Sorry for getting behind in posts, but things have been pretty busy in SMS development lately. I wanted to pass this on however as this issue tends to come up a lot and I’m not sure the official solution widely known.
If you have a collection of machines and you’d like to have an SMS 2003 user (or user group) be able to see and manage only those machines, how do you set up the permissions?
To give a user or group permissions to manage a collection of machines and only those machines, follow the steps below:
- Grant a user or user group class (all instances) level advertise, create, and delegate permissions to collections.
- Remove the user or group’s class level read/modify/delete permissions to collections.
- Grant the user or group instance level read permissions to the master collection that contains the machines to manage.
The user or group can now:
- Create collections that only contain members of the master collection (because of the way collection limiting works)
- Advertise only to visible collections, which will be the master collection and any subsequently created collections.
- If it’s a group that’s managing the master collection, the user creating the collection can then grant the group instance rights by virtue of the delegate permission.
The key here is that while we’ve granted class level advertise permissions to the user, they can only advertise to collections that they can view. The viewable collections should only be the master collection and any collections they’ve created. Since the user doesn’t have class level read rights to collections, SMS 2003 limits the membership of collections they create to the collections they have read rights to. So every collection they create is a subset of the master collection.
This posting is provided "AS IS" with no warranties, and confers no rights.