4. User and computer attributes can be used in ACEs ACEs with conditions, including logical and relational operators User and Device Claims Expression-Based ACEs File classifications can be used in authorization decisions Continuous automatic classification Automatic RMS encryption based on classification Classification Enhancements Central authorization/audit rules defined in AD and applied across multiple file servers Central Access and Audit Policies Allow users to self remedy or request access Provide detailed troubleshooting info to admins Access Denied Assistance

5. User claims User.Department = Finance User.Clearance = High Conditional Access Policy Applies to: Resource.Impact = High Allow | Read,Write | if (User.Department = Resource.Department) AND (Device.Managed = True) Device claims Device.Department = Finance Device.Managed = True Resource properties Resource.Department = Finance Resource.Impact = High AD DS 5 Expression-based access policy File Server

6. Restricted to making policy decisions based on the user’s group memberships Shadow groups are often created to reflect existing attributes as groups Groups have rules around who can be members of which types of groups No way to transform groups across AD trust boundaries No way to control access based on characteristics of user’s device Pre-2012: Security Principals Only Selected AD user/computer attributes are included in the security token Claims can be used directly in file server permissions Claims are consistently issued to all users in a forest Claims can be transformed across trust boundaries Enables newer types of policies that weren’t possible before: Example: Allow Write if User.MemberOf(Finance) and User.EmployeeType=FullTime and Device.Managed=True Windows Server 2012: Security Principals, User Claims, Device Claims

7. Led to group bloat Consider an org with 500 projects, 100 countries, 10 divisions 500,000 total groups to represent every combination: ProjectZ UK Engineering Users ProjectZ Canada Engineering Users [etc…] Pre-2012: ’OR’ of groups only ACE conditions allow multiple groups with Boolean logic Example: Allow modify IF MemberOf(ProjectZ) AND MemberOf(UK) AND MemberOf(Engineering) 610 groups instead of 500,000 Windows Server 2012: ‘AND’ in expressions 3 User Claims + 3 Resource properties Windows Server 2012: with Central Access Policies & Classification

14. Resource Property Definitions

15. FCI In-box content classifier 3 rd party classification plugin See modified / created file Save classification

16. Resource Property Definitions FCI In-box content classifier 3 rd party classification plugin See modified / created file Save classification For Security

17. Resource Property Definitions FCI In-box content classifier 3 rd party classification plugin File Management Task See modified / created file Match file to policy Save classification For Security

18. Resource Property Definitions FCI In-box content classifier 3 rd party classification Extensibility File Management Task See modified / created file Save classification For Security Match file to policy

20. Active Directory Finance folders User folders Standard organization policy High Impact rule Personal Information rule Standard organization policy High Impact rule Personal Information rule Finance department policy High Impact Data rule Personal Information rule Information wall rule Finance department policy High Impact Data rule Personal Information rule Information wall rule Corporate file servers High Impact Data rule Applies To: Resource.Impact == High Access conditions : User.Clearance = High AND Device.IsManaged = True Personal Information rule Applies To: Resource.PII == True Access conditions: Allow MemberOf( PIIAdministrators, Owner) “Information wall” rule Applies To: Exists Resource.Department Access conditions: User.Department any_of Resource.Department 2 Define Central Access Policies (CAPs) Define Central Access Rules (CARs) 1 Apply CAPs on File Servers 3

21. File Access Share Permissions Access Control Decision NTFS Permissions

22. File Access Access Control Decision Share PermissionsNTFS PermissionsCentral Access Policy

23. File/Folder Security Descriptor Central Access Policy Reference NTFS Permissions Active Directory (cached in local Registry) Cached Central Access Policy Definition Access Control Decision: 1)Access Check – Share permissions if applicable 2)Access Check – File permissions 3)Access Check – Every matching Central Access Rule in Central Access Policy Share Security Descriptor Share Permissions Cached Central Access Rule

25. Staging Policies

26. User claims Clearance = High | Med | Low Company = Contoso | Fabrikam User claims Clearance = High | Med | Low Company = Contoso | Fabrikam Resource properties Department = Finance | HR | Engg Impact = High | Med | Low Resource properties Department = Finance | HR | Engg Impact = High | Med | Low Current Central Access policy for high impact data Applies to: @File.Impact = High Allow | Full Control | if @User.Company == Contoso Current Central Access policy for high impact data Applies to: @File.Impact = High Allow | Full Control | if @User.Company == Contoso Staging policy Applies to: @File.Impact = High Allow | Full Control | if (@User.Company == Contoso) AND (@User.Clearance == High) Staging policy Applies to: @File.Impact = High Allow | Full Control | if (@User.Company == Contoso) AND (@User.Clearance == High)

27. Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy Subject: Security ID: CONTOSODOM\alice Account Name: alice Account Domain: CONTOSODOM Object: Object Server: Security Object Type: File Object Name: C:\FileShare\Finance\FinanceReports\FinanceReport.xls Current Central Access Policy results: Access Reasons: READ_CONTROL: Granted by Ownership ReadAttributes: Granted by D:(A;ID;FA;;;BA) Proposed Central Access Policy results that differ from the current Central Access Policy results: Access Reasons: READ_CONTROL: NOT Granted by CAR “HBI Rule” ReadAttributes: NOT Granted by CAR “HBI Rule”

29. Pre-2012 Token User Account User Groups [other stuff] 2012 Token User Account UserGroups Claims DeviceGroups Claims [other stuff]

30. NT Access Token Contoso\Alice User Groups:…. Claims: Title=SDE Kerberos Ticket Contoso\Alice User Groups:…. Claims: Title=SDE File Server User Contoso DC Ad Admin Enable Domain to issue claims Defines claim types Claim type Display Name Source Suggested values Value type User attempts to login Receives a Kerberos ticket Attempt to access resource

31. M-TGT Contoso DC Pre-Windows 2012 Pre-Windows 2012 File Server User

32. U-TGT Contoso DC Pre-Windows 2012 Pre-Windows 2012 File Server User M-TGT

33. TGS (no claims) Contoso DC Pre-Windows 2012 Pre-Windows 2012 File Server User M-TGTU-TGT

34. User M-TGTU-TGT TGS (no claims) ? Contoso DC Pre-Windows 2012 Pre-Windows 2012 File Server

35. File Server TGS (with User Claims) Contoso DC User M-TGTU-TGT

36. TGS (with User Claims) ? File Server Contoso DC User M-TGTU-TGT

37. Set Policy to enable claims Contoso DC File Server Pre-Windows 8 User

38. TGS (no claims) File Server Contoso DC Pre-Windows 8 User M-TGTU-TGT

39. TGS (no claims) Contoso DC File Server Pre-Windows 8 User M-TGTU-TGT

40. File Server Pre-Windows 8 User M-TGTU-TGT TGS (no claims) TGS (with User Claims) ? Contoso DC S4UToSelf()

41. TGS (User and Device Groups/Claims) M-TGT U-TGT Contoso DC File Server User M-TGTU-TGT

42. File Server TGS (User and Device Groups/Claims) ? Contoso DC User M-TGTU-TGT

43. Other Forest DC Publish Cross- Forest transformation Policy Contoso DC File Server User M-TGTU-TGT

44. Referral TGT Other Forest DC File Server Contoso DC User M-TGTU-TGT

45. TGS (with claims) Referral TGT Other Forest DC Contoso DC File Server User M-TGTU-TGT

46. Other Forest DC TGS (with claims) ? File Server Contoso DC User M-TGTU-TGT

47. TGS ADFS Cloud App Contoso DC User M-TGTU-TGT

48. Cloud App Contoso DC ADFS User M-TGTU-TGT

49. SAML TGS ADFS Contoso DC Cloud App User M-TGTU-TGT

50. SAML ? Contoso DC Cloud App ADFS User M-TGTU-TGT

53. First Claim 1 Boolean Claim Adds 242 Bytes User Claims Set 5 Claims: 1 Boolean 1 Integer 2 String – Single Valued Avg Len/value: 12 chars 1 String – Multi Valued Avg Len/value: 12 chars Avg #Values: 6 values Adds 970 Bytes Compound-ID Claims Sets User - 5 Claims: 1 Boolean 1 Integer 2 String – Single Valued Avg Len/value: 12 chars 1 String – Multi Valued Avg Len/value: 12 chars Avg #Values: 6 values Device - 2 Claims: 1 Boolean 1 String – Single Valued Avg Len/value: 12 chars Adds 1374 Bytes of Claims Data + Computer Group’s AuthZ Data Worst-Case Analysis (assumes no compression): Gives us confidence that claims and compound-ID should not result in huge spikes of ticket sizes in most environments. Bytes Before Compression 120user overhead 120device overhead 114per int/bool claim 8per int/bool value 138 per string claim 2 per string character

54. Current infrastructure Windows Server 2012 File Servers Access and Audit Policies based on security groups and file tagging Windows Server 2012 DCs Centrally defined access and audit policies User claims can be used by access and audit policies Windows 8 clients Add device claims to access and audit policies Better access denied experience Partner solutions and line of business applications

57. Please submit session evals on the Build Windows 8 App or at http://aka.ms/BuildSessionshttp://aka.ms/BuildSessions