9.11 Worked example: Executives, Finance and HR
Goal. Executives may print Strictly Confidential documents. Finance gets payment-data rules and a Finance label. HR gets personnel-data rules and must not see the Finance label. Everyone keeps the Common four-level scheme from section 8.14.
1. Prerequisite. Active Directory is configured and
Test succeeds (section 6.5). The AD groups
GG-Executives, GG-Finance and
GG-HR exist.
2. Create the groups (Policy → Groups). Use this order from top to bottom:
| Priority | Group name | Assign machines by | Targets | Why this position |
|---|---|---|---|---|
| 1 | Executives | AD group / user / e-mail | GG-Executives (group), the CFO’s laptop
EXEC-LT-01 (computer) |
The CFO is also in GG-Finance. Executives must win. |
| 2 | Finance | AD group / user / e-mail | GG-Finance (group), *@finance.contoso.com
(mail) |
The mail entry also serves Finance users in Outlook on the web. |
| 3 | HR | AD group / user / e-mail | GG-HR (group) |
– |
Everyone else is in Default.
3. Assign content.
| Item | Page | Group targeting |
|---|---|---|
| Public, Internal, Confidential (with sub-sensitivities Finance, HR), Strictly Confidential | Policy → Labels | Common |
| Strictly Confidential → Group exceptions → Executives: Printing blocked = Off | Label drawer | – |
| Label Finance Restricted (position between Confidential and Strictly Confidential) | Policy → Labels | Deliver to Executives, Finance |
| Rule “IBAN / card numbers” → Enforce Confidential Finance | Policy → Rules → Classification Rules | Finance, Executives |
| Rule “Personnel ID and salary” → Recommend Confidential HR | Classification Rules | HR |
| Screen watermark rule for Strictly Confidential (viewer identity) | Policy → Rules → Screen Watermark | Common |
| Awareness message “Payroll data reminder” | Policy → Rules → Awareness | Finance |
| Default label = Internal; Finance scope: Default label = Confidential | General Enforcement, Scope = Default and Finance | – |
4. Publish and verify.
- Click Publish & Sign.
- After the next sync, open Agents → Agents and check the Group column: the CFO’s laptop shows Executives (auto), Finance users’ machines Finance (auto), HR machines HR (auto), and everyone else Default.
- Open a Finance machine’s drawer → Active policies. You should see the Common labels plus Finance Restricted, the IBAN rule, and Finance’s default label.
Results:
- A user in both GG-Executives and GG-Finance is in Executives, because it is higher. They still get the Finance label and IBAN rule, because both are assigned to Executives too. They can print Strictly Confidential, and every page carries the print trace if it is on.
- HR machines never receive Finance Restricted. A document with that label opened on an HR machine counts as unlabeled there (section 8.9). If Finance documents reach HR, prefer the Common Confidential Finance.
- If a domain controller goes down, all three groups keep working from each machine’s last known AD groups.