ECM Governance - Post 3

Guiding Principles continued

Hi Everyone (or me, myself and I, not sure if anyone reads this...) sorry for the delay in this next post, I having been busy doing and not spending enough time writing about it.  In my post 2, we examined the idea of guiding principles and how they are used to set a foundation for our ECM.  We identified several categories or "Areas of Impact" that these principles could be separated into and this week I would like to start by detailing the intent of each of those categories.

General Principles

The general principles are principles that do not fall into any other category, they are usually the least specific (or most general) and often refer to governance rules and policies and how you intend to use them.  A good example of a general rule is the scope of the governance plan or how we intend to apply principles as a general rule.

For example, we want consistent governance across the entire solution and exceptions need to be recorded whenever a site or site collection does not follow the set of policies defined.  In that case, we can create a general principle to define that need:

Governance Scope
Principle
All governance principles, policies, standards and training are tied to the scope and intended purpose of the entire solution. Governance applies equally to all sites and all site areas.

Implication
While some policies will be enforced across the entire organization, others may be determined by each site owner. The Governance document is not intended to define the site specific policies, but is intended to provide the foundation for all sites. Deviation from the governance policies is by exception only and should be recorded and approved by the steering committee prior to implementation.

Security Principles

Security Principles deal with the need for security and how we plan on using security in our solution.  We address things like the security architecture, the use of roles, external access and permission management as security principles.  It is important that we keep security principles as general as possible, to allow for better granularity at the policy and configuration level of the solution to meet the organizations security needs.

As an example we can look at a principle that is common to any governance plan, the use of roles to manage permissions within the solution.  Again the principle is defined and then the implications to the way the solution will be used are outlined.

Role-based Security Model
Principle
Use of a Role-based security model will govern access control and permissions to the SharePoint Portal.

Implication
Users may have different permissions on different sites or areas of the site, which has an implication for both governance and training. This permission is based off the roles that are assigned at any given level. Direct permissions should not be used; if it is found that direct access is being provided, the roles should be reviewed to determine if a GAP exists in the role structure. If a GAP exists, a new role should be defined to prevent the future need for direct security permissions.

In my next post, I will go over the remaining principles Document Management Principles, Publishing Principles, Collaboration Principles, Business Process Principles and Esthetic Principles. Also if you want to learn more in person, I will be presenting on governance at the SharePoint Summit Vancouver 2013, October 28 & 29, I hope I see you there!

Creating a Bootable VHD

In many cases you only need to create VHD files for a virtual PC, but in some cases you may need to install a 64 bit OS. I needed to do exactly that when I decided it would be the quickest and cleanest way to do SharePoint 2010 development. Now one thing you should be aware of is that if you take this approach you will need a significant amount of space for each VHD file, unless it is a differential file. For a Windows 7 or Server 2008 R2 Install, I will typically use a 100GB VHD file, so make sure you have that much space available before we begin.

Before we begin

All tasks require Admin Access to your box and there are a few items you will need before you begin the build of your VHD, first you will need the Install.wim file found on your install DVD in the Sources directory. Additionally, you should download copies of all your systems drivers and store them in a single directory for access later. Lastly you will need to download and install the Windows AIK for Windows 7 (http://www.microsoft.com/downloads/en/details.aspx?familyid=696DD665-9F76-4177-A811-39C26D3B3B34&displaylang=en)

Create the VHD

1. Click Start


2. Right Click on Computer and Click Manage


3. Under Storage, Click Disk Management


4. Once the Disk Configuration Window is refreshed, under Action click More Actions > Create VHD


5. Specify the location and Name of the VHD file and set the size, then Click OK.


6. Once the setup completes you will find the Image in the list of Drives as a teal coloured drive icon.

Initialize and Partition the VHD

1. Right Click on the Grey area that contains the icon and choose Initialize Disk.


2. Choose MBR or GPT (GPT is newer and supports partitions larger than 2TB) and click OK


3. Right Click on the White area of the drive area with a black title that show a status of Unallocated, choose New Simple Volume…


4. Click Next >


5. Click Next >


6. Choose Assign the following drive letter (remember the letter chosen) and click Next >


7. Give the Drive a Volume label that makes it easy to identify, make sure quick format is chosen and click Next >


8. Click Finish


9. The bar on the top will turn blue and the drive will have the letter and label you gave it. If autoplay is turned on an autoplay popup will appear, close it.


10. Right Click on the white area and choose Mark Partition as Active

Install the OS and Add the Drivers

1. Click Start > All Programs > Microsoft Windows AIK and Right Click on Deployment Tools Command Prompt and choose Run as Administrator


2. Type: imagex /info {Install.wim Path}\install.wim eg: imagex /info c:\VHD\install.wim


3. In the result find the Index of the install you want to start


4. Type: imagex /apply {Install.wim Path}\install.wim /check {Index Number} {VHD Drive} eg: imagex /apply c:\VHD\install.wim /check 1 g:\


5. Wait for the install to complete


6. Type: dism /image:{VHD Drive} /add-driver /driver:{Path to drivers} /recurse eg: dism /image:g:\ /add-driver /driver:c:\drivers /recurse

Note: You should only navigate to the top level of the drivers folder, the recurse switch tells it to search all subfolders for drivers and install them.

Change the Boot Menu

1. Type: bcdedit /copy {current} /d "{Label}" eg: bcdedit /copy {current} /d "Windows 7 - VHD"


2. Type: bcdedit


3. Copy the CLSID property called Identifier using Mark for the entry that has the description that matches the label you entered above


4. Type: bcdedit /set {CLSID} device vhd=[{Drive Letter}]{VHD Path}\{VHD Filename} eg: bcdedit /set {b751de95-e30f-11df-b2f6-85541b19d1f4} device vhd=[C:]\VHD\Windows7.vhd


5. Type: bcdedit /set {CLSID} osdevice vhd=[{Drive Letter}]{VHD Path}\{VHD Filename}


6. Type: bcdedit /set {CLSID} detecthal on


7. Now you can reboot into the new image

Using Differential Images to keep your OS Image Pristine

If you install all the base software and perform updates to make the image current, you can then create a Differential Image, which will allow you to make changes without affecting the base image, eg. Test new software or perform development.

1. Click Start > All Programs > Microsoft Windows AIK and Right Click on Deployment Tools Command Prompt and choose Run as Administrator


2. Type: diskpart


3. Type: create vdisk file={Drive Letter}\{VHD DIF FileName} parent={Drive Letter}\{VHD FileName} eg: create vdisk file=c:\VHD\VS2010.vhd parent=c:\VHD\windows7.vhd


4. Change the boot menu to point to the new image for device and osdevice