Automated policy change alert in a distributed enterprise

• US 7,540,014 B2
• Filed: 02/23/2005
• Issued: 05/26/2009
• Est. Priority Date: 02/23/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Beaulieu, Michelle, Leibmann, Matthias, Brown, Laurie A., Lawrence, Mark David, Hunter, Kimberley Ann, Vasishth, Karan
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/064,172
• Publication Number:
  US 20060190985A1
• Time in Patent Office: 1,553 Days
• Field of Search: 726 1- 4, 726/6, 726/7, 726 22- 23
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A distributed enterprise includes a policy management module and policy library for automating policy change alerting. The policy management module and policy library are configured to list associations between published policies, published policy exceptions, and one or more systems policies, and to determine if changes to published (written) enterprise policies, published policy exceptions, or systems policies have occurred. The policy management module and policy library are also configured to notify personnel of the distributed enterprise so that appropriate actions may be implemented.

Claims

1. A method for automating management of policies in a distributed enterprise, the method comprising:

receiving one or more prospective published enterprise policies from one or more publishing portals within the enterprise;

receiving one or more system policies from one or more directory service databases;

maintaining a policy expiration time value for each of the one or more system policies;

associating the one or more system policies to each received prospective published enterprise policy;

examining the associations between the system policies and the prospective published enterprise policies;

determining associations that would be unmatched, changed, or inconsistent based on the one or more prospective published enterprise policies;

generating an alert in an event that the one or more system policies would be unmatched, changed, or inconsistent based on the one or more prospective published enterprise policies; and

generating an alert in an event one or more system policies would expire in response to examining the associations between the systems policies and the prospective published enterprise policies.

2. One or more computer-readable storage media having computer-executable instructions that, when executed, cause a processor to perform a method, the method comprising:

maintaining associations between a published policy and a system policy in a database;

maintaining a policy expiration time value for the system policy;

determining whether a prospective change to the published policy affects the system policy, wherein the determining comprises determining what specific change to the system policy would implement the prospective change to the published policy and determining whether the system policy will be orphaned as a result of the prospective change to the published policy;

generating an alert when the prospective change is determined to affect the system policy; and

generating an alert when the system policy would expire in response to implementing the prospective change to the published policy.

3. One or more computer-readable storage media as recited in claim 2, the method further comprising maintaining a list of generated alerts in a database.

4. One or more computer-readable storage media as recited in claim 2, wherein the determining further comprises determining whether the system policy will be invalidated as a result of the prospective change to the published policy.

5. One or more computer-readable storage media as recited in claim 2, the method further comprising:

storing an expiration date for the system policy; and

generating an alert if the prospective change will cause the expiration of the date of the system policy.

6. One or more computer-readable storage media as recited in claim 2, the method further comprising:

storing an expiration date for a published policy exception; and

generating an alert if the prospective change will cause the expiration of the system policy.

7. One or more computer-readable media as recited in claim 2, wherein the one or more systems policies comprise one or more group policy objects.

8. A computer comprising the one or more computer-readable storage media recited in claim 2.