Endpoint Administration Guide for Windows › Managing Resources › Internal File Protection › Internal File Rules

Internal File Rules

Internal file rules protect configuration files, log files, and database files. Internal file rules are not visible in selang and cannot be deleted. However, you can write FILE rules to override the internal file rules. If you delete these FILE rules, CA ControlMinder reverts to the internal file rules.

Except for database files, files that CA ControlMinder protects with internal file rules have the following access rights:

• Full access for CA ControlMinder internal processes
• Read and execute (where relevant) access for all other accessors

Database files that CA ControlMinder protects with internal file rules have the following access rights:

• CA ControlMinder internal processes have full access to the database
• The NT AUTHORITY\System user has read access to the database
• All other accessors have no access to the database

  Note: The default access rights for all other accessors were changed in r12.5 SP3. In previous releases, all other accessors had read access by default to the database files.

CA ControlMinder protects the following files with internal file rules. The second column of the table lists the registry subkey and entry that specifies the file location, where applicable. CA ControlMinder creates its registry entries under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\AccessControl

Note: Some file locations are defined internally and do not have a corresponding registry entry. You cannot configure the location of these files.

Note: For more information about configuration settings, see the Reference Guide.