To reduce the amount of time and effort required to allocate security permissions to user accounts, you can create configured User Groups. These are custom User Groups that can be associated with any of your Configured User Accounts.
When you have created a User Group, you can allocate security permissions to the User Group instead of individual user accounts.
When a user logs on via a user account that is a 'member' of a User Group, that user is granted:
- The permissions of the ‘Everyone’ User Group
- The permissions of the user account
- The permissions of the User Group(s) of which the user account is a member
- 'Responsibility' for any geographical regions that are assigned to the user account
- 'Responsibility' for any geographical regions that are assigned to the User Group(s) of which the user account is a member
- Access to any Operator Document Stores that are associated with the user account
- Access to any Operator Document Stores that are associated with the User Group(s) of which the user account is a member.
NOTICE
Security threat
On systems on which the 'Everyone' User Group is enabled, all User Accounts on the system automatically inherit the security permissions that are assigned to the 'Everyone' User Group, including the Guest user (which does not require a logon). Each user's security permissions comprise: Everyone permissions + User Group permissions + User Account permissions. To help avoid providing all users with unintended access to features and functionality that should be restricted, use configured User Groups rather than the 'Everyone' User Group. If the 'Everyone' User Group has to be used, it MUST be assigned the minimum permissions required, with access restricted where possible to just the relevant parts of the database. (On new installations, the built-in 'Everyone' User Group is inactive and is not assigned any security permissions by default.)
Failure to follow these instructions can result in equipment damage and a breach in system security.
You can manage User Groups directly in Geo SCADA Expert, or manage them remotely by associating them with Microsoft Windows or LDAP (Lightweight Directory Access Protocol) user groups.