hmLoadTopic({
hmKeywords:"mapped domain security group",
hmTitle:"Add a mapped domain security group",
hmDescription:"You can map a domain security group to the ESET PROTECT Server and allow existing users (members of these domain security groups) to become ESET PROTECT Web Console users.",
hmPrevLink:"protect_change_pass.html",
hmNextLink:"admin_ar_assign_user_a_permission_set.html",
hmParentLink:"admin_ar_users.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; <a href=\"admin.html\">More<\/a> &gt; <a href=\"admin_access_rights.html\">Access Rights<\/a> &gt; <a href=\"admin_ar_users.html\">Users<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > More > Access Rights > Users > Add a mapped domain security group",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Add a mapped domain security group<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">You can map a domain security group to the ESET PROTECT Server and allow existing users (members of these domain security groups) to become ESET PROTECT Web Console users.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">This feature is only available for systems with Active Directory.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">To access the <span class=\"f_UI\">Mapped Domain Security Groups<\/span> Wizard, navigate to <span class=\"f_UI\">More<\/span> &gt; <span class=\"f_UI\">Users<\/span> &gt; <span class=\"f_UI\">Add<\/span> &gt; <span class=\"f_UI\">New Mapped domain security group<\/span>.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"New mapped domain security group\" title=\"New mapped domain security group\" width=\"900\" height=\"550\" style=\"margin:0;width:900px;height:550px;border:none\" src=\".\/images\/admin_map_group_domain_security.png\"\/><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Basic<\/span><\/h2>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Domain group<\/span><\/h3>\n\r<p class=\"p_Normal\">Type a <span class=\"f_UI\">Name<\/span> for the group. You can also type a group <span class=\"f_UI\">Description<\/span>.<\/p>\n\r<p class=\"p_Normal\">Click <span class=\"f_UI\">Select tags<\/span> to <a href=\"tags.html#assign_tags\" class=\"topiclink\">assign tags<\/a>.<\/p>\n\r<p class=\"p_Normal\"><span class=\"f_UI\">Home Group<\/span> is the static group where all objects created by users from this domain group will be automatically contained. <span class=\"f_UI\">Home Group<\/span> is automatically detected based on the assigned permission sets of the currently active user.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_example\" >\n\r<tr class=\"Table_example\">\n\r<td class=\"Table_example\" style=\"width:4px; background-color:#77BB1A;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_example\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Example\" title=\"Example\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/example.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_example\"><p class=\"p_Example_heading\" style=\"page-break-after: avoid;\"><span class=\"f_Example_heading\">Example scenario:<\/span><\/p>\n\r<p class=\"p_Normal\">The currently active user account has the <span class=\"f_UI\">Write<\/span> access right for <span class=\"f_UI\">Software Install Client Task<\/span> and the user account <span class=\"f_UI\">Home Group<\/span> is &quot;Department_1&quot;. When the user creates a new <span class=\"f_UI\">Software Install Client Task<\/span>, &quot;Department_1&quot; will be automatically selected as the client task <span class=\"f_UI\">Home Group<\/span>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">If the pre-selected Home Group does not meet your expectations, you can select the Home Group manually.<\/p>\n\r<p class=\"p_Normal\">This domain group will be defined by a <span class=\"f_UI\">Group SID<\/span> (security identifier). Click <span class=\"f_UI\">Select<\/span> to select a group from the list and then click <span class=\"f_UI\">OK<\/span> to confirm. Your ESET PROTECT Server must be joined in the domain, otherwise there will be no groups in the list. If you are using Virtual Appliance, see the <a href=\"https:\/\/help.eset.com\/getHelp?product=protect_deploy_va&amp;version=12.1&amp;lang=en-US&amp;topic=rejoin_domain\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">related chapter<\/a>.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>If LDAPS is not available, you can map domain security group by:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 7px; margin-left: 19px;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:13px;margin-left:-13px\">o<\/span><span class=\"f_NormalList\">temporarily deactivating Active Directory settings in <\/span><span class=\"f_UI\">More<\/span><span class=\"f_NormalList\"> &gt; <a href=\"admin_server_settings.html\" class=\"topiclink\">Settings<\/a> &gt; <\/span><span class=\"f_UI\">Advanced Settings<\/span><span class=\"f_NormalList\"> &gt; <\/span><span class=\"f_UI\">Active Directory<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 26px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:13px;margin-left:-13px\">o<\/span>typing the Group SID manually.