Providing Limited User Admin Rights

[Rochelle_Petts]

Hello!

I would like to provide remote technical support staff the ability to delete user accounts for only the User Groups that they belong to. From what I have read in the MRG, if I grant a specific user the Administrator Option - "User Group Administrator" that user will have rights to all user groups. Do I understand this correctly? If so, is there a way to accomplish what I need?

Rochelle

[Elizabeth_Hallm]

Hi Rochelle,

You should be able to accomplish this by the User/User Groups in Configuration Rights for your user group then User Update Admin.  Hope this helps.

Thanks,

Liz

[Rochelle_Petts]

Yes, but that option provides the configuration rights to everyone that is a member of that group. Those are the users that I want the tech support person to be able to administer. Also if I make the tech support person a member of the Password Config user group they will have access to all users, even those that are not in their own user group. So far, I'm not finding a way to do this. 

[Carly_Chung]

Hi, Rochelle.

You are correct in saying the "User Group Administrator" setting gives the user the right to administer all user groups. Please let us know if the explanation in the MRG needs to be clearer.

To achieve your goal, you should be able to create a separate group just for users who need user configuration rights. As long as they don't have the "User Group Administrator" setting selected, users in this group should be limited to administering the following:

1. User accounts in any of the groups they belong to
2. Accounts that are not assigned to any user groups
3. Service accounts

In my test system, adding a user to the "Password Config" user group did not give the user access to all users in the system. The test user still was limited to only the user accounts I listed earlier. There are a couple of things you can check to see why this is behaving differently in your system:

1. Make sure your test user is not assigned the "User Group Administrator" setting.
2. Make sure you are logging your test user off of Config whenever you modify the user's privileges. This step ensures your changes take effect the next time you log on as that user.
3. When you are logged on as the test user, check whether the additional accounts you're seeing belong to any user groups. These accounts might be service accounts, or they might not belong to any user groups. 

 I hope this information helps. If not, please contact your first line of support for assistance.

Thanks!
Carly

[Rochelle_Petts]

Thanks Carly! That works. In my test I did still have the "User Group Administrator" (kind of a misnomer isn't it, since this is a setting at a user level?) option checked. Once I changed that, my test user tested out correctly. I appreciate the information and the clear instructions to make it happen.