One of the least-known secrets about PowerBroker for Windows is the ability to create logical groups of rules, or “collections.” Rules automate the actions taken by PowerBroker to enforce system and application access policies on Windows servers and desktops. In addition to making it easy to manage rules, collections enable you to enforce parent rules and take actions across all child rules within the collection.

Leveraging collections is a best practice that allows you to organize rules based on almost any criteria and treat multiple rules as a single entity. This comes in handy when:

Example Collections Use Cases

The below screenshot depicts some example collections commonly deployed by PowerBroker for Windows customers:

PBW-cricklewood sample RCS

Collections represented in the screenshot include:

Best Practices for Ordering Collections and Rules

The order of collections and the rules they contain is equally as important as the rules themselves. The order number for each rule and collection is displayed in the Order column of the PowerBroker snap-in user interface. They dictate the sequence in which the rules will process, much as with firewall rules.

The following best practices govern rule-processing order for collections and rules:

It’s important to note that a collection and a rule can have the same order number since rules are children of collections. No two collections can have the same order number nor can any two rules within any collection.

Profile photo of Morey Haber

Morey Haber

Chief Technology Officer, BeyondTrust

With more than 20 years of IT industry experience and author of Privileged Attack Vectors, Mr. Haber joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. He currently oversees BeyondTrust technology for both vulnerability and privileged access management solutions. In 2004, Mr. Haber joined eEye as the Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was a Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. Mr. Haber began his career as a Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelors of Science in Electrical Engineering from the State University of New York at Stony Brook.