Customize Super Administrator policies and filters

When you create each delegated administration role, you can select how policies and filters are created for the new role:

  • By default, only the current Default category and protocol filters in the Super Administrator role are automatically copied to each new role, and a Default policy that enforces those filters is created.

  • Alternatively, you can copy all policies, filters, custom categories, custom URLs, and keywords from the Super Administrator role to the new delegated administration role at the time of creation. This may take a long time (15 minutes or more) if there are many policies, filters, and filter components in the Super Administrator role.

    • If you are logged out of the Security Manager while information is being copied to a role, the copy process will continue on its own. You may not be able to log back on to the Security Manager, however, until the copy process is complete.
    • The special Permit All category and protocol filters are not subject to the Filter Lock, and cannot be used in delegated administration roles. When you copy a policy that uses a Permit All filter to a delegated administration role, a new filter (Permit Categories [Modified] or Permit Protocols [Modified]) is created in the role that permits all categories and protocols not blocked and locked by the Filter Lock. See Edit the Filter Lock.

Changes made to the filters and policies in the Super Administrator role are not automatically reflected in the policies and filters in other roles. After delegated administration roles have been created, however, any Super Administrator can:

  • Use the Copy to Role option to push changes to policies and filters to delegated administration roles.
  • Copy additional policies and filters to delegated administration roles.

As a best practice, in order to ensure that the Super Administrator policies and filters provide a useful baseline for delegated administrators, Super Administrators should review at least the Default filters before creating roles.