Unexpected behaviours with OmeSiteAdministrators Role

Your test user has privilege to run system update task on the group which you provided. But he can view all the other groups as well. When you try to create a system update task on a server belonging to any other group, then a pop should tell you that you will not be able to create task or something like you don't have permissions. 

One thing to note is which group have you selected? Did you select the already existing group or created a custom group? If you have selected an already existing group then note that same device can be present in multiple groups.

So, yes the test user will be able to see all the devices but he does not have write privilege on all of them except the one for which you gave that user the required permission,

I don't think you need to really remove the user from OMEUSERS group because that group does not have any write privilege and it should not make any difference. Although, if refresh the browser after adding the users to OMEsiteadministrator group, that should suffice.

For the additional user part, can you please help us with a screenshot of how it shows in OME? Have you added only one domain user?

I have created several custom groups, with membership based on device name starts with rules.  I have viewed the group members and verified they are populated as expected.

When my test user opens OME, and goes to System Update it always says "System Update: Filtered By: Grou1, Group2."  The odd thing is sometimes the filter works and only members of these two groups are shown -- but sometimes all devices are shown.  So there is an inconsistency there that I am experiencing.  When all devices are shown, I am able to click on the Apply Selected Updates button and the update task window appears.  The only alert I receive is if I have selected a driver with the out of band update method, which is unsupported.

And just now I was trying to run a Discovery on a discovery range (as an admin) and it was not doing anything.  I was not even getting the pop up alert that the discovery range was submitted for discovery.  So I restarted the OME server and after that I was able initiate the discovery process.

After the restart of the OME server I opened the OME console as the test user and went to System Update.  It still showed the header "filtered by group1, group 2" - but showed all devices for about 3-5 seconds then the table/grid refreshed itself to only show the filtered list as expected.

I closed and re-opened OME as the test user a second time, and once again saw all devices and then the table refreshed itself to only show the actual filtered list.

I have closed and re-opened OME as the test user an additional three times and now it is stuck again permanently showing All devices and will allow me to select and create a task to update devices not in the groups the test user has access to.

I am attaching a screen shot.  I have obscured our domain name and the user names for actual user accounts.  I have left the test user account name visible as well as the one "unknown" domain entry.

You can see for DOMAIN/test457 there are four entries in "Edit Members of OmeSiteAdministrators (they all with the correct/same Domain name.)

In Manage Device Group Permissions  this user shows up three times, twice with the correct Domain name and once with a Domain of Unknown.  One of these listings for the user under Manage Device Group Permissions has the groups selected that I selected for the user.  The other ones have no groups selected.

I have reviewed the whitepaper previously prior to attempting to test this functionality in OME.

Thanks for this extra detail.  Can you let me know how many devices are being managed in this OME system?

We need to look and see if the problem you see happens for a new group that is static, or just for custom queries.

For the netmon crash, we'll need to collect logs.  There is a service restart button, but we need to look at that.

I think we'll need a support ticket opened so we can review your system more closely and get you the best support.  Can you do this?

Thanks much,

Rob

en.community.dell.com/.../20406560

I'm having the same problem.  Running v2.0.1.2222.  Adding an account results in (3) entries, one with the 'Unknown' domain.

Was a root cause\fix identified?

Rob,

We have 326 devices discovered in OME.

When I call Dell Tech Support, what do I need to tell them to get my support ticket routed to the OME team?  I remember in the past having a difficult time trying to get routed to the correct group even when identifying it as relating to OpenManage Essentials.

thankx,

Geoff

If you have Pro Support you should just be able to give them a Service Tag of a system and mention you have an OME issue.  That should get you to the right group to start with, and if they need help, they have other folks they can pull in.  

You can reference this thread (and me), the role based security stuff is a bit less familiar to some folks, so it may need to be escalated. (800-945-3355)

Rob

Three entries doesn't sound right.  Can you open a ticket so we can get a closer look and see what's up?

(800-945-3355)

Rob