By default, the Grid Master denies access to Grid members when a limited-access admin group does not have defined permissions. You can grant an admin group read-only or read/write permission, or deny access to all Grid members or you can grant permission to specific Grid members, as described in Applying Permissions and Managing Overlaps About Administrative Permissions#bookmark423.

...

Note: Only superusers can modify DNS and DHCP Grid properties.

...

The following sections describe the types of permissions that you can set with Grid permissions:

• Administrative Permissions for Grid Members
• Administrative Permissions for Network Discovery
• Administrative Permissions for Scheduling Tasks
• Administrative Permissions for Microsoft Servers

Administrative Permissions for Grid Members
Table 4.8 lists the tasks admins can perform and the required permissions for Grid members.
Image Removed
NIOS 8.1NIOS Administrator Guide (Rev. A)241
Managing Administrators

Anchor
bookmark499 bookmark499

Table 4.8 Grid Member Permissions

Administrative Permissions for Network Discovery
Limited-access admin groups can initiate a discovery and manage discovered data based on their administrative permissions.
You can set global permissions for network discovery as described in Defining Global Permissions . The following table lists the tasks admins can perform and the required permissions for network discovery.
Table 4.9 Permissions for Network Discovery

...

Administrative Permission for the Grid

Anchor
Administrative Permissions for Schedulin Administrative Permissions for Schedulin

Anchor
bookmark503 bookmark503

Administrative Permissions for Scheduling Tasks
You can schedule tasks, such as adding hosts or modifying fixed addresses, for a future date and time. To schedule tasks, you must first enable the scheduling feature at the Grid level, and then define administrative permissions for admin groups and admin roles. For information, see Scheduling Tasks . Only superusers can enable and disable this feature and grant scheduling permissions to admin groups. Limited-access admin groups can schedule tasks only when they have scheduling permissions.
Superusers can do the following:

• Enable and disable task scheduling at the Grid level
• Grant and deny scheduling permissions to admin groups and admin roles
• Schedule tasks for all supported object types
• Reschedule and delete any scheduled task

You can set global permissions to schedule tasks as described in Defining Global Permissions . The following table lists the tasks admins can perform and the required permissions. Users with read/write permission to scheduling can view, reschedule, and delete their own scheduled tasks.
Table 4.10 Scheduling Task Permissions

To schedule tasks for specific resources, admins must have Read/Write permission to scheduling tasks, plus the required permissions to the supported resources. For information about permissions for specific resources, see the following:

• Grid members—See Administrative Permission for the Grid1.
• DNS resources—See Administrative Permissions for DNS Resources6.
• DHCP resources—See Administrative Permissions for DHCP Resources .

Note that the appliance deletes all pending scheduled tasks when superusers disable task scheduling at the Grid level. The appliance deletes an admin's scheduled tasks when superusers do the following:

• Set the scheduling permission of admin groups and roles to "Deny"
• Delete or disable an admin group or an admin role
• Delete or disable local admins
• Delete the scheduling permission from any admin group or admin role that contains users with pending scheduled tasks
• Change the admin group of a limited-access admin

Administrative Permissions for Microsoft Servers

By default, only superusers can add Microsoft servers as managed servers to the Grid. Limited-access admins can add and manage Microsoft servers from the Grid based on their administrative permissions.
The following table lists the tasks admins can perform and the required permissions. Note that only superusers can add a Microsoft server to a name server group.
Image Removed
NIOS 8.1NIOS Administrator Guide (Rev. A)243
Managing Administrators

Table 4.11 Microsoft Server Permissions

Administrative Permissions for IPAM Resources
Limited-access admin groups can access certain IPAM resources only if their administrative permissions are defined. By default, the appliance denies access when a limited-access admin group does not have defined permissions. You can grant admin groups read-only or read/write permission, or deny access to the following IPAM resources:

• Network views
• IPv4 networks
• IPv6 networks
• Hosts

The appliance applies permissions for IPAM resources hierarchically. Permissions to a network view apply to all networks and resources in that view. You can also grant an admin group broad permissions to IPAM resources, such as read/write permission to all IPv4 networks and IPv6 networks in the database. In addition, you can grant permission to a specific host in a network. Permissions at more specific levels override global permissions.
The following sections describe the types of permissions that you can set for IPAM resources:

• Administrative Permissions for Network Views

...

• Administrative Permissions for IPv4 and IPv6 Networks
• Administrative Permissions for Hosts

Anchor
bookmark507 bookmark507

Administrative Permissions for IPv4 and IPv6 Networks

...

A host record can contain both DNS and DHCP attributes if you configure them. When applying administrative permissions to host records, the permissions apply to all relevant DNS and DHCP resources within the host records. You can define global permissions to all hosts. To override global permissions, you must define permissions for specific hosts.
You can grant read-only or read/write permission, or deny access to host records, as follows:

• All hosts—Global permission that applies to all host records in the Grid.
• A specific host—Object permission that applies only to a selected host.

Anchor
Administrative Permissions for DHCP Fing Administrative Permissions for DHCP Fing

Anchor
bookmark510 bookmark510

Administrative Permissions for DHCP Fingerprint Permissions

NIOS provides a global permission for all All DHCP Fingerprints; however, it does not support object level permissions for fingerprints. To use fingerprint filters, you must have superuser privileges.

Anchor
Administrative Permissions for Network I Administrative Permissions for Network I

Anchor
bookmark511 bookmark511

Anchor
bookmark512 bookmark512

Administrative Permissions for Network Insight Tasks

Table 4.12 summarizes the permissions you need to perform various tasks related to device discovery.

Anchor
bookmark513 bookmark513

Table 4.12 Permissions for Network Discovery

...