Dynamic Access Control (DAC)
What is dynamic access control?
Dynamic access control (DAC) is a Windows Server feature introduced in Windows Server 2012. It uses data-governance technology to give administrators granular, context-aware control over access to file system resources. Administrators can set conditional access controls based on any criteria they choose, improving security and supporting regulatory compliance.
Before DAC, Windows authorized access to file system resources via shared and new technology file system (NTFS) permissions. This approach limited both the scale and the granularity of auditing and reporting.
DAC works alongside NTFS and shared-folder permissions, improving on them with more granular control and easier, more detailed auditing.
The three main features of dynamic access control
1. Classification
Network administrators can classify data with taxonomic tags that assign meaning to file system resources. For example, a file's sensitivity level, department or purpose.
2. Claims
A claim is an attribute from Active Directory, a piece of information stored as a token, used to grant access to a user or computer.
3. Policy
DAC's central access policy uses conditional logic to connect taxonomic tags and claims. The possible combinations enable highly contextual, granular access control and auditing.
Benefits of dynamic access control
Stronger security: Access adapts to risk. DAC can grant a user full access in the office and restrict that same user on an unsecured network.
Detailed auditing and reporting: These records support regulatory compliance and forensic investigations into attempted or successful attacks.
Simplified access management: Centralized policies, custom criteria and automation reduce the day-to-day work of managing access.
Dynamic access control resources
Blogs
How policy-based access control improves agility and security
Access Control Models and Methods