Multiple Groups Permissions Issues with Multiple Document Types

[Jacob_Primus]

Scenario:

User is in 2 User Groups:

Let's call them Group HR and Group ADMIN

Admin has Create, Modify, Delete, etc permissions and is linked to document Types A, B, C and D.

HR has View Only Rights and is linked to Document Types E, and F.\\

If a person is in both of these groups, they are able to Create, Modify and Delete document Types E and F? Why? Admin group doesn't see E and F.

This is just a scenario, we are adding more document types and groups to our OnBase system and have users that are going to be in multiple groups. They already have access to tons of document types they can freely modify and delete.

If I add them to another group I need them to not be able to delete the document types associated with the 2nd group.

Do I really have to set up override permissions for all these groups and document types, or is there a configuration piece I'm missing that enables this type of user group control?

[Sheila_Shaver]

Jake - When I took over as OnBase Administrator, I had to modify all of our permissions. I changed our Global Client Settings to be 'Most Restrictive'. Then I made sure to have a limited default setting on the User Group as kind of a 'view-only' type of setting. Then at the DocType, I went to the User Group and had to do overrides for the Admins. Needless to say, this took quite awhile - as I did one group at a time!

[Jacob_Primus]

Thank you Sheila, We may have to do this for each document type and group even though that seems like a waste of time. We use Active Directory for group management, but the groups don't work like other AD permissions. If I give users access to modify files at one file path they don't automatically get to modify all other files/folders they can see. I feel like this is something Hyland should address, and even if it's not a default behavior, this should be a global client setting to enable permission control via groups like this.

[Thomas_Reu · Accepted solution]

If you implement\define override privileges that should get you back on track.  However, if has to be done for anyone that is crossing groups and security.  I had to do this for every user group since I have some clients that want their document types open to all as readonly.  We also use AD.