Best practice to set up the user authorization

Dear expert,
I have a question regarding the user authorization access. I've attend the BOE training but I'm still blur in term of user authorization planning. Currently, I have around 50 named users that need to access the BOE server. But the certain user will be restricted to access to certain folders or reports. May I know what is the best practice to set up the user authorization access? Should I set up first in the development machine and once its firm, then I migrate it to production machine..or is there any steps that I need to follow...?
Really appreciate if you can let me know on what should I look into first before set up the authorization. Is there any doccument that I can referring to..?
Thanks & Regards,
-Syahida-

Create User Group for each folder (for eg. Sales/Marketing etc) and also based on the type of access you want to provide.
Like Sales VOD/ Sales View/Sales Schedule, and add users to the User Group based on the type of rights you want to provide them. Then add the User Group to respective report folders.
First deploy it in the Development environment, once you have everything finalized then you can replicate the same to QA and Prod environment by migration. Also make sure that in Development environment developers will have full control to develop/add reports to folders, you have to restrict that in QA & Prod environment.

Similar Messages

What is the best practice for setting up warehouse inventory for oil & gas tank farm

Hi, i want to know the best practice for setting up warehouse inventory for oil & gas tank farm. SAP has these levels for inventory management in warehouse environment: warehouse-aisle-shelf-bin. To me the bin seems to be the central location for inventory. So do i set up each oil tank as a bin location?

Hi,
Please refer below link:
https://help.sap.com/saphelp_sbo900/helpdata/EN/ad/4f233a7b864c7cbe2b57ad09246adb/content.htm
SAP Business One 9.0 Training - Feb 6, 2013 - Warehouse Bins - YouTube
Thanks & Regards,
Nagarajan

Although we have iPhones and iPads, this is our first mac pc and we wanted to know the best way to set up multiple users with parental contro;s

although we have iphones and ipads, this is our first imac and we wanted to know the best ways to set up multiple users with parental controls

I'm assuming you have the lastet OSX version 10.9 "Mavericks." Here are some useful links from Apple I think will help:
http://support.apple.com/kb/PH14414
http://support.apple.com/kb/PH14099
http://support.apple.com/kb/PH14280
and a video:
http://support.apple.com/kb/VI28
I suspect you have a newer iMac than the pre-2006 models this forum covers (the forum labels are unbelieveably vague). If you can confirm that yours is newer than 2005, I can ask the Hosts to move you the the forum for current iMacs, which gets many more views.

2K8 - Best practice for setting the DNS server list on a DC/DNS server for an interface

We have been referencing the article
"DNS: DNS servers on <adapter name> should include their own IP addresses on their interface lists of DNS servers"
http://technet.microsoft.com/en-us/library/dd378900%28WS.10%29.aspx but there are some parts that are a bit confusing. In particular is this statement
"The inclusion of its own IP address in the list of DNS servers improves performance and increases availability of DNS servers. However, if the DNS server is also a domain
controller and it points only to itself for name resolution, it can become an island and fail to replicate with other domain controllers. For this reason, use caution when configuring the loopback address on an adapter if the server is also a domain controller.
The loopback address should be configured only as a secondary or tertiary DNS server on a domain controller.”
The paragraph switches from using the term "its own IP address" to "loopback" address. This is confusing becasuse technically they are not the same. Loppback addresses are 127.0.0.1 through 127.255.255.255. The resolution section then
goes on and adds the "loopback address" 127.0.0.1 to the list of DNS servers for each interface.
In the past we always setup DCs to use their own IP address as the primary DNS server, not 127.0.0.1. Based on my experience and reading the article I am under the impression we could use the following setup.
Primary DNS: Locally assigned IP of the DC (i.e. 192.168.1.5)
Secondary DNS: The assigned IP of another DC (i.e. 192.168.1.6)
Tertiary DNS: 127.0.0.1
I guess the secondary and tertiary addresses could be swapped based on the article. Is there a document that provides clearer guidance on how to setup the DNS server list properly on Windows 2008 R2 DC/DNS servers? I have seen some other discussions
that talk about the pros and cons of using another DC/DNS as the Primary. MS should have clear guidance on this somewhere.

