ACE context management per user

Dear All,
Can per user get management access in per context on ACE module?
For instance, user A can manage just context A, user B can manage just context B on attachment file.
Thanks.

If you use an ACS for TACACS you can (for ACE you have to) set custom attributes for your group. The attributes look like this:
shell:= ...
If you want to restrict the user from changing into another context, you should change the Shell Command Authorization Set settings.

Similar Messages

Sharing VLAN's on ACE context's

Hi,
I am quite a newbie with ACE configurations. I have a VLAN i want to share over three ACE context's. Every context needs to have its own vlan ip address. How can i manage to do this ? I can only define an ip address on the main ACE configuration.
Regards,
Sebastian

You are probably talking about the transfer-network or client-side VLAN.
If you have already assigned the vlan to the module from the cat6k just create the three contexts and assigned those vlans to each context. That is how i do it. Serve three different context's with three different server networks with one client-side or transfer-network.
just make sure you use different ip's for the ip,peer ip and alias for each context if you use FT or 2 modules. With this setup i always need 4 IP's including the VIP per context on the client side.
Then you can configure the shared vlan in each context separate.
context A
allocate-interface vlan 10
allocate-interface vlan 20
context B
allocate-interface vlan 10
allocate-interface vlan 30
context C
allocate-interface vlan 10
allocate-interface vlan 40

Amount of Resources CPU and Memory per user

Hi,
We are looking to deploy a Line of Business Application via RemoteApp and a custom template. The application requires a significant amount of RAM and CPU, can someone tell me who much RAM and CPUs are allocated per session \ user? I would expect
that we would use the Standard tier if any difference to resources available.
Thanks
Giles

Hi James,
Currently there is no way to configure resources other than selecting either Basic or Standard. If you would like a lower per-VM user density (and thus higher resources for each user) what you can do is create more collections, and only assign
a small number of users to each.
For example, say you only wanted to have a maximum of 4 users on each VM, providing typically at least 1 vCPU per user. In this case you would create collections with the Basic plan, each linked
to the same template image, and only assign a maximum of 4 user accounts on the user access tab of each. Assuming each user uses 80+ hours a month, the total (before discounts) cost for each collection would be $228/month, making each user
cost about $57/month, slightly less than equivalent cost under Standard plan pricing if you factor in resources per user.
You probably already know this, but I will explain how scaling works normally for others that may read this. Azure RemoteApp will automatically create more VMs for each collection as needed to handle user load (Scale-Out) and shut down VMs when the
user load is reduced (Scale-In). The key thing that affects this scaling mechanism is the maximum concurrent users allowed on each VM, which for Standard is 10.
In your case you are asking if you can have more resources per user, hence my instructions above for creating multiple collections and limiting the number of assigned users to less than 10 each.
Depending on your unique needs it may make more sense to create a custom RDS deployment on Azure IaaS VMs. In this case you could control the size/type of VM used, user density, etc. Downside is you have to set up and manage more
RDS components than you do if you use Azure RemoteApp.
-TP

Is there any other way to achieve per user call forward restriction other than to create multiple voice policies?

Hello,
We mentioned the environment details below:
Environment
In our PBX environment, currently a user can forward calls to any local (within a region) internal extension. But for external PSTN call forwarding, a user needs to send a request and be approved by their manager. And the forwarding restriction
is applied such that user is only allowed to forward to that particular PSTN number - to prevent toll fraud.
Moving forward to Lync, using voice policy's call forwarding and simultaneous ring PSTN usages, I can set it to allow forward and simultaneous ring to custom PSTN usage and a custom route that will only send calls to these pre-approved
external numbers.
Outcome
But in such a scenario,
sSince all the custom external allowed numbers will have to be put into a single Route match table, User A will be able to successfully
set up call forward to User B's number. (if they come to know about it somehow, that is)
rü
Route matching list will be very long due to the number of users per hubsite that has call forwarding enabled.
Questions
Is there any other way to achieve per user call forward restriction other than to create multiple voice policies ? MSPL may be ?
2. Is there a limit in the number of entries you can have on the Route pattern matching regex expression ?
Please advise. MANY THANKS.

1) I think multiple policies may be your best bet, though it's not a fun one to manage, I agree. MSPL could do it, but it would be more complex to maintain in the end. Even gateways have limitations on routes.
2) I'm not aware of a limit, though I'm not saying there's isn't one. But if you hit it, you could move to a second usage/route combo.
I'd suggest building out some PowerShell usage/route creation/organization script for this so it's not something that would need to be maintained within the GUI.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications
This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Using Windows Server 2012 per-User RDS CAL on Server 2008 R2 Session Host

I have a Remote Desktop Licensing Server setup on my domain controller running Windows Server 2012 R2. I have installed a
’Windows Server 2012 Remote Desktop Services per-User CAL’ there and activated the licensing server already.
Currently I use ONLY Windows Server 2008 R2 machines as RDS Session Hosts (in the future I plan to transition them to 2012 R2, hence the CAL I bought is
already in the newest version).
I have already configured my WS 2008 RDS Session Hosts: set
Per-User licensing mode and specified license server address. The connectivity between my Session Host(s) and my License Server seems to be ok as the
Remote Desktop Session Host Configuration window on the Session Host correctly lists the 2012 per-user
license (CAL installed on server) from the license server.
On the License Server I can also see event logs entries (in
Microsoft-Windows-TerminalServices-Licensing/Admin), indicating that the user has been issued a license.
The issue I am having is that the license being issued is
2008 Per User CAL license (Build-in OverUsed - temporary) and not the 2012 Per User CAL license which is the only license installed on the server. According to the RDS CAL interoperability matrix at
social.technet.microsoft.com/wiki/contents/articles/14988.rds-and-ts-cal-interoperability-matrix.aspx, I was expecting the 2012 license to be backward-compatible with 2008 client (and that
in the absence of legacy licenses, the (only) 2012 license would be used for all clients connecting to the licensing server)
Before I bought my license, I found this document:
download.microsoft.com/download/3/D/4/3D42BDC2-6725-4B29-B75A-A5B04179958B/WindowsServerRDS_VLBrief.pdf
which says that - "newer version RDS CALs can be used with an older version of the server software" (In section FAQ, Q4), which means to me that
the 2012 license would work as-is for the 2008 Server and gives me flexibility when upgrading to the new server version.
How can I make this CAL work in my environment?
Note:
I have already explicitly disabled
Prevent license upgrade Group Policy setting which I assumed would fix the issue but nothing has changed.
Then I have enabled License server security group Group Polity setting
and added computers from my domain to RDS Endpoint Servers AD group. I have also created new AD group called
Terminal Server Computers and added the computer accounts there, but it changes
nothing. Reference - technet.microsoft.com/en-us/library/ee791761.aspx , technet.microsoft.com/en-us/library/cc725704.aspx and blogs.msdn.com/b/rds/archive/2009/09/17/control-the-issuance-of-rds-cals.aspx.
I found one potential ‘workaround’ which involved manually downgrading my CAL license by calling
Microsoft Clearinghouse. I am very reluctant do to so because, as I upgrade parts of my infrastructure to Server 2012, I’d need to then ask Microsoft to manually upgrade a part of my license back as well.
Am I missing something? What should I do to get my 2012 CAL to be issued to 2008 R2 server

Hi, I have tried several other possibilities.
I change expire date for my temporary assigned license (2008 CAL overused). It can be done, by changing Active Directory user properties – msTSExpireDate. When I restart my Session Host server and logged again, my license was renewed
for next 60 days (event ID - 4145).
I also delete information about license for this user (clear msTSExpireDate and msTSLicenseVersion). And the license was successfully removed from License Manager. After another SH restart it gets the same – 2008 overused – license
(event ID 4143 - license server has successfully issued …)
I now, that changing info in AD attributes is a little trick, and this is not a real value - only a reference, but it was useful to delete or change expiration date of license. But it didn’t change type of license as I expected.
Reference -
http://discussions.citrix.com/topic/243320-windows-2008-licensing-questions/
To TP:
I have found your post with information:
If you have a Server 2012 RD Licensing server you may install your 2012 RDS CALs on it (no downgrade necessary) and then set your Server 2008 R2 RDSH to
use the 2012 RDL server. The 2012 RD Licensing server will automatically issue the CALs as 2008. -
https://social.technet.microsoft.com/Forums/windowsserver/en-US/6046ded1-96bf-4d79-89ce-38aac2a6694e/can-we-use-windows-server-2012-rds-cal-license-in-rds-2008-r2-server?forum=winserverTS
And it showing my situation in brief. I also found
similar problems, but the solutions don’t meet my expectations.
https://social.technet.microsoft.com/Forums/windowsserver/en-US/dcfb1966-89a8-4b5d-bf5a-ff03ac0b7a66/rds-cal-licenses-not-recognized?forum=winserverTS
– “sudden all of the CALS were available”
https://social.technet.microsoft.com/Forums/windowsserver/en-US/f1228599-8452-4a3e-a263-061de14bfcfe/server-2012-rds-builtin-overused-cals-issue?forum=winserverTS
– “this should go away after a while”
Is there a way to determine this time you mentioned before? Or should I just wait patiently…

Can we save the printing preference of FR reporting per report per user?

We are using Hyperion Planning and Financial Reporting version 11.1.1.1. Some of our users will generate PDF for printing (HTML format is badly printed out).
However can we have the option to save the printing preference of each FR report? As some reports are in portrait and some are in landscape format, it is preferred users can setup the printing preference per user per report so that they can choose the paper size and printing orientation.
Thanks in advance!

OK; should this be submitted to http://developer.apple.com/bugreporter/?
I'm unsure about the best setup for this, but here is some brainstorming:
- In Workgroup Manager or Directory, an administrator can designate a user to 'auto-accept' invitations if the user is available at that time.
- Ideally, one would be able to establish an ACL for auto-acceptance, so that a user or admin could designate a list of users/groups from whom a user should auto-accept invites.
- If a user is set to auto-accept, it is reasonable to assume that this user is either unable to use iCal or does not regularly check their calendar, so invites that are not auto-accepted should be handled somehow. For example, a notification could be e-mailed to the user, an invitation accept/decline message could be sent to the iCal account of a designated administrator or delegate, etc.
I am imagining this for the case of my division, in which we have one person scheduling for lots of people, but I think that the idea of being able to delegate a person to be able to add things to one's calendar without confirmation and to confirm invites from non-privileged users would be useful in other cases as well. For example, a boss wants an administrator/secretary to be able to schedule things on his/her calendar, but does not want this person to be able to see all of the details of existing items on that calendar. I suppose that in this case it would be unclear to which calendar the designate should add the event initially, but I'm sure that for many people the privacy of the boss's calendar is more important than the inconvenience of having to create a throwaway calendar for events created by the delegate.
If anyone has any thoughts to help refine this, please let me know and I will incorporate that into my writeup.
Thanks,
Greg

No per user setting for JRE in Internet Explorer on W2K/W2K3 term. server

After installing Sun Java SE on terminal servers (both 2000 &
2003) you have an additional option within Internet Explorer 5.5 & 6.x under tools, intenet options, advanced; called "Java (Sun) Use JRE
XXX (applet) requires restart". This option cannot be set on a per user base. When a user changes this setting, it is changed for ALL terminal server users immediately. This is a big problem.
It should be able to set this on a per user base.
Current key is located at: HLKM\SOFWTARE\Microsoft\Internet
Explorer\AdvancedOptions\JAVA_SUN\SELECT
As some websites require Sun_Java and others won't work at all
when the Sun Java options is selected each user should be able
to select or disable this option on a per user base.
How can we accomplish this?

Hello. Sorry, don't have an answer for your issue. Just wondering whether you've experienced this issue in your Windows Server 2003 envionmnet.
We're running Windows 2000 Server (SP4) (and Citrix Presentation Server 4.0). We typically have 20+ concurrent users logged on to a server. Since JRE 1.5.0_7, we've had issues with Internet Explorer taking upwards of 15 seconds to display even though Iexplore.exe appears in Task Manager almost immediately. If we uninstall JRE 1.5.0_7 and use 1.4.2_6, Internet Explorers displays fine. We've tried JRE 1.5.0_11 and 1.6.0_3, and Internet displays slowly. Has anyone else experienced this issue? Any thoughts of why this is occuring? Thanks.

Change CAL to per user from per unit

Hello!
I bought per user CALS (has been verified) but I have been using per unit because the per user cal didn't update the license for the users. I don't understand why it works perfectly with per unit (group policy edited) but not per user? The system has been
online for one and half year now so it wasnt until know I noticed the problem because to many computers had been assigned a license and even when I revoke one of them I wont be able to connect another computer until december 10 so thats a big problem. I did
change to per user but it wont connect with the computer due to many licenses in use. Do I need to restart the server when I change to per user in group policy? And why is the cals working with per unit fine when I bought per user cal?
Regards

Hi,
>>don't understand why it works perfectly with per unit (group policy edited) but not per user?
Based on the description, I assume we are using group policy to manage Remote Desktop license mode. Here, please make sure that we have a sufficient number of RDS Per User CALs installed on the license server to provide an RDS Per
User CAL for each user that needs to connect to the RD Session Host server.
Besides, for this question is more related to RDS, in order to get professional help, it's recommended that we ask for suggestions in the following RDS forum.
Remote Desktop Services
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS
In addition, regarding issuing RDS CALs, the following article can be referred to for more information.
Install and issue RDS CALs or TS CALs
http://technet.microsoft.com/en-us/library/hh553159(v=ws.10).aspx
Best regards,
Frank Shen

Permit only one access per user on guest portal Cisco ISE

Hi,
Could you please help me to figure it out if it´s possible to create a guest account on cisco ISE which permit only one concurrent access?
We don't want to have multiple devices registering with the same account, just one different account for each device.
Thanks,

Hi Gino,
You can restrict guests to having only one device connected to the network at a time. When guests attempt to connect with a second device, the currently-connected device is automatically disconnected from the network.
This is a global setting affecting all Guest portals.
Step 1 Choose Administration > Web Portal Management > Settings > Guest > Portal Policy.
Step 2 Check the Allow only one guest session per user option.
Step 3 Click Save.

Maximum Number of Sessions per User

I am using OAM 11.1.1.5.0 running on Solaris 10. When we change the "Maximum Number of Sessions per User" to 1 (per customer requirement), a user is restricted to having one active OAM session at a time (as expected). However, if the user does not explicitly log out (e.g. they just close their browser), they are unable to log back in to OAM until their existing OAM session times-out/expires. Given the above max sessions of 1 requirement, is it possible to config OAM to auto-kill the user's session and create a new one if they attempt to login before their initial OAM session times-out/expires? This was possible in Sun's Access Manager. Is it possible in Oracle's OAM? Thank you in advance for your reply.

Hi,
Maximum session per user 0-9 and how can configure see the below link:-
http://help.sap.com/saphelp_nw70/helpdata/en/97/76a341ac57ef0be10000000a1550b0/content.htm
Regards,
Anil

Error for Sapgui 7.10: 'Cannot initialize context management library'.

Hi Xperts,
While accessing system from logon pad I am getting an error "cannot initialize context management library".
Can anybody help out for this.
Thanks in advance,
Chetan

Hi Everybody,
First of all remember that the 710 GUI is out of support.
Refer SAP note 1322923   Maintenance strategy / deadlines BW Business
For your problem please try the following:
- deinstall the sapgui with following command line in START -> RUN
    nwsapsetup /uninstall /all /nodlg
( on the affected workstation )
- uninstall the VCREDIST installation in the CONTROL PANEL ->
ADD / REMOVE Software -> deinstall the
+ Microsoft redistributable runtime DLLs VS2005 SP1(x86)
+ Microsoft redistributable runtime DLLs VS2008 SP1(x86)
+ MSXML 4.0
- if exists, delete the folder
   C:\Program Files\Common Files\Sap Shared
- delete all other folders where the sapgui was installed
   c:\%program files%\sap\sapsetup
   C:\%program files%\sap\Frontend
   C:\%program files%\SAP\Business Explorer
   C:\Documents and Settings\All Users\Start Menu\Programs\SAP Front En
   C:\Documents and Settings\All Users\Start Menu\Programs\Business
- delete then all SAP entries in the Registry in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLL
( !!!!     ONLY the   SAP* entries !!!! )
After that reinstall the latest patches which should solve the issue.
Regards,
Naveen.

3 installations per user-based license: HowTo?

Hello
We have a number of user-based licenses. License agreement states that I can have 3 installations per user, provided only one is utilised per time. Suits me fine, since we run a number of test systems (15) and have about 5 LV programmers ("a", "b", "c", "d", and "e") intermittently programming on these.
Now, however, I wonder how to set up the license manager.
Do I need to have 5 x 3 systems with Windows user accounts "a", "b", "c", "d",and "e" respectively?
Thank you for your help-
Michael

Hello
Sorry, I must have gotten mixwed up with the numbers: It's 5 named user licenses, indeed.
But to clarify, license agreement does say
--------------------- SNIP ---------------------
2.A: Named User/Computer Based License. If you have acquired a named user license, you must designate in
writing (through the NI registration process) one (1) of your employees to serve as the named user for the
license (the "Named User"). The SOFTWARE may be installed on up to three computers in a single
workplace of the designated Named User. Only the designated Named User, however, may use or
otherwise run the SOFTWARE, and the SOFTWARE may not be run concurrently (i.e., it may only be
launched on one computer at a time).
----------------- SNAP ----------------------
So my idea is that 5 employees with 5 named user volume licenses are licensed to 3 test stands each. Since those 5 are the only programmers around, none of them will use more than one license at a time, i.e. only 5 installations are being used. However, according to my understanding, there may be 15 machines with legal installations of LabVIEW on disc or registered to the NI-VLM, 10 dormant, 5 active.
And if this interpretation holds, my question is: How do I set up the test stand PCs and the licenses in the NILM.
Please pardon my persistence, but otherwise I'll be swapping licenses on an hourly basis ;-)
Michael

ASA5515X - WSE,AVC and IPS - Application block per user

Can I enable web applicaction blocking based on user or group of users with WSE license or do I need another type of license.?
Thanks,
Ivan

WSE is always packaged, at a minimum with AVC. that combination on an ASA is all the licensing you need to block web applications per user. You will of course need to implement a scheme to identify your users in order to use their identity in a policy. That can be via local database (seldom used as it doesn't scale well) or via integration with your Microsoft AD infrastructure (via active authentication or optionally using the free Context Directory Agent (CDA) server running on a VM in your environment) or via something like the Identity Services Engine (ISE - a licensed product).

QoS roles on WLC, Per user or per conection?

Hi guys.
This morning I`m talking with my colleages about QoS roles on WLC and their behaviour, then a question has arisen me, because I know when I apply a QoS role or QoS profile it is a per-user role. Ok said my colleage, but What is the behaviour when several devices are using the same user with a QoS role applied?
Good question, I always assumed that this QoS role applies to every different connection managing it like a new user connection, that is, every new connection with the same user (if the QoS role is, for example, 256k for this user) will have a bandwitdh of 256k, but now I'm not sure if the WLC manages every connection at this way or divide the bandwitdh defined for that used into as many parts as connection have with this user ( for ten connections, for example, 25,6k).
Anyone can tell me how is the behaviour of the WLC in this scenario???
Thanks in advanced.
Best Regards.

My2c.
If you apply the values on QoS profile instead of User profile then it is applicable to users connected to that WLAN mapped QoS profile. This way total no. of users will divide the available bandwidth. However, user with p2p application might consume all available bandwidth.

Time management End user document

Dear Experts
Can i have any positive or negative time management end user document? am badly needed. pls take your time and send it to me.. my ID shanmugakumarjatgmaildotcom
appreciate your valuable efforts.
Thanks in advance.
Shanmuga

End use DOC is the Knowlegde Shareing KIT which the Functioanl Consultant will give after the completion fo the Configuration and it helps how to use SAP
try to make a doc
of IT0007 2001 2006 other infotypes if u need
and tell the functionality those infotypes
and alon with that tell abt the RPTQTA00 and other Reprots as per ur requiemrent
still doubt will send u the doc

ACE context management per user

Similar Messages

Maybe you are looking for