For basic deployment of Dynamic Access Control, you do not need to put in a big effort. To use claims for authorization and auditing, there is only a need for the following components:

The following figure shows the basic deployment and configuration that needs to be done

However, what happens if you don't use Windows 8 clients?

As you can see in the figure above, DAC works between different Active Directory Forests (Active Directory instance of an organization), and Claims Transformation Policies will provide the functionality to translate the claims definitions between two or more organizations. To prepare for this scenario, you need to establish a Forest Trust between the Active Directory Forests and the Domain Function Level (DFL), which in both the Forest Root domains must be Windows 2012 or higher. Right now, this is a challenge but also a necessary requirement. There is no need for Claim Transformation Rules inside a Forest. This works fine out of the box because Dynamic Access Control objects are stored in the configuration part of the Active Directory and the whole Forest knows the relevant information.

Traditionally, you may have secured access to files by using NTFS file permissions and security groups. With this configuration, we were restricted to making policy decisions based on the user's group membership and the number of groups will explode. Therefore, if we wanted to include the device to control access, there was no chance to do this in an earlier version of the Windows Server. Another limitation was the requirement for folder or file access based on a certificate. Before Windows 2012 Dynamic Access Control, there was no way for the built-in functionality to include devices or certificates. DAC now integrates claims into Windows Authentication so that we can use Active Directory attributes from users and computers to control access to our information stored on file servers such as a location, department, or project.

The following figure shows the new combinations you can use for authorization:

This opens new ways of giving permissions on files and folders, such as:

Allow | Read, Write |
If (@User.Department == @File.Department)
AND (@Device.Managed == True)

By using expression-based access control, users or devices must satisfy conditions that we define to access files in a given classification.

To explain the major benefits, we use a very easy and common example. Let us consider that 200 projects, 20 countries, and two divisions are part of an organization. So in fact, this results in something like 8,000 groups to solve the access control in this scenario using the traditional approach. Reducing security groups is always a vital task in the current IT environment. For example:

Windows Server 2012, without claims, already allows multiple groups with a Boolean logic (expression-based Access Control lists). This helps us to reduce the groups in an effective way. Let us look at the following example of using the AND operations to build up a permission model:

Allow Modify IF MemberOf(ProjectA)
AND MemberOf(CH)
AND MemberOf(Finance)

The result is 222 groups instead of something like 8,000 security groups. Yeah!

Finally, by using claims inside the expression-based access rules, we can convert the groups into exactly three user claims.

The first task in every Dynamic Access Control project is to identify and classify files based on their content. With Windows 2008 R2, we could already fulfil the following tasks:

With Windows Server 2012, the following classification improvements are added:

The next figure gives you an introduction to the processes carried out in a file classification scenario and shows the continuous classification:

With the Windows Server 2012 File Classification Infrastructure (FCI) feature, you can identify sensitive files and encrypt them automatically with RMS.

Some possible scenarios include:

This technology also gives you the possibility of supporting file types other than Office documents. You just need to install and configure a combination of FCI with Rights Protected Folder Explorer from http://blogs.technet.com/b/rms/archive/2012/06/29/official-release-of-rights-protected-folder-explorer.aspx.

Otherwise, you need to add a third-party solution to provide support for other file types.

Central Access Policies (CAPs) play an essential role in a Dynamic Access Control scenario. CAPs are a set of authorization policies that we manage in the Active Directory and deploy them to the file servers over Group Policies. You can think about a CAP-like safety net policy to give you another idea of what you can expect from that element.

A CAP has two logical parts:

The next figure should provide you with some information on how the different solution components interact and where the information of the DAC objects is stored. Furthermore, it gives you the necessary tasks in the right order and the tools that you can use to configure CAPs, claims, and property definitions.

Obviously, if you change policy, you want to check the consequences of your work. For this reason there is a function called "policy staging" available, which lets you run a new policy parallel to your current configuration to evaluate the results.

On the left-hand side of the following figure, you see the tasks that need to be done to configure Dynamic Access Control, and on the right-hand side, the results on the system.

Also, a new tab is present in the Advanced Security Setting for Finance Documents called Central Policy.

After applying Central Access Policies, we need to think about Auditing Policies. With Windows Server 2012, you can author audit policies by combining claims and resource properties. It enables scenarios for you that were impossible or very hard to implement until now. The next figure shows you the file-access auditing workflow to give you a better understanding of this process:

A quick look at how much power is inside these new audit improvements:

To view and analyze audit events you can use the common Event Viewer or if available, the System Center Operations Manager with the Audit Collection Service configured.

Access-denied assistance is a role service of the File and Storage Services role in Windows Server 2012 and helps us in the following use cases:

There are two ways to configure the Access-denied assistance: