I need to create sub-admin users who have access to only specific groups (not "All). How is this done? Essentially what I am looking for is the textbook New York, Atlanta, San Francisco setup where sub-admins of these cities can see and manage only their objects.
When I create a permission set and assign appropriate sub-groups of All, then login as that user, a lot of things break and are missing. See this forum post.
My understanding from that same post is that objects such as Dynamic Group Templates, Installers, Policies, Client Tasks, Server tasks, even Licenses are stored in a static Group - by default, "All". When a user is created having a permission set that does not include "All", starting with 6.5, that user cannot see objects from All any longer. Apparently this was different <6.5, where they could see the report from All, but when they ran it, it only included data from computer objects for which they had permission.
So, am I understanding correctly that the workaround is to create a new static group under All and grant access to all admins and sub-admins to this group? Then I must move ALL OF THE MANY objects named above to this new resource group so that everyone can see them?
I am also concerned about making such sweeping changes by moving all of these objects into a custom static group. What challenges will this present when it's time to upgrade to the next version of ERA?
I assume the behavior of 6.5 was to prevent the resources like All reports from even appearing to users with lower access. That is fine, but it appears to have created a lot of work for those of us needing multi-tiered admin users.
Anyone have experience setting up this kind of multi-tiered admin permissions?
