Overview
This document goes over basics of user management in Ivanti Endpoint Manager. This is not an exhaustive guide on all facets of user management.
General
Before getting into specifics, there are some general details about EPM's user management process.
Groups
When you install the Core, we create 2 local groups on the Core server:
- Landesk Management Suite
- This group provides no special rights. Users who are not intended to be Landesk Administrators should be placed here.
- The LandeskComPlus user is placed in this group during install.
- Landesk Administrators
- This group provides users in it with Landesk Administrator rights.
- The user that installs EPM is placed in this group.
In order for a user to use any functions of EPM, they need to be a member of one of those 2 groups. This is not just for the Windows console, but also to access the web console, or the Analyst space of workspaces, etc. Anything that integrates with EPM.
While you can add individual users to these groups, you can also add other groups, and EPM will resolve the members of those groups.
Any users that are part of Landesk Management Suite will also need to have a Role configured before they can login.
Allow vs Deny
While other user management solutions, like Active Directory, will Deny before Allow (ie. if a user gains Allow from one group and Deny from other, they will get Deny), EPM is the opposite. EPM will provide the greatest available rights based on a user's combination of rights. It's often helpful to think of rights in EPM in the manner of a Venn Diagram, where each role is part of the diagram, and a user's "Effective Rights" are the entirety of the diagram.
As an example, let's examine the following situation:
- Group A is part of Landesk Administrators, and gains the Landesk Administrator role
- Group B is part of Landesk Management Suite, and is given no default rights.
- User "Tim" is part of both Group A and Group B.
In the situation above, Tim will be a full Landesk Administrator, as he will be given all rights from Group A AND Group B, despite Group B being denied any rights.
This also applies to Scopes.
Users vs Groups
EPM generally treats users and groups the same, in terms of actually configuring rights. All references to users in this document can also be considered to apply to groups, unless noted otherwise.
Active Directory/LDAP
You can use your AD users and groups in User Management. Doing so first requires adding an Active Directory source to User Management (Administration > User Management). Click the "Add" button (green circle with a white plus) and select "New Active Directory Source". Provide your domain and a user with Read access to the domain's objects.
You can also add AD sources by going to Configure > Manage Active Directory sources. Any sources added there will be available to User Management.
Adding Users
A user needs to be added to EPM before they can log in to the Console or access other functions. This can be done a few ways:
- Explicitly
- To add a user explicitly, head to Administration > User Management. Click the green circle with the white plus, and then select "New user or group". The resulting window will have tabs, one for each user source. Select the appropriate source, then navigate to the user you want.
- Group Membership
- If a user is a member of a group that's been explicitly added, then they will be as well through inheritance. While they won't show up in User Management until they log in, they will be allowed to.
- If a user is a member of a group that has not been explicitly added, they will not be able to login.
Once a user is added, you need to give it a role and a scope:
- Right click the newly added user and select Properties.
- On the left hand pane, select Roles and check any roles appropriate. Then do the same for Scopes.
A user should login to the console at least once before attempting to use other EPM functions outside of the console, such as Workspaces or HTML Remote Control. This is because we won't create an entry for the user until they do login, even if their group membership allows them to access EPM. Without that user entry being created, they essentially don't exist as far as those functions are concerned, and are therefore unauthorized.
Scopes
In EPM, you can create and assign Scopes. Scopes encompass a set of computers based on user defined criteria. A user can only see machine in their Scope, no matter what rights they have.
Creating Scopes
There are a few ways to create a scope:
- From a Device Group
- From a Query
- If using queries to create scopes, you should try to keep this to a minimum, or to not use very taxing queries, to avoid causing excessive strain on the database.
- More about writing queries can be found here
- From an LDAP Container
Roles
Roles are a collection of rights that allows a user to do certain things, but only to machines within their Scope.
Auditing Roles
One thing to note is that Auditing rights are special. Even a Landesk Administrator can't see or configure auditing by default. Anyone who needs to configure auditing needs to be assigned the Auditing Configuration right, and anyone who needs to see auditing events needs the Auditor role. This is regardless of other permissions.
Rights Documentation
This document has more information on specific rights: Explanation of Role Based Administration (RBA) rights
Additional Information
Sometimes after making changes to user rights, they don't take immediate affect. In this case, you can run the files below in the order specified. These needs to be explicitly run "As Administrator", and manually force the user rights to resolve. These are located in the %LDMS_HOME% directory
- CreateLandeskRights.exe
- ResolveDBCustomGroups.exe
- ResolveUserGroups.exe
