building almost any access control scheme you can dream up.

Sample

Dynamic Access Control in Windows Server lets you manage access to documents in ways that go beyond classic NTFS file system permissions. For example, if you want to allow Engineering department users in your Denver office read-only access to files relating to the Wind Turbine Project, Dynamic Access Control can do the job.

I. Overview of Dynamic Access Control

File Classification Infrastructure (FCI) is a way to permit organizations to use (and create) file properties, file property rules, and file management operations based on those rules.

Administrators gained access to FCI in Server 2008 R2 through a new node in the File Server Resource Manager (FSRM) titled “Classification Management.” FCI offered a new way of backing up, securing, restoring, archiving, and reporting on files.

FCI felt a little half-baked when introduced — interesting conceptually, but short on tools and limited in its application. Starting with Server 2012, however, Windows Server has taken classification management to a new level, focusing on the access control aspect and giving it a new acronym in the process: Dynamic Access Control (DAC).

In this paper, I’m going to illustrate the “nuts and bolts” by walking through a sample scenario:

Engineers in the Denver office aren’t working on my company’s Wind Turbine project anymore, so I don’t want them to be able to modify project documents, just read them.

With DAC, I can accomplish this without using security groups at all!

A. Limitations of NTFS Permissions

NTFS permissions let you restrict access to files by using two criteria:

• User identity (a capability rarely used in practice)
• Security group membership

As useful as group-based access control is, particularly given the administrative conveniences of nesting groups within other groups (“role groups” within “rule groups”), sometimes organizations would rather control file access on the basis of other criteria: department, location, project, and so forth. For some organizations, this may come across as a drawback.

In the past, we have tried to fit such criteria into the security group architecture, with results ranging from partial success to epic awkwardness. Share-level permissions don’t help much, as these, too, are based on user and group identities.

B. How DAC Provides New Flexibility

DAC provides new flexibility by building on the FCI concept:

• DAC uses FCI to control resource access, instead of just file management operations.
• DAC leverages Active Directory user and computer attributes, called “claims” in the context of DAC.
• DAC lets us create file attributes (“classification properties” in Server 2008 R2 lingo, “resource properties” in DAC-speak) of our own design, or use new built-in ones Microsoft has provided.
• DAC offers the ability to build custom rules, and it uses Group Policy to make those rules available throughout the domain.
• Finally, DAC provides a mechanism for providing helpful information to users who have been denied access based on one or more of those rules.

Note that DAC does not supersede NTFS permissions or share permissions; it just provides another type of access control. Think of DAC as another hurdle the user must jump over in order to access a file.

Also, note that you can use DAC with Windows security groups without taking advantage of AD user and device attributes. You would simply create central access rules and policies that leverage file resource properties, ignoring user and device claims.

This would not be a bad way to ease into using DAC in an organization before taking on the additional complexity of rules and policies that incorporate user and device claims as well as file resource properties. You may be able to reduce the number of security groups you need or reduce the number of nesting levels.