Enterprise Administration Guide › Deploying Sample and Best Practice Policies › Policy Deployment › How to Deploy Policies in a Staged Manner › Enable Sample Policy Enforcement

Enable Sample Policy Enforcement

By default, the sample policy scripts set Warning mode Warning Mode is a property that you can apply to a resource, and an option that you can apply to a class. If Warning mode is applied to a resource or a class and an access violates an access rule, CA ControlMinder writes an audit log entry with the return code W, but permits the access to the resource. If a class is in Warning mode, all the resources in that class are in Warning mode. for all policy rules. When you deploy the policy it is active but does not enforce its rules. After you familiarize yourself with the policy and customize it as required, you should be ready to enable the policy so that policy rules are enforced.

Note: This procedure explains how to enable policy enforcement for a single policy. For more information about how to enable policy enforcement for multiple policies after you perform system maintenance, see the Endpoint Administration Guide for your operating system.

To enable sample policy enforcement

1. Edit the policy script to change each instance of warning to warning-.

   When you run a rule that sets warning- for a resource or accessor, CA ControlMinder removes Warning mode from the resource or accessor.

2. Deploy the edited policy.

   Policy enforcement is enabled.

Example: Enable Windows Sample Policy Enforcement

The following snippet is from the sample JBoss policy for Windows. The policy is enabled because "warning" is changed to "warning-".

# Protect JBoss files
# -------------------

# Protect JBoss files in the application directory.
# These rules apply protection to files that are not protected by other rules.
editfile       ("<!JBOSS_HOME>\*") owner(nobody) defaccess(NONE) warning- comment ("AC Sample - JBoss base dir")
authorize FILE ("<!JBOSS_HOME>\*") id(ROL_JBOSS_ADMIN) access(ALL)        via(pgm("<!JBOSS_HOME>\bin\*"))
authorize FILE ("<!JBOSS_HOME>\*") id(jboss_pgm)       access(READ,CHDIR) via(pgm("<!JBOSS_HOME>\bin\*", "<!JBOSS_JAVA_PGM>"))

More information:

How to Perform System Maintenance