CSM per admin group using per device group

I am looking to see if multiple admin and device groups can be created to limit certain administrators to administrate only certain devices but not others.
For example:
admin group "ag_na" (including user admin1 & admin2) can make changes to device group "dg_na" containing (device 1, device 2) only
admin group "ag_ca" (including user admin3 & admin4) can make changes to device group "dg_ca" containing (device30 & device31) only
Any tips on if / how to do this?
Thanks

You can do it by integrating the CSM into an ACS v4.2 and doing RBAC. There you can define for which NDGs a user has which access policy.
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/installation/guide/aduser.html#wp1063220
Unfortunately this is a short-therm solution as ACS v4.2 has been put to EoS and no real alternative methods are available today. Hopefully Cisco will come up with a new solution on the long-therm.

Similar Messages

Adding users in Local Administrators Group using GP Restricted Group

Hi Experts.
I have approx 200 servers. There are user1, user2 and user3 which I have added in
Local Administrators Group using GP Restricted Group in all 200 servers. This works fine. In Add Group option I added "Administrator" and Added user1, user2 and user3 in "Members of this Group". Now all 3 users are reflected as a Local
Administrators member.
Now there is a need that user 4 should be in Local Administrators Group using GP Restricted Group for certain servers only. Lets say 50.
In Add Group option I added "Administrator" and Added user4 in "Members of this Group". BUT it doesn't work.
Any idea?
Regards Suman B. Singh

Hi,
How is it going? I agree with Martin. To do this, we can configure the setting in two different GPOs. For instance, in GPO1, we add user1, user2, and user3 to the local admin group; in GPO2, we add user1, user2, user3, and user4 to the local admin group;
and then we can use Security Filtering to apply the specific GPOs to specific computers.
Regarding security filtering, the following article can be referred to for more information.
Security filtering using GPMC
https://technet.microsoft.com/en-us/library/cc781988(v=ws.10).aspx
Filter Using Security Groups
https://technet.microsoft.com/en-us/library/cc752992.aspx
Besides, in addition to Restricted Groups, we can also use Group Policy Preferences Local Users and Groups to do this, in which way we can configure two Local Group items in one GPO and utilize Item-Level Targeting to apply the specific items to specific
computers.
Regarding GPP Local Users and Groups, the following article can be referred to for more information.
Configure a Local Group Item
https://technet.microsoft.com/en-us/library/cc732525.aspx
How to use Group Policy Preferences to Secure Local Administrator Groups
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
Regarding Item-Level Targeting, the following article can be referred to for more information.
Preference Item-Level Targeting
https://msdn.microsoft.com/en-us/library/cc733022.aspx
Best regards,
Frank Shen

Profile Manager - Device Group member of Device Group

Hi Everyone,
I have an iPad which is a member of a group on Profile Manager. This device group is in another device group...
EG.
Staff iPads (setting a generic profile of security etc.)
> Site One iPads (setup to use a certain SSID etc. etc.)
> Site Two iPads (setup to use another SSID etc. etc.)
Am I right in saying the profiles should be applied much like group policy - so the top level profile is applied then ones lower down the tree?
If so, anyone got any idea why ours arent?
Cheers
John Rickard

We have device groups, once the device have been enrolled we then move to a pre-configured profile which sets up items such as wifi, e-mail and passcpde etc all in one go, this has had mixed results, I've now setup profile groups for each item to give us more control over only given the user what they need instead on forcing everything, this resolved my item above but more testing is needed, the main issue has been trying to pass a pre-owned device to a new user as it seems to remember the pervious user in some cases, this is why I asked about if it was possible to delete device history.

Apps per "playlist"? Using multiple devices to one itunes account.

Hi,
Perhaps it's a silly question...but I run into a sync issue.
we have itunes running on one PC, and have two ipod touches and one ipad, all under the same apple account.
When I synced my new ipad, itunes tried to sync all my 100+ ipod apps on my pc to my ipad....That was not the idea, so I cancelled and put the apps I wanted (10 or so) on my ipad "by hand"
Is there a way to create lists (playlists?) with apps PER device? So that you can only sync that specific list to that specific ipod or ipad?
Thx, FF

However, when I connected my "fresh" iPad, it immediately started to sync (set to automatic sync), and started to put all my 100 or so iPod Touch apps to my iPad....They were all checked.
It's been a while since I connected a fresh iPad, but I believe that doing a full sync is the default. Stopping the sync and changing what apps you wanted was the correct procedure.
So, next time I connect the iPad, it "knows" which apps need to synced, and does not try to sync "all" apps?
Correct. I do that all the time with my two iPads, each of which have a different set of apps, music, videos, etc.
Regards.

1) Device groups

First question:
Workstations (devices) are currently allocated under /Devices/Workstations to
folders that represent the office location of the workstation.
Is there a way to create device groups without removing the devices from their
primary location-related folder?
Is there a way to use AD device groups to assign bundles?
What's the latest thinking on to how to apply a constraint on a bundle to apply
both "user-membership-in-AD-group", and "device is approved for this app"?
e.g. I know I can add "specified devices" as a requirement, but that demands
adding individual workstations and I see no way to add device groups, which can
be very tedious if I want, for example, "this app can install for these users
on these 200 devices".
Thanks.
-- DE

Originally Posted by DE
thsundel wrote:
> Yes, create a workstation group and add the computers you want as
> members (they will not be removed from their "location-related" folder.
OK, so I want to be sure that I am understanding ...
Currently the workstations are in, say,
/Devices/Workstations/bigcity1/desktops
/Devices/Workstations/bigcity1/laptops
/Devices/Workstations/bigcity2/desktops
/Devices/Workstations/bigcity2/laptops
They need to stay in those folders, for obvious reasons. And unfortunately,
this will never match up to AD because it starts at the top level by
differentiating between workstations & servers, while AD identifies "computers"
that are placed into whatever AD structure you define.
In any case: So I can create device groups that won't result in them being
moved out of those folders?
IOW, I could define a device group that contained the systems that were allowed
to have a certain app installed, and that group membership won't disrupt the
above folders?
And are we talking about Dynamic device groups (which I've never used) or are
there other regular "device groups" that don't just represent the structure above?
Thanks again. I have a feeling that others before me have already requested an
enhancement that device groups be an option in Requirements, since I think I've
read discussions of these same issues here in the past.
-- DE
Yes, just create e "regular" Device Group where ever you want in the folder structure and add workstations as members.. You probably hava a test workstation that you can try with if your not confident.
Thomas

MARS Device Groups

I am working with MARS 4.3.4 and have a question on what you can do with Device Groups. I don't see where they can be referenced in queries or rules. Am I missing something?

No, you're not. They're somewhat pointless really. You can create them, but they're only used to filter what is displayed, you still have to manually select each individual device in a query.
In other words, you can't create a report using a device group and expect future updates to the device group to show up in the report.
FWIW, there are lots of other "groups" like this too. Protego/Cisco seems to have forgotten the real value of making groupings like this.

NCM Device Group owner

We are currently running NCM 1.3 (Build 4045-112607). I am wondering if it is possible to define a default owner for Sites, Parent Device Groups, and Device Groups? Our dilemma is we have several engineers with the ability to create these containers. Once an engineer leaves you cannot delete their account as long as they are owners of a Site, Parent Device Group, or Device Group. I know if you have admin privileges you can select the owner of the Device Group at creation. Is there a way or is it possible to select/change the owner of a Site or Parent Device Group?

