rbarole

User Roles

A user role determines the web console menu items accessible to a user. A role is assigned a permission for each menu item.

Menu Item Permissions

Permissions determine the level of access to each menu item. The permission for a menu item can either be:

• Configure: Allows full access to a menu item. Users can configure all settings, perform all tasks, and view data in a menu item.

• View: Only allows users to view settings, tasks, and data in a menu item.

• No Access: Hides a menu item from view.

Menu Item Types

There are 3 types of menu items in OfficeScan.

Menu Items for Servers and Clients

The following table lists the menu items for servers/clients:

Menu Items for Managed Domains

The following table lists the menu items for managed domains:

Client Management Menu Items

The following table lists the client management menu items:

Built-in User Roles

OfficeScan comes with a set of built-in user roles that you cannot modify or delete. The built-in roles are as follows:

Custom Roles

You can create custom roles if none of the built-in roles meet your requirement.

Only users with the built-in administrator role and those using the root account created during OfficeScan installation can create custom user roles and assign these roles to user accounts.

To add a custom role:

• Administration > User Roles

1. Click Add. If the role you want to create has similar settings with an existing role, select the existing role and click Copy. A new screen appears.

2. Type a name for the role and optionally provide a description.

3. Define the client tree scope.

• You will not be able to save a custom role if you do not define the client tree scope.

1. Click Define Client Tree Scope. A new screen opens.

2. Select the root domain icon , or one or several domains in the client tree.

3. Click Save.

Only the domains have been defined at this point. The level of access to the selected domains will be defined in step 6 and step 7.

4. Click the Global Menu Items tab.

5. Click Menu Items for Servers/Clients and specify the permission for each available menu item. For a list of available menu items, see Menu Items for Servers and Clients.

The client tree scope you configured in step 3 determines the level of permission to the menu items and defines the targets for the permission. The client tree scope can either be the root domain (all clients) or specific client tree domains.

Menu Items for Server/Clients and Client Tree Scope

Criteria	Client Tree Scope
	Root Domain	Specific Domains
Menu item permission	Configure, View, or No Access	View or No Access
Target	OfficeScan server and all clients For example, if you grant a role "Configure" permission to all menu items for servers/clients, the user can: Manage server settings, tasks, and data Deploy global client settings Initiate global client tasks Manage global client data	OfficeScan server and all clients For example, if you grant a role "Configure" permission to all menu items for servers/clients, the user can: View server settings, tasks, and data View global client settings, tasks, and data

• Some menu items are not available to custom roles. For example, Plug-in Manager, User Roles, and User Accounts are only available to users with the built-in administrator role.

• If you select the check box under Configure, the check box under View is automatically selected.

• If you do not select any check box, the permission is "No Access".

6. Click Menu items for managed domains and specify the permission for each available menu item. For a list of available menu items, see Menu Items for Managed Domains.

The client tree scope you configured in step 3 determines the level of permission to the menu items and defines the targets for the permission. The client tree scope can either be the root domain (all clients) or specific client tree domains.

Menu Items for Managed Domains

Criteria	Client Tree Scope
	Root Domain	Specific Domains
Menu item permission	Configure, View, or No Access	Configure, View, or No Access
Target	All or specific clients Examples: If a user deployed firewall policies, the policies will be deployed to all clients. The user can initiate manual client update on all or specific clients. A compliance report can include all or specific clients.	Clients in the selected domains Examples: If a user deployed firewall policies, the policies will only be deployed to clients in the selected domains. The user can initiate manual client update only on clients in the selected domains. A compliance report only includes clients in the selected domains.

• If you select the check box under Configure, the check box under View is automatically selected.

• If you do not select any check box, the permission is "No Access".

7. Click the Client Management Menu Items tab and then specify the permission for each available menu item. For a list of available menu items, see Client Management Menu Items.

The client tree scope you configured in step 3 determines the level of permission to the menu items and defines the targets for the permission. The client tree scope can either be the root domain (all clients) or specific client tree domains.

Client Management Menu Items

Criteria	Client Tree Scope
	Root Domain	Specific Domains
Menu item permission	Configure, View, or No Access	Configure, View, or No Access
Target	Root domain (all clients) or specific domains For example, you can grant a role "Configure" permission to the "Tasks" menu item in the client tree. If the target is the root domain, the user can initiate the tasks on all clients. If the targets are Domains A and B, the tasks can only be initiated on clients in Domains A and B.	Only the selected domains For example, you can grant a role "Configure" permission to the "Settings" menu item in the client tree. This means that the user can deploy the settings but only to the clients in the selected domains.
	The client tree will only display if the permission to the "Client Management" menu item in "Menu Items for Servers/Clients" is "View".

• If you select the check box under Configure, the check box under View is automatically selected.

• If you do not select any check box, the permission is "No Access".

• If you are configuring permissions for a specific domain, you can copy the permissions to other domains by clicking Copy settings of the selected domain to other domains.

8. Click Save. The new role displays on the User Roles list.

To modify a custom role:

• Administration > User Roles

1. Click the role name. A new screen appears.

2. Modify any of the following:

• Description

• Client tree scope

• Role permissions

• Menu items for servers/clients

• Menu items for managed domains

• Client management menu items

3. Click Save.

To delete a custom role:

• Administration > User Roles

1. Select the check box next to the role.

2. Click Delete.

• A role cannot be deleted if it is assigned to at least one user account.

To import or export custom roles:

• Administration > User Roles

1. To export custom roles to a .dat file:

1. Select the roles and click Export.

2. Save the.dat file. If you are managing another OfficeScan server, use the .dat file to import custom roles to that server.

• Exporting roles can only be done between servers that have the same version.

2. To export custom roles to a .csv file:

1. Select the roles and click Export Role Settings.

2. Save the .csv file. Use this file to check the information and permissions for the selected roles.

3. If you have saved custom roles from a different OfficeScan server and want to import those roles into the current OfficeScan server, click Import and locate the .dat file containing the custom roles.

• A role on the User Roles screen will be overwritten if you import a role with the same name.

• Importing roles can only be done between servers that have the same version.

• A role imported from another OfficeScan server:

• Retains the permissions for menu items for servers/clients and menu items for managed domains.

• Applies the default permissions for client management menu items. On the other server, record the role’s permissions for client management menu items and then re-apply them to the role that was imported.

See also:

• Role-based Administration

• User Accounts