Enterprise Administration Guide › Managing Policies Centrally › How to Create and Deploy a Policy › Create and Store a Policy Version

Create and Store a Policy Version

Every policy you create and store on the DMS automatically gets a version number. The first time you store a policy it receives a version number "01". For example, the first time you store policy myPolicy, CA Access Control Enterprise Management creates a GPOLICY object named myPolicy and a POLICY object named myPolicy#01. Every time you store a policy that already exists on the DMS, the latest stored version of the policy is incremented by one to create the new policy version. For example, when you store a version of myPolicy for the twenty-eighth time, CA Access Control Enterprise Management creates a POLICY object named myPolicy#28.

Note: This procedure describes how you use CA Access Control Enterprise Management to create and store a policy version. This procedure does not apply to UNAB login and configuration policies.

To create and store a policy version

1. (Optional) Create a new script file with selang deployment commands.

   These are the commands necessary to construct the policy you want to deploy on endpoints in your enterprise.

   Important! Policy deployment does not support commands that set user passwords. Do not include such commands in your deployment script file. Native selang commands are supported but will not show in deviation reports.

2. (Optional) Create a new script file with selang undeployment commands.

   These are the commands necessary for undeploying (removing) the policy from endpoints in your enterprise.

3. In CA Access Control Enterprise Management click Policy Management, Policy task, and expand the Policy tree in the task menu on the left.

   The Policy tasks appear.

4. Click Create Policy.

   The Create Policy: Policy Search screen appears.

   Note: If you want to create a new version for an existing policy, click Modify Policy instead and search for the policy you want to modify.

5. Click OK.

   The Create Policy task page appears.

6. Complete the following fields in the dialog:

   Name

   Defines the name of the policy (GPOLICY object). This name has to be unique on the DMS (enforced) and in your enterprise (not enforced but you will not be able to deploy a policy to a host if a policy of the same name already exists).

   Description

   (Optional) Defines a business description (free text) of the policy. Use this field to record what this policy is for and any other information that helps you identify the policy.

7. Click the Policy Script tab and provide a deployment and an undeployment script, using one of the following methods:
   • Type the deployment and undeployment scripts into the appropriate fields.

     Use this option if you did not create a script file with the deployment commands.

   • Load the commands from an existing selang script file:
     1. Click Browse and locate the file that contains the selang script you want to use.
     2. Click Load to populate the script field with the contents of the file you selected.
8. (Optional) Provide a description for this policy version.

   Use this to provide specific information about the deployment scripts you use for this policy version.

9. (Optional) Select Finalize on Submit.

   This option specifies that the new policy version you create can be deployed. If you are not finished creating the deployment script, clear this option.

   Note: If you do not select this option, you can modify the deployment scripts without creating a new version of the policy. However, a non-finalized policy version cannot be deployed.

10. Click the Policy Dependency tab, then click Add.

    The Add Member dialog appears.

11. Select the policies you want to add as prerequisites to the policy, then click Select.

    The Add Member dialog closes and the policies you selected are added to the Members List for the policy you are creating.

12. Click Submit.

    The task is submitted and, if successful, a message indicating that a new policy version was created appears shortly afterwards. You follow a different process to create and deploy UNAB login and configuration policies.

Note: You can also use the policydeploy utility to perform this task. For more information about the policydeploy utility, see the Reference Guide.

More information:

policydeploy -store Function—Store a Policy

Manage UNAB Login Authorization

Configure a UNAB Host or Host Group