Endpoint Administration Guide for Windows › Scope of Administration Authority › Environmental Considerations › Windows Environment

Windows Environment

Valid in the native Windows environment

When CA Access Control is running, if you use selang to change a resource in the native Windows environment, the CA Access Control Agent changes the resource in the appropriate Windows repository. You do not need any additional Windows permissions to change the resource. This means that when users in CA Access Control with global or group authorization attributes perform selang commands in the native Windows environment, they have the same privileges and limits for Windows as they do for CA Access Control.

When CA Access Control is not running, if you use selang to change a resource in the native Windows environment, you must follow these rules:

• You must include the ‑l option in the selang command
• You must have the ADMIN attribute or sub administration privileges
• You must have sufficient Windows permissions to change the resource

  This restriction occurs because a selang process, not the CA Access Control Agent, changes the resource in the Windows repository.

For example, user Emma wants to use the chfile selang command in the native Windows environment to change the owner of the file C:\tmp.txt. If CA Access Control is running, Emma requires sufficient CA Access Control permissions to change the file owner, but does not require additional Windows permissions. If CA Access Control is not running, Emma requires both CA Access Control and Windows permissions to change the file owner.