NT User Group accounts

[Debbie Zisky]

Does anyone know if you can add an NT domain user group instead of adding the users individually? In the list of users that appears when I click on the users of that domain, no groups appear. I've manually entered the group name, but the users are unable to log in. Any ideas?

[Brent Ingler]

What you did is the only way I've found, so far, to add groups to CIM. Make sure that the domain and group name are correct, and make sure that all of the users who are trying to log in are, in fact, in the NT group. Also, if you just added them to the group, initiate a synchronization of the domain to make sure that the ACL's have been sent to all the DC's.

Brent

[Scott Shaffer]

Unfortunately IM7 does not support using groups. You actually have to us individual user accounts.

[Brent Ingler]

That's absolutely not true. While Compaq's support line may not support use of groups(I have no idea, but this may be what you meant), CIM7 CERTAINLY DOES allow it. We currently have people logging into our CIM server, with only a group specified, not individual user accounts. The only limitations in CIM are that the domain and group names cannot contain any special characters, and you cannot browse for groups. You can, however, type in the name of the group, if you know it.

Brent

[Scott Shaffer]

Brent, are you saying that users from the group you have specified can actually log in?

I know that IM7 lets you type the name of the domain/group in and adds it to the list (as Debbie said) but none of those users in that group are able to log into IM7 (again, as Debbie indicated.)

The code just isn't designed to allow this (unfortunately.)

[Brent Ingler]

Scott,

That's exactly what I'm saying. As I mentioned before, the only limitation that I've found is the use of special characters in the domain name. Are either of you using Active Directory? FYI, we're actually using NT4 domain accounts/groups, as we have not moved to AD yet. Perhaps this is the difference.

Brent

[Brent Ingler]

Scott et.al.,

I just went and checked with the people who I *THOUGHT* were logging in using their domain accounts, and was informed that they are, in fact, using the administrator account which is defined from installation. So, as it turns out, apparently we can't log in using accounts that are part of a group that was granted permissions. I apologize for any confusion that this may have caused anyone else.

Brent

[Scott Shaffer]

No problem Brent, I figured that might be the case. The usage is subtle (which is generally bad.)

Unfortunately you can type in the name of a group into the 'Add User' box. This is because IM7 does no validation of the domain/user name you put in -in fact you can put garbage in (I did this, I put in asdfj/asdfj and it took it.) This could be discussed as a possible bug but we did it because we figured that people might be adding users to IM7 that might not already be in the domain/directory. I'm not sure how valid this is though. I'd encourage any feedback on this topic.

Scott
Manager, Insight Manager Development
Hewlett-Packard Corporation

[Brent Ingler]

Scott,

Since we seem to have HP's ear, with you, I'd suggest that the ability to provide NT Group permissions is essential. In addition to that, we should also be able to add users and groups with either special characters in their names, or in the domain names. During setup, you are allowed to point to an administrator account with special characters in the domain name, however you are not allowed to do this after install.

Brent