How to Prevent Users from Modifying Their Own Access Rights

Hello,

From the moment a person has access to user and group management, they can modify their own access rights to make themselves an administrator and take full control of the application.

Is there a setting to prevent this situation from happening?

Thanks a lot

Find more posts tagged with

Accepted answers

All comments

Lofstrand

If you give a person administrator rights within SolarWinds Observability – Self Hosted, or NPM, that is the required permission to be able to adjust accounts, that person can change all accounts. Including their own.

You can't filter what accounts that person can adjust.

bourlis

RomainF,

Based on the assumption you're referring to the SolarWinds SH or SWOSH and not another product

Yes, here's what you need to do.

Collect info - are the users in question associated with a individual account, windows group or SAML group.
1. If the users are associated with an individual account proceed.
2. If the users are associated with a windows group or a SAML group then collect more info:
  1. who needs admin rights
  2. who needs elevated rights (manage nodes, manage SAM, manage WPM)
  3. who needs limited rights mute/unmanage edit reports
  4. everyone else should be relegated to read-only rights.
3. Edit windows/SAML groups with the maximum rights that they need to accomplish their job.
  1. word to the wise, follow the zero trust security model for the safety of your organization.
4. To edit a group or an individual rights simply:
  1. Click on Settings
  2. Find the correct account/group
  3. Find 'Allow Administrator Rights'
  4. Uncheck it.
  5. (optional) remove other rights not needed.
  6. Click the submit button
5. Important note: if the user is logged in the changes will not take affect until they log out & log back in.

Please take heed SolarWinds does not, inherently, log changes made from within the setting page. Which is important to know, since anyone with the admin rights can do anything nearly anything they want to the system or systems monitored and it will go unrecorded.

Once I realized that I took a zero trust stance, modern dashboard audit reports and a modern dashboard showing user/group rights so I can quickly & easily see that the zero trust model is being followed by my team.

If this interests you, let me know and I'll share these modern dashboards in the content exchange area.