ControlPoint 8.7 - User Guide

Using ControlPoint Policies to Control Your SharePoint Environment

You can use ControlPoint Policies to prevent and/or send out a notification when an attempt is made to:

·delete a subsite

·exceed a quota imposed on a subsite

·delete documents/items

·create content

·upload a file that exceeds a specified size limit

·create a subsite

·create a subsite with a specific template

·create a subsite after a certain depth

·create or delete a list (optionally, with a specific template)

·upload files of one or more specific types

·add or delete a permission

·add, delete, or update a Permissions Level

·add, delete, or update a SharePoint group

·add or delete SharePoint group members

·break or restore permissions inheritance

You can configure your policy to

·include in the policy—or exclude from the policy—either:

§all users

§specific users and Active Directory groups

§users in one or more SharePoint groups

OR

·exclude from the policy users with a specified Permissions Level.

If Sensitive Content Manager is installed in your environment, you are a member of the Compliance Administrators group, and the options are enabled, you can also create policies to scan content for sensitive content whenever an item or document is added to—or updated in—a SharePoint list or library.

IMPORTANT:  If you have upgraded to version 2.0 or later of Metalogix Sensitive Content Manager from an earlier version and have existing policies to scan content, you may have to re-create or re-register these policies.  Contact Quest Support for assistance.

In a multi-farm environment, you can create and manage ControlPoint policies for the home farm only.

Factors to Consider When Creating ControlPoint Policies

Policies that can be Created:

You can create ControlPoint polices to control:

·subsite creation

·creation of subsites with specific templates

·creation of subsites after a certain depth

·subsite deletion

·the creation and deletion of lists

·the enforcement of subsite-level quotas

·the deletion of documents/items (and optionally, attachments)

·content creation, using a custom Web service

·the uploading of files over a specified size

·the uploading of files of one or more specific types

·the adding or deleting of permissions

·the adding, deleting, or updating of Permissions Levels

·the adding, deleting, or updating SharePoint groups

·the adding or deleting of SharePoint group membership

·permissions inheritance breaking or restoring

·if Sensitive Content Manager is installed in your environment, you are a member of the Compliance Administrators group, and the options have been enabled, the submission of a document/item for sensitive content analysis whenever it is added to—and/or updated in—a list or library.

IMPORTANT:  If you have upgraded from Sensitive Content Manager 1.9 and have existing policies to scan content, you may have to re-create or re-register these policies.  Contact Quest Support for assistance.

Excluding Specific Users from All Policies

ControlPoint Application Administrators can exclude selected users—such as farm administrators—from all policies via the ControlPoint Configuration Setting Users to Exclude from All ControlPoint Policies (CPPOLICYSUPERUSERS).  Refer to the ControlPoint Administration Guide for details.  

NOTE:  Users specified in this setting will always be excluded from all policies, even if they are explicitly added to a policy.

How Policies Impact Operations Performed in ControlPoint

Any action on a SharePoint site that is initiated through ControlPoint is actually carried out by the ControlPoint Service Account rather than the logged in user.  Therefore, if the ControlPoint Service Account is included in a policy, the policy will be enforced for any ControlPoint action that is restricted by that policy (for example, Delete Site and Copy/Move Site--which involves site creation/deletion), regardless of the user who initiated it.

When "Include Children" Applies to Your Scope

Most policies created at the site collection level or above will include all child sites by default. If  a policy is created for a site (other than the root site) or subsite, by default the policy will apply to the selected site and not its child sites.  This behavior is consistent with the model for Selecting Objects on Which to Perform a ControlPoint Operation.

EXCEPTION:  Because the action applies specifically to the creation of child sites, Control Subsite Creation in Certain Depth will always include child sites, regardless of whether "Include Children" is explicitly checked in the Selection panel.

Including and Excluding Users and Active Directory Groups

You can either include or exclude users and/or Active Directory groups from a policy.

Creating Policies That Control Subsite Quota

Subsite-level quotas do not supersede the quota set for an entire site collection.  That is, once a site collection quota is reached, no more content can be added.

NOTE:  Because the contents of Recycle Bins are managed at the site collection level, they are not considered in a subsite-level quota.

Creating Policies That Affect Users Based on Permissions Level

You can only exclude (not include) a SharePoint permissions level from a policy.  

