hmLoadTopic({
hmKeywords:"permission sets",
hmTitle:"Permission Sets",
hmDescription:"A permission set represents the permissions for users that access ESET PROTECT Web Console. They define what the user can do or see in the Web Console. Native users have their...",
hmPrevLink:"admin_ar_two_factor_authentification.html",
hmNextLink:"admin_ar_manage_permission_set.html",
hmParentLink:"admin_access_rights.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; More &gt; <a href=\"admin_access_rights.html\">Access Rights<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > More > Access Rights > Permission Sets",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Permission Sets<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">A permission set represents the permissions for users that access ESET PROTECT Web Console. They define what the user can do or see in the Web Console. <a href=\"admin_ar_create_native_user.html\" class=\"topiclink\">Native users<\/a> have their own permissions while domain users have the permissions of their <a href=\"admin_ar_map_group_to_domain_security_group.html\" class=\"topiclink\">Mapped security group<\/a>. Each permission set has its domain of application (static groups). Permissions which are selected in the <span class=\"f_UI\">Functionality<\/span> section will apply over objects in the groups which are set in the <span class=\"f_UI\">Static Groups<\/span> section for each user assigned by this permission set. Having access to certain <a href=\"admin_sg.html\" class=\"topiclink\">Static Group<\/a> automatically means access to every one of its subgroups. With proper setting of static groups you can build separated branches for local administrators (<a href=\"admin_ar_users.html#branch_office\" class=\"topiclink\">see the example<\/a>).<\/p>\n\r<p class=\"p_Normal\">A user can be assigned a permission set even without being able to see it. A permission set is also an object which is automatically stored in the home group of the user who created it. When a user account is created, the user is stored as object in the home group of the creating user. Usually the Administrator creates users, so they are stored in the group <span class=\"f_Path\">All<\/span>.<\/p>\n\r<p class=\"p_Normal\">Permission sets are additive. If you assign more permission sets to a single user, the sum of all permission sets is the resulting access that the user has.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Combining of more permission sets<\/span><\/h2>\n\r<p class=\"p_Normal\">The final access user has to an object is the result of the combination of all permission sets assigned to the user. For example, a user has two permission sets, one for homegroup with full permissions and another one for a group with computers, only with permissions Read, Use for Computer &amp; Groups. This user can run all tasks from homegroup on computers in the other group.<\/p>\n\r<p class=\"p_Normal\">In general, a user can run objects from one static group over objects in another static group, if the user has permissions for certain object type in the certain group.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Access Group filter button\" title=\"Access Group filter button\" width=\"187\" height=\"42\" style=\"margin:0;width:187px;height:42px;border:none\" src=\".\/images\/access_group.png\"\/> The <span class=\"f_UI\">Access Group<\/span> filter button allows users to select a static group and <a href=\"admin_sg.html#access_group\" class=\"topiclink\">filter viewed objects<\/a> according to the group where they are contained.<\/p>\n\r<p class=\"p_Normal\">You can use <a href=\"tags.html\" class=\"topiclink\">tags<\/a> for filtering the displayed items.<\/p>\n\r<p class=\"p_Normal\"><img alt=\"Edit Permission Set.\" title=\"Edit Permission Set.\" width=\"900\" height=\"550\" style=\"margin:0;width:900px;height:550px;border:none\" src=\".\/images\/admin_ar_permissions.png\"\/><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_important\" >\n\r<tr class=\"Table_important\">\n\r<td class=\"Table_important\" style=\"width:4px; background-color:#E9A514;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_important\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Important\" title=\"Important\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/important.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_important\"><p class=\"p_Important_heading\" style=\"page-break-after: avoid;\"><span class=\"f_Important_heading\">Good practice for working with permissions<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Never give access to ESET PROTECT Server <a href=\"admin_server_settings.html\" class=\"topiclink\">Settings<\/a> to inexperienced users—only Administrator should have this access.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Consider restricting access to <\/span><span class=\"f_UI\">Client Tasks<\/span><span class=\"f_NormalList\"> &gt; <\/span><span class=\"f_UI\">Run Command<\/span><span class=\"f_NormalList\">—it is a very powerful task that could be abused.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Non-admin level users should not have permissions for <\/span><span class=\"f_UI\">Permission Sets<\/span><span class=\"f_NormalList\">, <\/span><span class=\"f_UI\">Native Users<\/span><span class=\"f_NormalList\"> and <\/span><span class=\"f_UI\">Server Settings<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>If a more complex model of permissions is needed, do not hesitate to create more permission sets and assign them accordingly.