Windows Security Policies

On the Windows operating system, security policies are defined by string entries in policy tables in the Windows registry. The site Policy key is always required. It defines the basic security policy for this component. Modifications, if needed, can be defined by optional component policy keys.

The security policy is determined by the role the application is playing, whether that be as a client or server. Therefore, the policy tables might contain two communication keys, server and client, under site and under each other component entry.

BMC does not recommend that you edit the Windows registry unless you have previous experience doing so and only after you first back up the registry.

The Policy Tables are at located in the following Windows registry locations:

  • Control-M/EM: HKEY_LOCAL_MACHINE\SOFTWARE\BMC Software\CONTROL-M\CONTROL-M/Enterprise Manager\9.0.X\Default\SecurityPolicy\<site|GTW|CMSG|EM>\<client|server|common>

  • Control-M/Server and Agent: HKEY_LOCAL_MACHINE\SOFTWARE\BMC Software\CONTROL-M\<Control-M/Agent|Control-M/Server>\SecurityPolicy\<site|NS|CA|CO|AG|RU>\<client|server|common|keystore>

    You can update the site section in the registry to affect all communications or update a specific hive to control a specific connection. Values that are specified in the other sections override the values specified in the site registry key for the relevant SSL connections.

You can update the site section in the registry to affect all communications or update a specific hive to control a specific connection. Values that are specified in the GTW and CMSG sections override the values specified in the site registry key, for the relevant SSL connections.

The EM registry contains an EM key for internal encryption purposes. Do not change this key.

After the communication type is established, as listed in the table below, the values (if any) in the relevant policy override the values in the site.plc file.

Policy

Type of Communication

cmsg

Control-M Configuration Server to Control-M Configuration Agent

em

Control-M/EM internal encryption purposes

gtw

Control-M/EM Gateway to Control-M/Server

ca

Control-M/Server Configuration Agent to CCM

co

Control-M/Server to Control-M/EM

ns

Control-M/Server to Control-M/Agent

ag

Control-M/Agent to Control-M/Server

ru

Control-M/Agent and Agentless Host utilities

ruj

Control-M/Agent and Agentless Host utilities