OpenManage Enterprise 4.0.x User's Guide

PDF

User roles

All local and directory-based (Active Directory or LDAP) users should be assigned a role to determine the privileges they have in OpenManage Enterprise. Active Directory and LDAP directory groups can be imported and assigned to one or more OpenManage Enterprise roles.

Table 1. User rolesThe following table lists user roles:
Role	Privileges
Backup Administrator	The ability to perform all actions on the console by UI or REST API, including backup, restore, and migration. Users cannot manage or edit this role as it is internal and predefined. This role is only assigned to the preconfigured admin user.
Administrator	The ability to perform all actions on the console by UI or REST API except backup, restore, and migration. This role can: Read, view, create, edit, delete, export, and remove information that is related to devices and groups that are available on OpenManage Enterprise. Create local, Microsoft Active Directory (AD), and LDAP users and assign roles. Enable and disable users. Modify the roles of existing users. Delete the users. Change the user password.
Device Manager	The ability to view and manage user-created entities (jobs, firmware, or configuration templates and baselines, alert policies, profiles, and so on). Also, the ability to run tasks, policies, and other actions on the devices (scope) assigned by the administrator.
Viewer	Read-only access to the console and all groups and cannot run tasks or create and manage policies. View information that is displayed on OpenManage Enterprise and run reports.

Any change to the user role takes effect immediately and all impacted users are logged out of their active sessions.
An audit log is recorded when:
- A group is assigned, or access permission is changed.
- The user role is modified.