American Dynamics Intellex Policy Manager, User Manual

Page: 39 / 44

Security Concepts for Policy Manager
User’s Guide 33
Implicit access
This is virtually synonymous with inherited access. If JSmith is a member of the Boston group, and
that group has access to Forcasts.xls, then JSmith has access to Forcasts.xls. When the
administrator has to resolve access issues, this kind of access is the most difficult to recognize
because there is no entry for JSmith in the security descriptor, and therefore his name does not
appear in the access control editor for that descriptor.
Explicit access
The administrator can explicitly grant a user or user group access to an object. Let’s assume there
is a second file, Forcasts2.xls that Boston does not have access to. The administrator can
explicitly grant access to JSmith by adding him to the list of users or user groups in the files
security descriptor. The administrator grants access with the access control editor, adding JSmith
to the security descriptor for the file and then checking the box labeled Allow. Subsequently,
JSmith’s name will appear every time he, or someone else, edits that security descriptor.
Explicit denial
The administrator can explicitly deny a user or user group access to an object. Let’s assume that
the head of the Boston group has decided that JSmith is no longer allowed to see the Forcasts.xls
file. JSmith has inherited access to that file (i.e. he does not appear on the security descriptor for
that file.) The only way to override implicit (inherited) access is to explicitly deny
access to a
specific user or user group. Explicit denial takes precedence over all other forms of access
permission. Use the access control editor, adding JSmith to the security descriptor for the file and
then checking the box labeled Deny.