Post Upgrade Steps for Windchill Policy Access Control Rules

If you enabled either of the following migrators in the Upgrade Manager, in order to fully enable the corresponding functionality in Windchill, you must perform manual steps in Policy Administration:

In Windchill Policy Administration, ensure the following permissions are granted to enable functionality that allows all team members to create a CAPA request if they add an action to the Action table in the New CAPA Request window (some permissions may already exist for the listed group):

In Windchill Policy Administration, ensure the following permissions are granted to enable functionality that allows the customer experience creator to edit the intake node from the customer experience structure (some permissions may already exist for the listed group):

Object	Domain	State	Group	Permission
CustomerExperience	Default	All	Customer Experience Creator (COMPLAINT_CREATOR)	Create, Modify, Modify Content

For a source system of Windchill 10.2 M030, containers created in Windchill 10.2 M030 from the out-of-the-box templates already have some of these permissions specified in the policy access control rules. However, with changes made to existing container templates at Windchill 11.0 by the migrator “Updates container templates to remove all entity references to QMS external entities,” containers created at 11.0 (and containers created prior to 10.2 M030) may not have the same permissions unless the manual steps above are performed.

In addition to the manual Policy Administration post-upgrade steps, in order to enable functionality related to the optional migrator “Loads Policy Access Control rules for CAPAActionPlan and CAPAChangeActivity”, ensure that the following preferences are set in Windchill Preference Management:

Preference	Value
CAPA – Allow Containment Action	Yes
CAPA – Verify Effectiveness	Yes
CAPA – Reinvestigate After Failed Effectiveness Verification	Yes
CAPA – Action Plan Team Source	Quality Team

For more information about the optional migrators, see Options.

For more information about the policy access control rules, see “PTC Windchill CAPA: Access Control Rules” and “PTC Windchill Customer Experience Management: Access Control Rules” topics in the Windchill New and Changed for This Release documentation for Windchill 11.0 F000.

Members of the View and Print Only license group should be absolutely denied all permissions other than Read and Download for WTObject. A new Modify Security Labels permission was introduced in Windchill 11.0. If you select No for the "Enable Modify Security Labels permission migrators" option during upgrade, the Modify Security Labels permission will not be added to the policy rule that absolutely denies the Modify Security Labels permission to the license group. As a result, you need to update the out-of-the-box policy access control rule defined in the Site’s Root (/) domain to add Modify Security Labels to the list of absolutely denied permissions. Updating this policy access control rule is recommended to ensure license compliance.