<\/p><\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">The Audit log permissions enables the user to view logged actions of all other users and domains, even those related to assets the user does not have sufficient rights to view.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\">After setting permissions to ESET PROTECT On-Prem functionality, you can also assign <span class=\"f_UI\">Read<\/span>, <span class=\"f_UI\">Use<\/span>, <span class=\"f_UI\">Write<\/span> access to <a href=\"admin_user_management.html\" class=\"topiclink\">User Groups<\/a>.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"policy_duplicate\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">Duplication<\/span><\/h2>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_example\" >\n\r<tr class=\"Table_example\">\n\r<td class=\"Table_example\" style=\"width:4px; background-color:#77BB1A;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_example\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Example\" title=\"Example\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/example.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_example\"><p class=\"p_Normal\">For an object duplication the user needs to have <span class=\"f_UI\">Read<\/span> permission on the original object and <span class=\"f_UI\">Write<\/span> permission on his <span class=\"f_UI\">Home Group<\/span> for this type of action.<\/p>\n\r<p class=\"p_Normal\"><span class=\"f_Path\">John<\/span>, whose home group is <span class=\"f_Path\">John’s Group, <\/span>wants to duplicate <span class=\"f_Path\">Policy 1,<\/span> which was originally created by <span class=\"f_Path\">Larry<\/span>, therefore the policy is automatically contained in Larry\'s home group, <span class=\"f_Path\">Larry\'s Group<\/span>.<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span><span class=\"f_NormalList\">Create a new static group. Name it, for example, <\/span><span class=\"f_Path\">Shared policies<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span><span class=\"f_NormalList\">Assign both <\/span><span class=\"f_Path\">John<\/span><span class=\"f_NormalList\"> and <\/span><span class=\"f_Path\">Larry<\/span><span class=\"f_NormalList\"> with <\/span><span class=\"f_UI\">Read<\/span><span class=\"f_NormalList\"> permissions for <\/span><span class=\"f_UI\">Policies<\/span><span class=\"f_NormalList\"> in the group <\/span><span class=\"f_Path\">Shared policies<\/span><span class=\"f_NormalList\">.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span><span class=\"f_Path\">Larry<\/span><span class=\"f_NormalList\"> moves <\/span><span class=\"f_Path\">Policy 1<\/span><span class=\"f_NormalList\"> to the <\/span><span class=\"f_Path\">Shared policies<\/span><span class=\"f_NormalList\"> group.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span><span class=\"f_NormalList\">Assign<\/span><span class=\"f_Path\"> John<\/span><span class=\"f_NormalList\"> with <\/span><span class=\"f_UI\">Write<\/span><span class=\"f_NormalList\"> permissions for <\/span><span class=\"f_UI\">Policies<\/span><span class=\"f_NormalList\"> in his home group.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 39px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span><span class=\"f_Path\">John<\/span> can now <span class=\"f_UI\">Duplicate<\/span> the <span class=\"f_Path\">Policy 1<\/span>—duplicate will appear in his home group.<\/p><\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\"> <a id=\"write_vs_use\" class=\"hmanchor\"><\/a>Difference between Use and Write<\/span><\/h2>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_example\" >\n\r<tr class=\"Table_example\">\n\r<td class=\"Table_example\" style=\"width:4px; background-color:#77BB1A;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_example\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Example\" title=\"Example\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/example.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_example\"><p class=\"p_Normal\">If <span class=\"f_Path\">Administrator<\/span> does not want to allow user <span class=\"f_Path\">John<\/span> to modify policies in the <span class=\"f_Path\">Shared policies<\/span> group, he would create a permission set with:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">Functionality <\/span><span class=\"f_UI\">Policies<\/span><span class=\"f_NormalList\">: <\/span><span class=\"f_UI\">Read<\/span><span class=\"f_NormalList\"> and <\/span><span class=\"f_UI\">Use<\/span><span class=\"f_NormalList\"> permissions selected<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">Static Groups<\/span>: Shared Policies<\/p>\n\r<p class=\"p_Normal\">With these permissions assigned to <span class=\"f_Path\">John<\/span>, <span class=\"f_Path\">John<\/span> is able to apply those policies but he cannot edit them, create new, nor delete them. If an administrator were to add <span class=\"f_UI\">Write<\/span> permission, John could create new, edit and delete policies within the selected static group (<span class=\"f_Path\">Shared policies<\/span>).<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r"
})
