Endpoint Administration Guide for UNIX › Scope of Administration Authority › Environmental Considerations › Windows Environment

Windows Environment

Valid in the native Windows environment

When CA ControlMinder is running, if you use selang to change a resource in the native Windows environment, the CA ControlMinder Agent changes the resource in the appropriate Windows repository. You do not need any additional Windows permissions to change the resource. This means that when users in CA ControlMinder with global or group authorization attributes perform selang commands in the native Windows environment, they have the same privileges and limits for Windows as they do for CA ControlMinder.

When CA ControlMinder is not running, if you use selang to change a resource in the native Windows environment, you must follow these rules:

• You must include the ‑l option in the selang command
• You must have the ADMIN attribute or sub administration privileges
• You must have sufficient Windows permissions to change the resource

  This restriction occurs because a selang process, not the CA ControlMinder Agent, changes the resource in the Windows repository.

For example, user Emma wants to use the chfile selang command in the native Windows environment to change the owner of the file C:\tmp.txt. If CA ControlMinder is running, Emma requires sufficient CA ControlMinder permissions to change the file owner, but does not require additional Windows permissions. If CA ControlMinder is not running, Emma requires both CA ControlMinder and Windows permissions to change the file owner.