----- Original Message -----
----- Original Message -----
> On 07/24/2014 01:44 PM, Yassir Elley wrote:
> > Hi guys,
> >
> > With regard to adding support for gpo processing in offline mode, if we
> > have gpo-guids and policy files cached from previous transactions, then
> > we
> > can simply retrieve all the gpo-guids from the cache, construct the
> > policy
> > file names, retrieve the policy files from the local GPO_CACHE directory,
> > and perform the access checks.
> >
> > However, I have some questions:
> >
> > 1. If we don't have any gpo-guids or policy files cached from previous
> > transactions, should gpo processing deny access by default (assuming that
> > gpo_mode is enforcing)?
>
> If we don't have anything cached but some previous transaction was
> successful (i.e. no policy was configured that time), I'd say we should
> allow access.
We should probably behave in the same manner whether we are offline (and
don't have any gpo-guids cached) or online (and no gpos were found to be
applicable for the machine). Currently, in the online case, we are denying
access by default (assuming gpo_mode is set to "enforcing"). In other words,
if no GPOs are found, we deny access. I think this is a bug, b/c it is
possible (though unlikely) that not a single gpo is applicable to the client
machine. While there is such a thing as a Default Domain Policy GPO, it can
be disabled (not a good idea, but possible).
Do we agree that we should adopt a default Allow policy for both the offline
and online cases described above?
Actually, we are already doing the right thing in the online case (default Allow), so I
just need to change the offline case to default Allow also.
Yassir.