SCCM RC2 LABS

using Role Based Administration to define permissions in the ConfigMgr Console

Step 1. Understanding Role Based Administration

In Configuration Manager 2007, administrative access to site resources is controlled by using class and instance security settings that are verified by the SMS Provider computer to allow access to site information and configuration settings. System Center 2012 Configuration Manager introduces role-based administration to centrally define and manage hierarchy-wide security access settings for all sites and site settings.

Instead of using individual class rights, role-based administration uses security roles to group typical administrative tasks that are assigned to multiple administrative users. Security scopes replace individual instance rights per object to group the permissions that are applied to site objects. The combination of security roles, security scopes, and collections allow you to segregate the administrative assignments that meet your organization requirements and this combination defines what an administrative user can view and manage in the Configuration Manager hierarchy.Role-based administration provides the following benefits:

Sites are no longer administrative boundaries. They were with Configuration Manager 2007.

You create administrative users for the hierarchy and assign security to them one time only.

You create content for the hierarchy and assign security to that content one time only.

All security assignments are replicated and available throughout the hierarchy.

There are built-in security roles to assign the typical administration tasks and you can create your own custom security roles.

Administrative users see only the objects that they have permissions to manage.

You can audit administrative security actions

What roles are included ?

The following 14 built in security roles are included:-

Operations Administrator

Full Administrator

Infrastructure Administrator

Security Administrator

Software Update Manager

Read-Only Analyst

Remote Tools Operator

Operating System Deployment Manager

Application Deployment Manager

Application Author

Application Administrator

Asset Manager

Endpoint Protection Manager

Compliance Settings Manager

Step 2. Implementing a custom security role.Perform the following on your Configuration Manager 2012 server as SMSadmin.

In the ConfigMgr console, click on Administration and expand Security, click on Security Roles. The 14 built-in roles appear.

We want to create a custom security role to allow users assigned to that role to read Software Update Reports. As there is no option to create a blank new role, we must use the Copy function to create our new security role. Select the built-in Software Updates Manager role, right click and choose Copy.

When the Copy Security Role wizard appears, give the new role a name based on the function, you can name the new role as follows:- SUM Reports Reader it's also a good idea to fill in a Description of the role as per the screenshot below, notice all the predefined permissions assigned to the Software Updates Manager role appear selected in the Permissions pane. We will edit these to only leave those permissions that are required to run reports.

using the Customize the permissions for this copy of the security role, expand any permission not required and change it from YES to NO (you can double click on each one to change). For example, expand the Alerts permissions and set them all to NO as none of these permissions is required to read reports.

Configure the Permissions so the only the following are set to Yes

Site: Read

Software Updates: Read, Run Report

Click OK when done, the custom SUM Reports Reader role now appears in your console.

Step 3. Create a Global Security Group in Active DirectoryPerform the following on your Active Directory Domain Controller server as Domain Administrator.

Now that we have created our custom security role, we want to assign users to that role. In Active Directory Users and Computers create a new Global Security Group called Software Updates Management Report Readers as per the screenshot below.

To create a new global security group, right click on Users, select New, Group.

Add some users to that group by selecting those users and right-clicking, choose Add to a Group

when the Select Groups wizard appears, type in the name of our security group and click on Check Names, click ok when done.

you've now added some users to the Active Directory security group called Software Updates Management Report Readers.

Step 4. Assign the Active Directory Security Group to our custom rolePerform the following on your Configuration Manager 2012 server as SMSadmin.

In the Administration pane, expand security and select Administrative Users.

In the ribbon click on Add User or Group

when the Add User or Group wizard appears select browse and search for our previously created Active Directory Security Group, type in Software Updates Management Report Readers and click ok

next we need to assign this group with our custom role, so select Add to add security roles, scroll through the list of roles and select our custom role: SUM Reports Reader as per the screenshot below

Click OK when done (leave the Assigned security scopes and collections as they are)

Our active directory security group is now assigned the custom SUM Reports Reader security role.

Step 5. Verify the custom role has the permissions we needPerform the following on your Configuration Manager 2012 server as a member of the Software Updates Management Report Readers active directory security group.

We will now test our new custom role by starting the Configuration Manager console as a user which is a member of the previously created active directory security group. To do this right click on the Configuration Manager console icon in the system tray and hold down the shift key, then right click again (while holding down shift) on the new configuration manager console icon so that we can get a context based menu option called Run as Different User.

when the security credentials window appears, type in the credentials of a domain user that you have previously added to the Software Updates Management Report Readers active directory security group, click ok when done.

After a while, the Configuration Manager console will appear as it would if started by that user and you can immediatly see that it looks different, only the bits that are relevant to this user running Software Update reports are displayed in the console.

When you add (or remove) permissions from the role, this view will change however you should close and re-open the console to see the new view with the credentials of your desired user. We have already defined our permissions so lets select Monitoring and expand Reporting and then select Reports. Notice how only 48 software update related reports appear (in comparison to the 445 or so reports that a member of the Full Administrator security role would be able to view).

and below is what a Full Administrator would see in the same Reports pane

The difference in the number and type of reports available and what you can do/see in the Configuration Manager console is governed by Role Based Administration, cool huh ?