Hello Thorsten, I checked your helpful link, but it doesn't change the situation.
In my opinion I have an inconsistency in the ccr repository, but it is not my intention to edit it directly.
On node is left, and the diskset is Online:
! root@pixtest1:/ # scstat -D
-- Device Group Servers --
                         Device Group        Primary             Secondary
Device group servers: jboss-set           pixtest1            pixtest2
-- Device Group Status --
                              Device Group        Status
Device group status:        jboss-set           Online
-- Multi-owner Device Groups --
                              Device Group        Online Status
! root@pixtest1:/ # metaset -s jboss-set -d -h pixtest2
metaset: pixtest1: jboss-set: host pixtest2 is not in the set
! root@pixtest1:/ # metaset -s jboss-set -d -h pixtest1
metaset: pixtest1: Failed to delete hosts from DCS service: No such file or directory
! root@pixtest1:/ # metaset -s jboss-set
Set name = jboss-set, Set number = 2
Host                Owner
pixtest1      No messages are logged in syslog as I execute the commands.
-- Nick

Percentage based on Status using per group

Hi Gurus,
Can you help me with this? You have any approach of getting the percentage based on status using per group?
Currently I have this code below but it doesn’t have result but no error. I am trying to get the % In Complete.
<?xdofx:(sum(current-group()/NUMINCOMPLETE)/(sum(NUMSUBMITTED) + sum(NUMCOMPLETED) + sum(NUMINPROGRESS) + sum(NUMINCOMPLETE)))*100?>
Thanks Much,
JP
Edited by: BIPnewbie on Feb 6, 2012 3:05 AM

Use this:
<?xdoxslt:div(sum(current-group()/NUMINCOMPLETE), ((sum(NUMSUBMITTED) + sum(NUMCOMPLETED) + sum(NUMINPROGRESS) + sum(NUMINCOMPLETE)))*100?>
Thanks,
Bipuser

Get count per each group using t-sql

Hi All, I have a table with 5 columns and my source data looks like this...
ID    Doctor     NurseType    VisitID      Date
1      Sam       Main-Nurse      10        09/23/2013
1      Tom       Sub-Nurse       10        09/23/2013
1                   Sub-Nurse       10        09/23/2013
2      Ryan      Sub-Nurse       24        10/29/2013
2      Ron       Main-Nurse      24        10/29/2013
3                   Main-Nurse      35        04/12/2014
3                   Main-Nurse      35        04/12/2014
3                   Sub-Nurse       35        04/12/2014
3                    Main-Nurse      40        05/12/2014
3       Greg      Main-Nurse      40        05/12/2014
3                    Sub-Nurse       40        05/12/2014
4       susan     Main-Nurse      45        06/12/2014
4       Roby       Main-Nurse      45        06/12/2014
4                     Sub-Nurse       45        06/12/2014
I want output to be in this format. I want number of doctors present in each ID group per each date using t-sql.
Output:
ID      Comments      VisitID      Date
1       2 doctors       10        09/23/2013
2       2 doctors       24        10/29/2013
3       0 doctor        35        04/12/2014
3       1 doctor        40        05/12/2014
4       1 doctor        45        06/12/2014
Note:
1)NurseType column always will have Main-Nurse and sub-nurse values.Each ID group will have minimum one main and sub-nurses.
2) In the above sample date , Id=3 repeated 2 times becoz visitID and date is different.
3) Also in ID=4(records), even though we have 2 doctors susan and roby we consider them as one doctor becoz NurseType is same(main-nurse).
4) Values in the comments field will always be 2 doctors , 1 doctor and 0 doctor. Rules for populating this column
a) In a ID group if Main-Nurse and sub-nurse has nay doctors then will show as 2 doctors.
b) In a ID group if Main-Nurse or sub-nurse (any one) has doctor then will show as 1 doctor.
c) In a ID group if Main-Nurse and sub-nurse both doesn't have any doctors then will show as 0 doctor
Create statement:
Create table sample ( ID Int null ,Doctor varchar(25) null,NurseType varchar(20) null ,VisitID int null,Date datetime null)
Insert statement:
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (1,'Sam,Main-Nurse' , 10 , '09/23/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (1,'Tom,Sub-Nurse' , 10 , '09/23/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (1, ,'Sub-Nurse' , 10 , '09/23/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (2,'Ryan','Sub-Nurse'   , 24 ,10/29/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (2,'Ron' , 'Main-Nurse' ,     24,'10/29/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, , 'Main-Nurse' ,     35 ,'04/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, , 'Main-Nurse' ,     35 ,'04/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, , 'Sub-Nurse' ,      35 ,'04/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, , Main-Nurse',      40 ,'05/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3,'Greg', 'Main-Nurse',      40 ,'05/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, , 'Sub-Nurse' ,      40,'05/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (4, 'susan' , 'Main-Nurse' ,      45,'06/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (4, 'Roby' , 'Main-Nurse' ,      45,'06/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (4, , 'sub-Nurse' ,      45,'06/12/2014')
Thanks.
sql

