Troubleshooting Policies on a Domino Server

Transcription

1 Troubleshooting Policies on a Domino Server Open Mic Webcast October 9, 2012 Jana Medlin Domino Server Development IBM Collaboration Solutions 2012 IBM Corporation

2 Agenda Policy, its types and usage Ways to assign policy Elements of a settings document Policy precedence How the effective policy is determined How a client pulls policies from server Where the policies are stored in the client Policy Synopsis Tool Troubleshooting tips and tricks References Q&A IBM Corporation

3 Policy, its types and usage Policy A document that contains one or more settings documents Types of policies Organizational assigned to all users Explicit can be assigned to selected users - static Dynamic can be assigned to selected users/groups Usage Powerful feature for administrators Can be used to set purely administrative controls Helps for proper domino management in an organization Makes administrators life easier IBM Corporation

4 Ways to assign policy - Implementation Organizational This policy gets assigned to users when they authenticate with the server based on their Organizational name (ie /ACME) Explicit Administrator can assign this policy to selected users via their Person document Dynamic Administrators can assign this policy to selected users/groups via the policy assignment tab Auto populate groups can be added to dynamic policy IBM Corporation

5 Elements of a settings document How to apply this setting (HTA) Do not set value Value set here won't apply Set initial value Value will be applied initially but user can change Set value whenever modified Value set will be reapplied if modified Set value and prevent changes Value set will be applied and disabled for the user IBM Corporation

6 Elements of a settings document Inherit Plays an important role in parent-child policy hierarchy A top level organization policy is always a parent policy Inherits setting from parent policy irrespective of the setting made in child policy IBM Corporation

7 Elements of Settings document Enforce Plays an important role in parent-child policy hierarchy Any setting with enforcement in parent policy will be enforced in child policy IBM Corporation

8 Policy Precedence How the effective policy is determined An explicit policy takes first precedence, then dynamic policy, followed by an organizational policy which takes final precedence When all three policies are applied to the user with the same type of policy setting with different values, a policy precedence comes into play The explicit policy in a user's Person document overrides a dynamic policy which in turn overrides the organizational policy Precedence applies on a per field basis. So a setting in a policy with lower precedence can still make it into the effective policy if the policy with the higher precedence does not have a value for that setting IBM Corporation

9 Policy Precedence How the effective policy is determined For example a user is assigned three security settings through three different policies. An Explicit, Dynamic, and Organizational are shown below: Required change interval Assigned vault Warning period Allowed grace period Explicit 120 days Don't Set Don't Set 120 days Dynamic Don't Set ExecutiveVault Don't set Don't Set Organizational 90 Days NA 14 Days 90 Days The resultant effective policy would be Required Assigned vault Warning period Allowed grace Effective policy 120 days ExecutiveVault 14 days 120 days IBM Corporation

10 How does a client pull policies from server and update them? Server Client 1.Client sends hash value to server with policy information during authentication with user's home server. 2.Server calculates similar hash value that client should have and compares, if it matches no change is made 3. If it is not matching, then server tells client to refresh policy information 4. Client launches dynamic client configuration process and refreshes policy IBM Corporation

11 Where are policies stored on the client? $policies hidden view in Client's Names.nsf Dynamic Client Configuration uses NAMEGetPolicy API which asks the server to calculate the effective policy for user Then stores the effective policies locally in the client's Names.nsf database Cached policy documents are stored in the $policies view (via Ctrl+Shift View/go to) in local names.nsf New hashed values received from the server are stored by ndyncfg and sent back to server during next authentication IBM Corporation

12 Policy Synopsis tool Policy Synopsis Helps to determine users effective policy Generates a report in the Policy Synopsis Results Database (Polcysyn.nsf) on the admins local machine (notes/data directory) Select one or more users and go to Policy Synopsis IBM Corporation

13 Policy Synopsis tool Policy synopsis results document Blues are hyperlink, take you to the particular document Shows detailed information about each setting and relevant field for that setting To understand, you need to know the field names for each setting document IBM Corporation

14 Troubleshooting Tips and Tricks You have assigned a policy with desktop settings document to several users but its not taking effect for few users. What should you check on this? Run policy synopsis tool for an affected user and determine effective policy Rebuild $Policies view in Domino Directory with below command Load updall -t ( $Policies ) names.nsf -R Get the user authenticated with server and check if required policies are pulled down under $Policies view in user's local NAMES.NSF Locking client using CTRL+F5 and unlocking it by supplying password will get the user authenticated without restarting Notes Client Check and confirm active location document settings are correct Home/Mail server should have proper server name, not IP Address IBM Corporation

15 Troubleshooting tips and tricks You have created a policy with security settings to synchronize Notes Password with Internet Password and assigned the policy to users. How will you verify whether the policy is in effect or not? From Notes client, File Menu > Security > User Security and make sure below setting is checked IBM Corporation

16 Troubleshooting Tips & Tricks Debug parameters applied to both client and server Debug_Policy=1 Debug_Dynconfig=1 Also enable console_log_enabled=1 Enable the debug and force the policy to be updated Make change to users person document and replicate that to users home mail server. Have user log off and back on to client and authenticate with server Wait for Notes configuration settings have been refreshed on status bar Check $policies to see if policy has been applied. Contact support and provide console.log from both client and server for review Additional information to collect for support Policy synopsis database with results document Servers names.nsf with policy and settings documents User's names.nsf IBM Corporation

17 References Self-Training: Troubleshooting Domino policies and settings documents Domino Policies wiki %20policies Domino Policy Explained When will Policy Change Take Effect? New Dynamic Group Policies can Reduce Admin Overhead Notes Domino Policy Flow Chart Domino_Policy_Flow_Chart Lotus Domino Administrator Help IBM Corporation

18 Press *1 on your telephone to ask a question. IBM Lotus Support page IBM Corporation