Actually, my suggestion, which seems to be the mostly agreed method, is:
Primary DNS: Locally assigned IP of the DC (i.e. 192.168.1.5)
Secondary DNS: The assigned IP of another DC (i.e. 192.168.1.6)
Tertiary DNS: empty
The tertiary more than likely won't be hit, (besides it being superfluous and the list will reset back to the first one) due to the client side resolver algorithm time out process, as I mentioned earlier. Here's a full explanation on how
it works and why:
This article discusses:
WINS NetBIOS, Browser Service, Disabling NetBIOS, & Direct Hosted SMB (DirectSMB).
The DNS Client Side Resolver algorithm.
If one DC or DNS goes down, does a client logon to another DC?
DNS Forwarders Algorithm and multiple DNS addresses (if you've configured more than one forwarders)
Client side resolution process chart
http://msmvps.com/blogs/acefekay/archive/2009/11/29/dns-wins-netbios-amp-the-client-side-resolver-browser-service-disabling-netbios-direct-hosted-smb-directsmb-if-one-dc-is-down-does-a-client-
logon-to-another-dc-and-dns-forwarders-algorithm.aspx
DNS
Client side resolver service
http://technet.microsoft.com/en-us/library/cc779517.aspx
The DNS Client Service Does Not Revert to Using the First Server in the List in Windows XP
http://support.microsoft.com/kb/320760
Ace Fekay
MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007 & Exchange 2010, Exchange 2010 Enterprise Administrator, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.
I agree with this proposed solution as well:
Primary DNS: Locally assigned IP of the DC (i.e. 192.168.1.5)
Secondary DNS: The assigned IP of another DC (i.e. 192.168.1.6)
Tertiary DNS: empty
One thing to note, in this configuration the Best Practice Analyzer will throw the error:
The network adapter Local Area Connection 2 does not list the loopback IP address as a DNS server, or it is configured as the first entry.
Even if you add the loopback address as a Tertiary DNS address the error will still appear. The only way I've seen this error eliminated is to add the loopback address as the second entry in DNS, so:
Primary DNS: The assigned IP of another DC (i.e. 192.168.1.6)
Secondary DNS: 127.0.0.1
Tertiary DNS: empty
I'm not comfortable not having the local DC/DNS address listed so I'm going with the solution Ace offers.
Opinion?

Best practices for setting up projects

We recently adopted using Captivate for our WBT modules.
As a former Flash and Director user, I can say it’s
fast and does some great things. Doesn’t play so nice with
others on different occasions, but I’m learning. This forum
has been a great source for search and read on specific topics.
I’m trying to understand best practices for using this
product. We’ve had some problems with file size and
incorporating audio and video into our projects. Fortunately, the
forum has helped a lot with that. What I haven’t found a lot
of information on is good or better ways to set up individual
files, use multiple files and publish projects. We’ve decided
to go the route of putting standalones on our Intranet. My gut says
yuck, but for our situation I have yet to find a better way.
My question for discussion, then is: what are some best
practices for setting up individual files, using multiple files and
publishing projects? Any references or input on this would be
appreciated.

Hi,
Here are some of my suggestions:
1) Set up a style guide for all your standard slides. Eg.
Title slide, Index slide, chapter slide, end slide, screen capture,
non-screen capture, quizzes etc. This makes life a lot easier.
2) Create your own buttons and captions. The standard ones
are pretty ordinary, and it's hard to get a slick looking style
happening with the standard captions. They are pretty easy to
create (search for add print button to learn how to create
buttons). There should instructions on how to customise captions
somewhere on this forum. Customising means that you can also use
words, symbols, colours unique to your organisation.
3) Google elearning providers. Most use captivate and will
allow you to open samples or temporarily view selected modules.
This will give you great insight on what not to do and some good
ideas on what works well.
4) Timings: Using the above research, I got others to
complete the sample modules to get a feel for timings. The results
were clear, 10 mins good, 15 mins okay, 20 mins kind of okay, 30
mins bad, bad, bad. It's truly better to have a learner complete
2-3 short modules in 30 mins than one big monster. The other
benefit is that shorter files equal smaller size.
5) Narration: It's best to narrate each slide individually
(particularly for screen capture slides). You are more likely to
get it right on the first take, it's easier to edit and you don't
have to re-record the whole thing if you need to update it in
future. To get a slicker effect, use at least two voices: one male,
one female and use slightly different accents.
6) Screen capture slides: If you are recording filling out
long window based databse pages where the compulsory fields are
marked (eg. with a red asterisk) - you don't need to show how to
fill out every field. It's much easier for the learner (and you) to
show how to fill out the first few fields, then fade the screen
capture out, fade the end of the form in with the instructions on
what to do next. This will reduce your file size. In one of my
forms, this meant the removal of about 18 slides!
7) Auto captions: they are verbose (eg. 'Click on Print
Button' instead of 'Click Print'; 'Select the Print Preview item'
instead of 'Select Print Preview'). You have to edit them.
8) PC training syntax: Buttons and hyperlinks should normally
be 'click'; selections from drop down boxes or file lists are
normally 'select': Captivate sometimes mixes them up. Instructions
should always be written in the correct order: eg. Good: Click
'File', Select 'Print Preview'; Bad: Select 'Print Preview' from
the 'File Menu'. Button names, hyperlinks, selections are normally
written in bold
9) Instruction syntax: should always be written in an active
voice: eg. 'Click Options to open the printer menu' instead of
'When the Options button is clicked on, the printer menu will open'
10) Break all modules into chapters. Frame each chapter with
a chapter slide. It's also a good idea to show the Index page
before each chapter slide with a progress indicator (I use an
animated arrow to flash next to the name of the next chapter), I
use a start button rather a 'next' button for the start of each
chapter. You should always have a module overview with the purpose
of the course and a summary slide which states what was covered and
they have complete the module.
11) Put a transparent click button somewhere on each slide.
Set the properties of the click box to take the learner back to the
start of the current chapter by pressing F2. This allows them to
jump back to the start of their chapter at any time. You can also
do a similar thing on the index pages which jumps them to another
chapter.
12) Recording video capture: best to do it at normal speed
and be concious of where your mouse is. Minimise your clicks. Most
people (until they start working with captivate) are sloppy with
their mouse and you end up with lots of unnecessarily slides that
you have to delete out. The speed will default to how you recorded
it and this will reduce the amount of time you spend on changing
timings.
13) Captions: My rule of thumb is minimum of 4 seconds - and
longer depending on the amount of words. Eg. Click 'Print Preview'
is 4 seconds, a paragraph is longer. If you creating knowledge
based modules, make the timing long (eg. 2-3 minutes) and put in a
next button so that the learner can click when they are ready.
Also, narration means the slides will normally be slightly longer.
14) Be creative: Capitvate is desk bound. There are some
learners that just don't respond no matter how interactive
Captivate can be. Incorporate non-captivate and desk free
activities. Eg. As part of our OHS module, there is an activity
where the learner has to print off the floor plan, and then wander
around the floor marking on th emap key items such as: fire exits;
first aid kit, broom and mop cupboard, stationary cupboard, etc.
Good luck!

Best practiceS for setting up Macs on Network

Greetings.
We have six Macs on our Windows Server network; three iMacs and three laptops. We have set up all the machines and they are joined to the Active Directory. In the past, we have always created local users on the machines and then "browsed" to the server shares and mounted the them. We've learned things have improved/changed over the years and we're just now realizing we can probably have the machines set up to work better. So, I have a couple of questions for "best practices" when setting up each of the machines.
1. Since we’re in a network environment, should we not set up “local logins/users” and instead have users login using their AD login? It seems having a local account creates some conflicts with the server since upgrading to lion.
2. Should we set the computer to not ask for a “list of users” and instead ask for a username and password for logins?
3. For the user that uses the machine most often, they can still customize their desktop when they use an AD login, correct?
4. Should we set up Mobile User Accounts? What exactly does this do?
Any other advice on how we should best be setting up the clients for our environment to make sure we are following best practices would be great!
Thanks for any help!
Jay

