Setting up a Role in SMS for Specific Collections

SMS Rights are a pain to work with. (don't think so? Well then stop reading!) For instance, Giving a user or group rights for specific collections, becomes a tricky situation (I say this because rights are not inherited, so when you try to create roles with less than super admin access, it gets sticky.

Role for a specific collection, or set of collections.

Assign class rights for the following: Advertise, Create, Manage Folders, and Delegate.

Assign the following instance rights for the collections you wish the role to have access to: Read, Modify, Delete. (Each collection, and one of those collections must contain some computers!)

If you do this with a hierarchy for example, you would have the top level collection with the computers which the role can manage. Then anyone in that role can manage only that collection of computers. Every time they make a new collection, they will be forced to limit their query to that top level collection with the computers in it.

If necessary, remove the users instance rights for other collections.

Any collection which they can see, they can advertise to.

The user who creates a collection, must use their delegate right to grant rights to others in the role.

---

About the Author

Emmanuel Tsouris is a Systems Management veteran and Developer Advocate specializing in PowerShell and Cloud Automation. He maintains DotVBS to preserve legacy knowledge for the "archaeologist admin."

Ready to move from VBScript to the Cloud? Check out his book, Pro PowerShell for Amazon Web Services.

Visit EmmanuelTsouris.com for his latest projects.

As an Amazon Associate, I earn from qualifying purchases at no cost to you.