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>If you keep getting an error message after clicking Select and you have Active Directory set up correctly, the background process might be time outed. You can:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: \'Courier New\';display:inline-block;width:13px;margin-left:-13px\">o<\/span><span class=\"f_NormalList\">Type the SID manually to bypass the issue<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: \'Courier New\';display:inline-block;width:13px;margin-left:-13px\">o<\/span>Type your AD credentials to <span class=\"f_UI\">More<\/span> &gt; <a href=\"admin_server_settings.html\" class=\"topiclink\">Settings<\/a> &gt; <span class=\"f_UI\">Advanced Settings<\/span> &gt; <span class=\"f_UI\">Active Directory<\/span>. ESET PROTECT On-Prem then uses a different, faster way to retrieve the list of SIDs.<\/p><\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Account<\/span><\/h3>\n\r<p class=\"p_Normal\"><span class=\"f_UI\">Enabled<\/span>—Select this option unless you want the account to be inactive (if you intend to use it later).<\/p>\n\r<p class=\"p_Normal\"><span class=\"f_UI\">Autologout (min)<\/span>—This option defines the idle time period (in minutes), after which the user is logged out of Web Console.<\/p>\n\r<p class=\"p_Normal\"><span class=\"f_UI\">Email contact<\/span> and <span class=\"f_UI\">Phone<\/span> contact can be defined to help identify the group.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Permission Sets<\/span><\/h2>\n\r<p class=\"p_Normal\">Assign competencies (rights) for the users from this group.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">The <a href=\"admin_ar_permissions_sets.html\" class=\"topiclink\">permission sets<\/a> are set for the Active Directory domain security group (instead of for individual users, as in the <span class=\"f_UI\">Native User<\/span> case).<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">You can <a href=\"admin_ar_assign_user_a_permission_set.html\" class=\"topiclink\">assign<\/a> multiple permission sets to a domain security group.<\/p>\n\r<p class=\"p_Normal\">You can select a pre-defined competence (listed below) or you can use a custom <a href=\"admin_ar_manage_permission_set.html#edit\" class=\"topiclink\">permission set<\/a>.<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">Reviewer permission set<\/span><span class=\"f_NormalList\">—Read-only rights for the <\/span><span class=\"f_UI\">All<\/span><span class=\"f_NormalList\"> group.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">Administrator permission set<\/span><span class=\"f_NormalList\">—Full access to the <\/span><span class=\"f_UI\">All<\/span><span class=\"f_NormalList\"> group.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">ESET Inspect reviewer permission set<\/span><span class=\"f_NormalList\">—Minimum read-only access rights (for the <\/span><span class=\"f_UI\">All<\/span><span class=\"f_NormalList\"> group) required for an ESET Inspect On-Prem user.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">ESET Inspect server permission set<\/span><span class=\"f_NormalList\">—Access rights (for the <\/span><span class=\"f_UI\">All<\/span><span class=\"f_NormalList\"> group) required for ESET Inspect On-Prem installation process and further automatic synchronization between ESET Inspect On-Prem and ESET PROTECT On-Prem.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">ESET Inspect user permission set<\/span>—Write access rights (for the <span class=\"f_UI\">All<\/span> group) required for an ESET Inspect On-Prem user.<\/p>\n\r<p class=\"p_Normal\">Each permission set provides permissions only for objects contained in the <span class=\"f_UI\">Static Groups<\/span> selected in the permission set.<\/p>\n\r<p class=\"p_Normal\">Users without any permission set will not be able to log in to the Web Console.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_warning\" >\n\r<tr class=\"Table_warning\">\n\r<td class=\"Table_warning\" style=\"width:4px; background-color:#E04239;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_warning\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Warning\" title=\"Warning\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/warning.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_warning\"><p class=\"p_Normal\">All pre-defined permission sets have the <span class=\"f_UI\">All<\/span> group in the <span class=\"f_UI\">Static Groups<\/span> section. Be aware of this when assigning it to a user. Users will have these permissions over all objects in ESET PROTECT On-Prem.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Summary<\/span><\/h2>\n\r<p class=\"p_Normal\">Review the settings configured for this user and click <span class=\"f_UI\">Finish<\/span> to create the group.<\/p>\n\r<p class=\"p_Normal\">Users will appear in the <span class=\"f_UI\">Mapped Domain Security Groups<\/span> after they first log in.<\/p>\n\r"
})