Greetings.
We have six Macs on our Windows Server network; three iMacs and three laptops. We have set up all the machines and they are joined to the Active Directory. In the past, we have always created local users on the machines and then "browsed" to the server shares and mounted the them. We've learned things have improved/changed over the years and we're just now realizing we can probably have the machines set up to work better. So, I have a couple of questions for "best practices" when setting up each of the machines.
1. Since we’re in a network environment, should we not set up “local logins/users” and instead have users login using their AD login? It seems having a local account creates some conflicts with the server since upgrading to lion.
2. Should we set the computer to not ask for a “list of users” and instead ask for a username and password for logins?
3. For the user that uses the machine most often, they can still customize their desktop when they use an AD login, correct?
4. Should we set up Mobile User Accounts? What exactly does this do?
Any other advice on how we should best be setting up the clients for our environment to make sure we are following best practices would be great!
Thanks for any help!
Jay

Best practice for setting or detecting screen size?

Hi All,
Trying to determine a best practice for setting or detecting the screen size. For playbook and iOS, I can set them. But for Android, the number of devices is too large so I'd rather detect. My first choice is to use the stage.stageHeight and stage.stageWidth. This works fine if I set my stage properties with standard meta data:
[SWF(height="320", width="480", frameRate="64", backgroundColor="#010101")]
However, if I use the application descriptor file to set the stage dimentions (as suggested by Christian Cantrell here http://www.adobe.com/devnet/flash/articles/authoring_for_multiple_screen_sizes.html)
<initialWindow>
<aspectRatio>landscape</aspectRatio>
<autoOrients>false</autoOrients>
<width>320</width>
<height>480</height>
<fullScreen>true</fullScreen>
</initialWindow>
Then the stage.stageHeight and stage.stageWidth are not the correct numbers when my main class is added to the stage. Sometime after the main class is added to the stage, then those numbers are fine. Is there an event I can wait for to know that the stage.stageHeight and stage.stageWidth are correct?
Thanks in advance!

Hi Lee,
Thanks for the quick response! However, for some reason the heightPercent & widthPercent metadata tags are not working as expected for me.
I have a wrapper class that I target for compiling, WagErgApplePhone.as where I've got my metadata
[SWF(heightPercent="100%", widthPercent="100%", frameRate="64", backgroundColor="#010101")]
sets some stage properties
stage.quality=StageQuality.LOW;
stage.scaleMode = StageScaleMode.NO_SCALE;
stage.align = StageAlign.TOP_LEFT;
and instantiates my main class
var main:Main = new Main();
addChild(main);
my main class constructor even waits for the stage
public function Main(){
if (stage) init();
else addEventListener(Event.ADDED_TO_STAGE, init);
in my init function, stage.stageHeight traces out as 375 (expecting 320).
i have a function which is called via a button press event by the user, and stage.stageHeight traces out correctly (320) there. that's what makes me think that if i wait long enough, i can get the correct stageHeight before init/drawing. but i'm not sure what event to listen for, or if there's another trick.
if i use Capabilities.screenResolutionX and Capabilities.screenResolutionY the correct values are provided for mobile, but these values are not useful for the desktop and web version of the app. if there's no other solution, i'll execute different code depending on platform.
again, for reference, my app descriptor:
<initialWindow>
<aspectRatio>landscape</aspectRatio>
<autoOrients>false</autoOrients>
<width>320</width>
<height>480</height>
<content>bin-iOS/WagErgApplePhone.swf</content>
<title>WAG ERG</title>
<fullScreen>true</fullScreen>
<renderMode>cpu</renderMode>
</initialWindow>
looking forward to any other ideas to try out & thanks so much for your thoughts! if you want to really dig in, this is an opensource project at code.google.com/p/wag-erg/

(Request for:) Best practices for setting up a new Windows Server 2012 r2 Hyper-V Virtualized AD DC

Could you please share your best practices for setting up a new Windows Server 2012 r2 Hyper-V Virtualized AD DC, that will be running on a new WinSrv 2012 r2 host server. (This
will be for a brand new network setup, new forest, domain, etc.)
Specifically, your best practices regarding:
the sizing of non virtual and virtual volumes/partitions/drives,
the use of sysvol, logs, & data volumes/drives on hosts & guests,
RAID levels for the host and the guest(s),
IDE vs SCSI and drivers both non virtual and virtual and the booting there of,
disk caching settings on both host and guests.
Thanks so much for any information you can share.

