ControlPoint 8.6 - Administration Guide

Adding Advanced ControlPoint Menu Items

Because they serve a very specialized purpose, the following menu items are not included on any of the Axceler Menus:

·Manage Forest Access, and

·Archive Audit Logs.

It is recommended that the ControlPoint Application Administrator create a custom Tools menu that contains one or both of these items only, then limit permissions to specific ControlPoint users or groups.  Remember, customized menus are merged with any other ManageCP menu(s) for which ControlPoint users have permissions.

To create a custom menu with advanced menu items:

1From the Menu Maintenance page, click Create a Menu.

2Enter a Menu Name and Description of your choosing, then from the Target Menu drop-down, select ManageCP.

3Click [Insert].

4Add either or both advanced menu items using the procedure for Adding and Editing Custom Items in a Menu.  Use the information in the following table for guidance.

NOTE:  <machine_name> refers to the name of the machine on which ControlPoint was initially installed; it may also refer to a host header or load balancer name, if supported in your environment.  <portnumber> refers to the port used by the ControlPoint application (1818 is the ControlPoint default).

5Click [Save Menu].

Now you can manage access to the menu.

Customizing Your Favorites

Each individual administrator can customize his or her own ControlPoint Favorites list to include frequently-used items, including SharePoint sites and ControlPoint actions and analyses.

When you add Web applications, site collections and sites to your Favorites list, you have access to all of the right-click menu options for which you have permissions.

Custom items—such as links to SharePoint pages, internal or external web sites and web-based applications—can also be added.

NOTE:  If you use ControlPoint to manage multiple farms, your Favorites will be carried over to every farm.

To access the Favorites Maintenance page:

From the Manage ControlPoint tree, choose ControlPoint  Configuration > Favorites Maintenance.  

To add items to your Favorites:

1Use the information in the following table to determine the appropriate action to take.

*NOTE:  In a multi-farm environment, you can only select items from the home farm (that is, the farm whose URL you used to launch ControlPoint).  You can add objects from multiple farms to your Favorites, as long as the farm you select them from is currently the home farm.

2Use the information in the following table to determine the appropriate action to take.

3To add the highlighted item(s) to the selection list, either:

§drag and drop the item(s) onto the item below which you want to nest it.

OR

§highlight the item below which you want to nest the new item(s) then click the [Add] button.

To change the placement of items:

1If you want to move multiple items at once, hold down the [Ctrl] or [Shift] key and highlight each item you want to move.

2Drag and drop the item(s) onto the item below which you want to nest it.

To remove items:

1In the right pane, highlight the item(s) you want to remove.  (To select multiple items, hold down the [Ctrl] or [Shift] key.

2Do one of the following:

§drag and drop the item(s) to the left pane.

OR

§click the [Remove] button.

§To remove all items in the right pane, click the Clear All link.

To save changes to your Favorites:

When you have finished adding items to your Favorites, click [Save Favorites].  

IMPORTANT:  If you do not click [Save Favorites] and receive a confirmation dialog, any changes you made will be lost when you navigate away from the page.  

Defining Custom Properties to Apply to SharePoint Sites

For SharePoint Server farms that are subscribed to the Managed Metadata Service Application, ControlPoint Application Administrators can use Managed Metadata to define "Custom Properties" which can be applied to SharePoint sites via the ControlPoint Set Site Properties action.  Unlike SharePoint, which allows Managed Metadata to be applied only to a list column, ControlPoint allows you to" tag" a site with Managed Metadata, for use as parameters in ControlPoint Advanced Searches.

NOTE:  For Custom Properties to be definable, the Web application that hosts ControlPoint Configuration Site Collection must be associated with the relevant Managed Metadata Service Application(s).

To define Custom Properties:

1Open the Settings page for the ControlPoint Configuration Site's Custom Properties list.

2Under Columns, click Create column.

3Enter a Column name (that is, the name you want to assign to the Custom Property), and for column type, select Managed Metadata.

4For Term Set Settings, either:

§select Use a managed term set, then select the term set you want to use.

OR

§select Customize your term set, then create the term set you want to use.

NOTE:  Although list-specific term sets are not available to other lists in the farm when used within SharePoint, term sets created within this list can be used as ControlPoint Custom Properties by all sites throughout the farm.  

NOTE:  Additional settings, such as Allow multiple values, Allow Fill-in, and Default value are not valid for Custom Properties

5To save the custom property, click [OK].

Custom Properties defined within this list will be available for selection in the Set Site Properties user interface.

NOTE:  If you delete a Managed Metadata column from the Custom Properties list, it will no longer be selectable as a Custom Property, and any existing site associations will be lost.

Accessing Members of Active Directory Groups in Different Domains or Forests

If you want to be able to view members of Active Directory groups in another domain or forest when analyzing users and permissions, one of the following trust relationships must exist:

·a two-way trust (that is, users from both domains or forests can access each other's resources without additional authentication)

OR

·a one-way outgoing trust relationship (that is, resources in the domain in which ControlPoint is installed are accessible to users in the user domain or forest.  In this case, ControlPoint needs to be configured to access certain resources—such as Active Directory group members— in the other forest).

The Manage Forest Access feature lets you specify the account credentials that ControlPoint will use for authentication whenever it needs to retrieve Active Directory group members in a forest with which it has a one-way outgoing trust relationship. The account ControlPoint uses for authentication must have a minimum of Read access to the other forest.  As an added security measure, ControlPoint encrypts these credentials using the Advanced Encryption Standard (AES) algorithm before they are stored.

Note that, if your environment uses a one-way trust relationship and you do not configure ControlPoint to manage forest access:

·ControlPoint will still be able to report on permissions granted to users and groups in other domains, but you will not be able to expand Active Directory groups and view membership in those domains.  

AND

·If an Active Directory group is placed into the Business Administrators group, members of that Active Directory group will not be recognized as Business Administrators.

To access the Manage Forest Access feature:

·If the menu item has been added to ControlPoint and you have permissions for it, from the Manage ControlPoint panel, choose Manage Forest Access

OR

·Replace the xcMain.aspx portion of the ControlPoint url with xcForestAccess.aspx.

To manage access to domains and forests with one-way outgoing trusts:

Use the information in the following table to determine the appropriate action to take.