Creating Policies Involving Site Templates

If you want to control the creation of sites that use one or more specific templates, you can choose from any template that has been deployed for the entire farm.   The creation of a site using a certain template cannot literally be "prevented," since it is only upon successful creation of the site that ControlPoint can evaluate the template.  The way ControlPoint enforces this type of policy is by deleting a site that is in violation immediately after it is created.

Creating Content Insertion Policies Using a Custom Web Service

You can create a policy to invoke a custom Web service whenever content in a SharePoint list or library is inserted or updated.  For example, you may want documents and attachments to be scanned for sensitive content and have a notification sent when the policy is violated.

A content insertion policy can be created if:

·the Web service includes the logic necessary to integrate with ControlPoint and is accessible by ControlPoint Service account.  (Details can be found in the guide Running ControlPoint Actions Programmatically.)

AND

·the ControlPoint Configuration Setting Content Creation Policy URL (POLICYSERVICEURL) is populated with the path to the Web Service asmx file.  (Details can be found in the ControlPoint Administration Guide.)

NOTE:  The ControlPoint policy cannot prevent content that violates a policy from being added.

Users Subject to Multiple Polices

If a user is restricted by more than one similar policy, all policies, including the most restrictive one, will be enforced.  

EXCEPTION:  If a policy is created at the list level, any similar policies at a higher scope will be ignored.

Updating or "Re-Registering" a Policy When a New Site Collection or Subsite is Added to the Scope

Whenever you add a Web application or site collection to the scope covered by a policy, you must "re-register" the policy so that the new site collection will be included.  This assigns the new object to the SharePoint event handlers that watch for the actions covered by the policy.  When a subsite is created the event handlers are automatically propagated to the new site.

See Re-Registering a New Site Collection for a Policy.

Creating a ControlPoint Policy

Before creating a ControlPoint policy, it is recommended that you review Factors to Consider When Creating ControlPoint Policies.

To create a ControlPoint policy:

1Select the object(s) for which you want to create the policy.

2Choose Automation > Create a ControlPoint Policy.

3Complete the Policy section as follows:

a)Select one of the Policy Rules.  Use the information in the following table for guidance.

*If you are creating a policy to control subsite quota, content creation, or document/item deletion, ControlPoint must process every event that the policy covers. Therefore, if the scope of the policy is exceptionally large (for example, it covers an entire farm with hundreds of sites, lists, and libraries) or the policy includes sites with a high volume of activity, performance of both ControlPoint and SharePoint may be impacted.

b)Enter a Policy Name and Policy Description.

c)Select either or both of the options described in the following table.

4Complete the User Selection section as described in the following table.

REMINDER:  Any user that the ControlPoint Application Administrator has specified as a "super user" in the ControlPoint Configuration Setting Users to Exclude from All ControlPoint Policies (CPPOLICYSUPERUSER) will be excluded from the policy regardless of whether that user is explicitly included in the policy.

5If you checked the Notify box, select the Enforce Policy tab and complete the Distribution Details as described in the following table.

6Click [Run Now].

After the action has been processed:

·a confirmation message displays at the top of the page, and

·a ControlPoint Task Audit is generated for the action and displays in the Results section.

See also The ControlPoint Task Audit.

Managing ControlPoint Policies

The Manage ControlPoint Policies action lets you view ControlPoint policies for a selected scope.  You can:

·view/edit the details of a ControlPoint policy

·delete a policy, and

·re-register policies when a new Web application, site collection or subsite is added.

NOTE:  If you are a Farm Administrator, you will be able to view all policies within the selected scope; otherwise, you will only be able to view policies that you have created.

To manage ControlPoint policies:

1Select the object(s) whose policies you want to manage).

2Choose Automation > Manage Policies.

All of the policies that apply to the selected scope display, along with the following information:

§the Policy Name and Policy Description

§an indication of whether the policy is Active

§the Owner (creator) of the policy

§the policy's Created Date

§the user the policy was last Updated By.

3If you want to narrow the list to include only policies that meet specific criteria:

a)Specify one or more of the following filters:

§Policy Name contains

§Policy Rule

§Policy Owner

§Show Active policies only

b)Click [Refresh Display]

Now you can:

·open a policy for viewing/editing

·re-register one or more policies

·delete one or more policies.