A bit of non essential additional info:
We are small to midrange school district who, after close to 20 years on Novell networks, have decided to design and create a new Microsoft network and migrate all of our data and services
over to the new infrastructure . We are planning on rolling out 2012 r2 servers with as much Hyper-v virtualization as possible.
During the last few weeks we have been able to find most of the information we need to undergo this project, and most of the information was pretty solid with little ambiguity, except for
information regarding virtualizing the DCs, which as been a bit inconsistent.
Yes, we have read all the documents that most of these posts tend point to, but found some, if not most are still are referring to performing this under Srvr 2008 r2, and haven’t really
seen all that much on Srvr2012 r2.
We have read these and others:
Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100),
Virtualized Domain Controller Technical Reference (Level 300),
Virtualized Domain Controller Cloning Test Guidance for Application Vendors,
Support for using Hyper-V Replica for virtualized domain controllers.
Again, thanks for any information, best practices, cookie cutter or otherwise that you can share.
Chas.

Best practices for setting environment based static variables?

I have a set of static string variables that hold the url location of modules in a project. These locations change depending on whether I'm building for development, staging or production.
What's the best way to set static variables in this way?

I don't know if this is best practice, but here's the solution I've come up with.
The root domain is accessible within the swf via a node on a loaded xml file. So I created a simple method that sets a url variable based on that domain node.
The domain-based url variable is then used within the static string variables that define the location of the modules.
Simplified like so:
var domain:String = xml.node.value;
static var bucketLocation:String = getLocation()
static var moduleLocation:String = bucketLocation + "modulename.swf";
function getLocation():String
     var loc:String
     switch (domain) {
          case stagingUrl:
              loc = "pathToAmazonStagingBucket";
               break;
          case productionUrl:
               loc = "pathToAmazonProductionBucket";
               break;

How to Set up the User POV in Web Analysis report

Hi , I am new to create the Hyperion Web Analysis report.
I am trying to set up the user POV. I have followed the document and did the below steps.
1. I went to User preference -> OLAP Server -->checked the BOX "Save Filters only for POV".
2. selected the layout and in options checked the Use user POV.
after that I have opened the report in HTML. nothing got prompted.
When I opened the Financial report, It will prompt user to select the year, period, entity, etc... I need the same way in Web Analysis also.
I have selected Accounts in rows, Entity, Year, Period in columns , rest all i kept in Filters.
Could some one please help me how user can get prompted to select the members from dimensions.
Thanks

What you have in Webanalysis is POV and PV
Applying Point of View (POV)
Selecting Personal Variables
You can also look at Oracle - Hyperion Labs......: WebAnalysis - how to show the current user's report when he logs in to see how PV can be leveraged.
There is no prompt option in WebAnalysis
Regards
Celvin
http://www.orahyplabs.com

All the users authorization report

Dear Experts,
I want run the all the users authorization in SAP. I want prepare authorization matrix from all the users.
Please help me on this. Thanks for advance.
Regards
S.Prasad

Hi,
post your query in abap forum.
the following tables are useful to create such report
ROLES BY TCODE ASSIGNMENT
TSTCT
AGR_1251
ROLES BY USERS ASSIGNMENT
AGR_USERS
USER_ADDR
ROLES BY ORGANIZATIONAL LEVEL ELEMENT ASSIGNMENT
AGR_1252
USVART
regards,
kaushal

What is the best practice for setting up and migrating two notebook users on one desktop

My wife and I have just purchased a desktop iMac and would like to migrate our 2 notebooks to it. I plan to use the Migration Application to achieve this. I am trying to gather information on the best ways to establish a main music library merging ours together, multiple photo libraries keeping ours apart and maintaining unique user log ins. I'm sure alot of this stuff is may appear to be pretty straight forward setting up multiple users and all, yet we individually have never established multiple users on our personal notebooks, so there will be some bit of learning. Any advice on the hang ups or tricks users have encountered would be greatly appreciated. Thank you.

