Removing Administrator from everyone group

security CMC
1

I’m trying to remove the Administrator from the everyone group and it seems to revert back.

What i want to do is set folder permission so that the everyone group has View on demand and then advanced…remove the ability to schedule.
This works fine however when you log into infoview as Administrator the scheduling ability is lost as it appears that it takes the permissiosn of the everyone group into account as the administrator is part of the everyone group.

Does anyone know how to resolve this?

nandos999 (BOB member since 2006-01-27)

2

Everyone is a very special group in XIR2 the best is to really leave “everyone” in there and manage all permissions for other groups.

If you disable something for everyone. There is no way to get this function back.

Everyone = all users.

ClaireB :de: (BOB member since 2002-08-09)

3

I don’t think it is a special group. it’s more like a group that does not work :slight_smile:

I want all users + Guest account to have access to a folder but want to disable the scheduling ability.

If the product gives you the option to remove the Administrator from the Everyone group then this should work. No point having an option and then it not working.

nandos999 (BOB member since 2006-01-27)

4

I agree with you.

But everyone really means all users in the CMS.

When I define a CMS. I make sure to never use the everyone group and have different groups for all my permissions. One is usually all (having all users except the admin’s)

Having scripted groups would be very helpful to select only some user.
Like Everyone - admin group.

ClaireB :de: (BOB member since 2002-08-09)

5

problem is that you’d have to maintain this group. i.e when you add a new user you would have to always had it to this newEveryone
group.

I feel that there is a fault in the product itself as a user should not have to belong to the everyone group.

We have a setup whereby we would like the whole company to access particular reports. .i.e everyone group . the user is authenticated and because they don’t exist in the CMC they get logged in as Guest.

nandos999 (BOB member since 2006-01-27)

6

The Administrator should have full access rights…just like in V5 V6.
But in this environment the everyone group distorts this as the Administrator belongs to the everyone group.

nandos999 (BOB member since 2006-01-27)

7

Nandos

                  F.Y.I.  Administrator is a seperate group until unless you add administrator to Everyone group administrator will not show up in Everyone group.

Harish

harishreddy :india: (BOB member since 2006-05-11)

8

i’ve just checked and on our 3 environments the Administrator is part of the everyone group. We have never added it to the everyone group.

Are you sure that you don’t have the Administrator in your everyone group?

nandos999 (BOB member since 2006-01-27)

9

The Administrator Account will be in the Everyone Group.
The option to remove a user from the Everyone Group does not exist.

How do you attempt to remove the Administrator from the Everyone group?

Crash :us: (BOB member since 2004-04-27)

10

The best way is to take a class and invite all the users and educate in a small session and tell them that they cannot delete any folders.

Or just pass on a document to who ever uses BO telling them the consequences and that will take a stick beating if they do that… :reallymad:

monty4u :us: (BOB member since 2006-12-12)

11

Found a solution.

If you want to remove the scheduling ability to the everyone group set it to Not specified.
Then for the Administrator group set to explicitly granted.

This means that everyone will not have the ability to schedule the report but the Administrator will be able to.

nandos999 (BOB member since 2006-01-27)

12

Generally speaking, setting the Everyone group to Not specified is a good practice for virtually everything (folders, universes, applications, etc.). If there truly is some functionality or access that is needed by everyone, use it … otherwise giving specific groups specific privileges works best to me.

Dwayne Hoffpauir :us: (BOB member since 2002-09-19)