Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Create limitation for an admin account

hello

We have some solarwinds modules. I want delegate accounts to be admin for related module. for example I want for a user set "Allow Administrator Rights" to "yes" but he can not work with NCM module. in other words he is admin of solarwinds except NCM module. it can be done by setting NCM role to "None No access to NCM functionality." from user accont management, but beacuse of his administratin rights he can edit the setting and set "Administrator Unlimited access to NCM functionality." for NCM role. is there a way to specify every modules admin?

Find more posts tagged with

Accepted answers

All comments

cvachovecj

Hi,

The only option is not give the "Allow Administrator Rights" and then add roles for individual modules.

If an account is full Orion admin ("Allow Administrator Rights") then he/she can modify roles for the modules.

Jiri

silverbacksays

Further to cvachovecj‌ feedback, it's best to think about using access rights as a way to enable users to access a given module, rather than a way of restricting access.

In other words, if you want someone to only have access to specific modules, then only give them access to those modules, but do not also give these users Orion admin rights. As Jiri rightly said, if you also give a user Orion administrative rights, they can simply undo your restrictions. Orion administrative rights should be restricted to all but the absolute minimum number for any given environment, as if you give it out like candy, someone will change a global setting, and if you don't keep an eye on the audit log you could be caught out and things will go down hill from there very quickly.

A good rule of thumb is if a user needs Admin rights, then you may as well give them access to everything, since denying access is only going to work 'till they learn how to grant themselves access to what has been omitted. If you need to delegate specific module management rights, then only give them access to that specific module.

Also, if you cannot use domain integration, always name accounts for the user that will be using them, never use generic accounts for a team, as there is no accountability. If a user has access, then their username should be john.doe, for example. If he changes something, his name will then be all over the aforementioned audit logs.

cvachovecj

I totally agree.