Software

Ask something
Discussion Locked

Netware levels of administration

0 helpful
3 replies

by iddy

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I work for a university which is looking at implementing a Novell solution. I have setup a test Netware 5.1 server and have been testing for sometime.

We are looking at implementing Zenworks to deploy software, and run the inventory and remote management features.

Currently I administer the tree using Console One, however I was wondering if it is possible to specify users with different levels of administrative privleges. For example, lowend admin's who only have permission to perform some administrative tasks such as initialising a remote management session or creating a user account, then have other highend administrators who can manipulate objects in the tree etc.

Does this make sense?

Anyway, I hope someone can help me with this.

3 replies

by jimbb

Depending on the complexity and size of your organisation of course, but in general, yes it makes sense. You'll want your helpdesk people for example to be able to reset passwords, but not change access rights. Or you can have an administrator perbranch (in your tree), and even block access for the other administrators. HR typically requires such an approach.

The best thing to do is to create "Organisational Roles", and give these objects the rights they need. Like allowing them to change the password of a certain container. You then make people member of these "organisational roles". The advantage of doing this is that you don't have to touch the individual's access rights or so. If someone has a new role in your organisation, you can make him or her member of another "organisational role" object. Another method is to make some kind of a user that has the rights needed, and then make others "security equivalent" to that user. But the disadvantage there is that if the original (nicely tuned and adapted) user is deleted (left the company, for example), the others loose their special rights too. So using an "Organisational Role" object is a lot safer, and easier to control and manage. You can give that object rights to files and directories, but also to objects, containers and so on.

Jim

This discussion is closed to new replies.