Setting up a Role in SMS for Specific Collections

SMS Rights are a pain to work with. (don't think so? Well then stop reading!) For instance, Giving a user or group rights for specific collections, becomes a tricky situation (I say this because rights are not inherited, so when you try to create roles with less than super admin access, it gets sticky.

Role for a specific collection, or set of collections.

Assign class rights for the following: Advertise, Create, Manage Folders, and Delegate.

Assign the following instance rights for the collections you wish the role to have access to: Read, Modify, Delete. (Each collection, and one of those collections must contain some computers!)

If you do this with a hierarchy for example, you would have the top level collection with the computers which the role can manage. Then anyone in that role can manage only that collection of computers. Every time they make a new collection, they will be forced to limit their query to that top level collection with the computers in it.

If necessary, remove the users instance rights for other collections.

Any collection which they can see, they can advertise to.

The user who creates a collection, must use their delegate right to grant rights to others in the role.