Enterprise Administration Guide › Deploying Sample and Best Practice Policies › Policy Deployment › How to Deploy Policies in a Staged Manner

How to Deploy Policies in a Staged Manner

When you deploy your policy, there are several actions you can take to ensure that the policy deploys and performs as expected and without errors. After you have prepared your endpoint for policy deployment, we recommend that you proceed with a staged policy deployment.

We recommend that you deploy the policies first in a test environment and after you have adjusted the policies as required, deploy the policies in the production environment.

To deploy policies in a staged manner:

1. Deploy the policy in Warning mode Warning Mode is a property that you can apply to a resource, and an option that you can apply to a class. If Warning mode is applied to a resource or a class and an access violates an access rule, CA Access Control writes an audit log entry with the return code W, but permits the access to the resource. If a class is in Warning mode, all the resources in that class are in Warning mode.

   The policy is now active but does not enforce its rules. You can then examine the audit log to preview the results of your intended policy before you put that policy into effect.

   Note: By default, the sample policies' scripts set Warning mode for all policy rules.

2. Review the CA Access Control audit log for warning messages

   After you deploy the policy, any policy breaches show up in the audit log as warnings (assuming your policy rules use Warning mode).

3. Use the system in real scenarios and analyze the audit log again

   To test your policy effectively you can perform regular operating procedures on the computer (log in, start and stop services and applications, and so on). You can then analyze the audit log again to see if any new warnings appear.

4. Adjust the policy as required

   Using the information you gathered from the audit log, you can adjust the policy to account for expected use in your environment.

5. Remove Warning mode to enable the policy

   Once you are confident your policy is ready to enforce rules in your production environment, you can remove Warning mode to enable it.

   The policy is now enforced.

Note: If you want to make changes to a policy, you should first disable policy enforcement (use Warning mode), make the changes to the policy and then reactivate it when you are confident the changes are working as desired.

More information:

Policy Deployment

How to Customize the Policies for Your Environment

Enable Sample Policy Enforcement

Warning Mode