Step one would be to the steps in Pondini's Setup New Mac guide and migrate your account, apps, and settings from your machine, using the Setup Assistant on first boot. Then, use the Migration Assistant to migrate your wife's account to the machine. That should carry over her photos and music. Merging those libraries should be detailed in the respective help files for iTunes and iPhoto. I don't share anything and only have one account, so I can't help with those details.

Best practices for setting up users on a small office network?

Hello,
I am setting up a small office and am wondering what the best practices/steps are to setup/manage the admin, user logins and sharing privileges for the below setup:
Users: 5 users on new iMacs (x3) and upgraded G4s (x2)
Video Editing Suite: Want to connect a new iMac and a Mac Pro, on an open login (multiple users)
All machines are to be able to connect to the network, peripherals and external hard drive. Also, I would like to setup drop boxes as well to easily share files between the computers (I was thinking of using the external harddrive for this).
Thank you,

Hi,
Thanks for your posting.
When you install AD DS in the hub or staging site, disconnect the installed domain controller, and then ship the computer to the remote site, you are disconnecting a viable domain controller from the replication topology.
For more and detail information, please refer to:
Best Practices for Adding Domain Controllers in Remote Sites
http://technet.microsoft.com/en-us/library/cc794962(v=ws.10).aspx
Regards.
Vivian Wang

What is the best practice to set Captivate variables from Get (less ideal) and Post (more ideal)?

We are trying to set a couple of variables in Captivate 7 by posting the information from a URL. Is there a best practice for doing this, or does it require a custom JS or other call in order to do this?
Essentially, we want to pass three variables from a URl to named variables in a Captivate 7 swf so that the information can be drawn from a database, and does not need to be entered by the user.
Suggestions, thoughts, pointers to where we may be able to find this information - all would be greatly appreciated!

Not sure how Captivate treats FlashVars internally, but the native html template includes a script to read URL parameters:
var strURLFull = window.document.location.toString();
var intTemp = strURLFull.indexOf("?");
var strURLParams = "";
then:
if(strURLParams != "")
so.addVariable("flashvars",strURLParams);
It also has a script to add variables but you'd have to parse the variables first first to use it:
so.addVariable("variable1", "value1");

Best Practice: Deploying Group Policy to Users on different OUs

Greetings, everyone! I am needing some advice on how to deploy some group policy objects to specific users stored on different OUs.
Let me set the stage: I work for a large school district, and have recently taken over the district's career center. The idea behind the career center is that students from different high schools around the city come in to take classes based on their choice
of career, such as radio broadcasting or auto mechanic and such. The AD structure is set up so that each school has their own OU. When a user (staff, student, etc.) is assigned to a school OU, they automatically are added to
their school's security group (i.e. EASTHIGH-STUDENT), and that when any user moves from one school to another, we have to move their AD account to that school's OU, which will remove the security group from the old school and apply the new school
security group.
For the career center, since we have students coming from different buildings every day, rather than trying to find a way to move their AD account from their high school OU to the career center OU, the previous techs created generic accounts (such as tv001,
tv002, etc.) in AD and stored them in the career center OU. This way, teachers can assign students that particular generic account so that they can access the drives and printers from the career center, as well as access the career center network
drives while they are at their home high school.
Since I have moved to the career center, and apparently I have more knowledge about group policy than most of the techs in the district, the district system engineers want me to remove all of the generic accounts from the career center OU, and have students
use their own AD accounts. Obviously I also want to do this since the generic accounts are very confusing to me, but I'm trying to figure out the best way to do this.
For simplicity sake, I'm just going to start off by figuring out how to set up a group policy for mapping the career center drives. Now, I obviously know that the best way would be to create security groups for each career area, and that we would need
to add students to those groups so that only those particular students would get the GPO for the career center, but my question is where would I like the group policies to? Do I need to link it at the root of the domain so that every OU is hit?
Just curious about this.
Thanks!

Don't link it to the root.... apply the drive mapping as a policy at the OU or you could apply the drive mapping using Group Policy Preferences using security group targeting... .I would also strongly recommend you check out my articles
Best Practice: Active Directory Structure Guidelines
– Part 1
Best Practice: Group Policy Design Guidelines – Part 2
Hope it helps...

Best practice to set up the user authorization

Similar Messages

Maybe you are looking for