1 Reply Latest reply on Apr 15, 2014 2:04 PM by Roger Palmen

    AF effective permissions not showing effective permissions?

    Roger Palmen

      Hi All,

       

      Before i start diving into the wonderful world of windows permissions, does anybody know of issues with checking effective permissions? I have a case on my hands, where i can logon to an AF server using an account (using "Connect as"), i can e.g. update the name of an AF Element, but if i check the effective permissions for that AFelement, it tells me i only have read permissions?

       

      This thread shows an example of the Effective Permissions tab: http://vcampus.osisoft.com/discussion_hall/development_with_osisoft_sdks/f/8/t/2735.aspx 

        • Re: AF effective permissions not showing effective permissions?
          Roger Palmen

          I actually found the answer before i posted my question, but i decided to share anyway to make it popup in a future forum search.

           

          From the windows help it tells me:

          Factors that are not used for objects that are accessed remotely

          The following are not used to determine effective permissions for objects that are accessed remotely:

          • Local group membership

          • Local privileges
          In this case, i was granted access through a windows usergroup, local to the AFserver. When requesting the effective permissions from my (remote) laptop, it does not read the group memberships on the AF server, and therefore it does not determine that through that group i have admin rights.

          Conclusion

          Be aware of local (to the AF server) usergroups when evaluating permissions. To be sure, evaluate the permissions on the AFserver itself.