Home Folders

In EmpowerID, Provisioning policies, also known as "Resource Entitlements" or "RETS," are policies that can be created to automate the provisioning, moving, disabling and de-provisioning of resources to users based on their meeting certain qualifying criteria, such as belonging to a specific group, Management Role, Business Role and Location, or Query-Based Collection. Once a policy is created and enabled, EmpowerID continuously evaluates the policy to determine who should and should not have the resource specified by the policy.

Prerequisites

EmpowerID must first be connected to Active Directory. For details, see Connecting to Active Directory.
Add a File server to EmpowerID as a managed resource system. For details, see Adding File Servers.
Connect EmpowerID to a File server. For details, see Adding File Servers.
Additionally, for EmpowerID to have the necessary NTFS permissions to create shared folders, you must associate the Windows Server Management Web Service job with a service account that is a member of the domain administrator's group with a password that is vaulted in EmpowerID. For details, see Configuring the EmpowerID Windows Server Agent account.
RET provisioning and RET deprovisioning must be enabled on the Active Directory account store.

Provisioning policies can be targeted against any number or combination of Management Roles, groups, Business Roles and Locations, Query-Based collections, as well as individual people.

To create a provisioning policy for home folders

In the Navigation Sidebar of the EmpowerID Web interface, expand Admin, then Policies, and click Provisioning Policies (RETS).
From the Find Resource Entitlements page, click the Actions tab and then click the Create Provisioning Policy tile.
In the Choose Type section of the Policy Details form that appears, select Windows Home Folder from the Object Type To Provision drop-down.
In the General section of the form, do the following:
1. Type a name and display name for the policy in the Name and Display Name fields, respectively. These fields are required.
2. Optionally, type a description for the policy in the Description field.
3. Select the Active Directory domain with the File server in which the home folders are to be provisioned from the Account Domain drop-down.
4. Select the profile drive letter form the Profile Drive Letter drop-down.
5. Tick Share Folder if the home folders provisioned by the policy are to be shares.
6. Tick Share as Hidden if the home folders created by the policy are to be hidden shares.
7. Type the name of the parent shared folder in the Parent Shared Folder field and click the tile for that shared folder.
  
  Once you have completed the above, the General section of the form should look similar to the below image.
In the Throttling Settings section of the form, specify the provisioning and deprovisioning thresholds for the policy. These settings are as follows:
- Approve All Provisions - If this option is selected, the provisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
- Approve All Deprovisions - If this option is selected, the deprovisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
- Require Approval if Provision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the provisions. If the threshold is reached, EmpowerID will not provision any of the home folders until approval is granted.
- Require Approval if Deprovision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the deprovisions. If the threshold is reached, EmpowerID will not deprovision any of the home folders until approval is granted.
  
  As a best practice, when testing provisioning policies, you should select Approve all Provisions and Approve All Deprovisions to become familiar with how EmpowerID processes RETs. Then, when moving to production, you can set the approval thresholds to a number that makes sense for your environment.
  
  In our example, we have selected Approve All Provisions and Approve All Deprovisions, meaning that the provisioning and deprovisioning of all home folders must be approved before those folders will be processed by RET Inbox.
In the Advanced section of the form, do the following:
1. Select Do Nothing from the On Claim Action drop-down. This tells EmpowerID to simply mark any previous resources assigned to the user that match this policy as RET-managed resources. For example, if the user already has an home folder and is placed in a Management Role targeted by the RET policy, EmpowerID marks that user's home folder as RET managed.
2. Select Do Nothing from the On Revoke Action drop-down.
  
  The Advanced section of the form should now look like the following image:
3. Leave the Creation Location Path Resolver Assembly and Creation Location Path Resolver Type fields empty.
Back in the main form, click Save.

Next, assign the policy you just created to one or more targets as demonstrated below.

To assign the home folder RET policy to a target

Scroll to the Policy Assigned To section of the Policy Details form and click the Add (+) button below the specific target type to which you want to assign the RET.

In our example, we are assigning the policy to the Contractor in All Business Locations Business Role and Location so we are clicking the Add (+) button in the Business Role and Locations pane of the section. In this way, each Person who has the Contractor Business Role in any location will receive a home folder.

This opens the Add Entry pane, which is where you select the specific actor you want to assign the policy to. Because we are assigning the policy to a Business Role and Location, the Add Entry pane is contextualized for that actor type.
From the Add Entry pane, click the Select a Role and Location link.
In the Business Role and Location selector that appears, do the following:
1. Search for and select the Business Role to which you want to assign the policy. In our example, we are assigning the policy to the Contractor Business Role, so we have selected Contractor.
2. Click the Location tab and then search for and select the Location. In our example, we want the policy to be applied to all contractors within any business location of the default organization regardless of their location, so we have selected Anywhere.
Click Select to close the Business Role and Location selector.
Type a number to specify the priority for the RET policy in the Priority field. This value is used to determine the priority of the RET if the user qualifies for the same RET by virtue of another assignment, such as being a member of a group that has the same policy.
Click Save.
Back in the main form, click Save.

If you selected Approve All Provisions, you must manually approve each item in the Resource Entitlement Inbox for this policy before EmpowerID will provision the home folders. This is demonstrated in the next section.

To approve pending RETs

From the Navigation Sidebar, expand System Logs and click Provisioning (RET) Inbox.
Click the Pending Approval tab. You should see a list of all RETS requiring approval.

If you do not see a list of RETS pending approval, allow several minutes for EmpowerID to process the RET policy and then press the Search button.
To approve a RET, click the Approve drop-down and select Approve from the menu.
Repeat for each RET you want to approve.
When finished, click the Shopping Cart at the top of the page, type a reason for the approval in the dialog and then click Submit.
Back in the RET Inbox, click the Approved or Rejected tab. You should see the RETS you approved show in the grid with a RET Action of Grant.