I had to correct the sample script a bit. The query you are asking for comes after the inserts.
Create table sample ( ID Int null ,Doctor varchar(25) null,NurseType varchar(20) null ,VisitID int null,Date datetime null)
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (1,'Sam','Main-Nurse' , 10 , '09/23/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (1,'Tom','Sub-Nurse' , 10 , '09/23/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (1, NULL,'Sub-Nurse' , 10 , '09/23/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (2,'Ryan','Sub-Nurse' , 24 ,'10/29/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (2,'Ron' , 'Main-Nurse' , 24,'10/29/2013')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, NULL, 'Main-Nurse' , 35 ,'04/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, NULL, 'Main-Nurse' , 35 ,'04/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, NULL, 'Sub-Nurse' , 35 ,'04/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, NULL, 'Main-Nurse', 40 ,'05/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3,'Greg', 'Main-Nurse', 40 ,'05/12/2014')
Insert into sample (ID,Doctor,NurseType,VisitID,Date) values (3, NULL , 'Sub-Nurse' , 40,'05/12/2014')
go
SELECT ID, COUNT(Doctor) DoctorCnt, VisitID, Date
FROM sample
GROUP BY ID, VisitID, Date
go
DROP TABLE sample
Erland Sommarskog, SQL Server MVP, [email protected]

Multiple Network Device Groups when importing to ISE using template

I have a question about importing a group of network devices into ISE using the template provided. The template only has a single column for Network Device Groups - is there a way to import devices and include more than one NDG? For instance, the NDG's we use are "Device Type" and "Location". I'd like to include both when doing my import and I've tried multiple ways to seperate the two strings within the column (comma's colons, semi-colons, spaces, pipes, tabs, etc), but i always get an error message that "NDG group does not exist". I also tried adding a new column into the template, but that just plain failed to import.
If there is any way to do this, I would appreciate any advice on how - I have to add about 40 devices per week to our ISE deployment and I'd rather not have to go in and add any parameters manually if it can be helped. Thanks very much!
Ross
BTW, we are running ISE ver 1.1.2 in case it is relevant.

Yes, you can do it. You have to use the pipe "|" to separate the groups. But please notice you must create the network device groups in advance.
For example, I have the following groups in my csv file to import a lot of network devices
Device Type#All Device Types#SWITCHES#375O-X|Location#All Locations#PERU#LIMA
But as a pre-requisite I have to create the network device groups.
If you have lots of network device groups, you can mass import them instead of creating them one by one.
Please rate if it helps

Sales Analysis query per item group summarized per BP Group

Dear experts,
My client is requiring me to create a query that when i select a certain item group it returns a sum/total of sold items in that group per BP group
format:
parameter: Item Group A
BP Group A    1,000
BP Group B    2,000
BP Group C   1,000
I have managed to get total sales per BP Group but i cant seem to figure how to break it down per Item Group
here is my query:
SELECT T2.[GroupCode], SUM(ISNULL(T0.Debit,0) - ISNULL(T0.Credit,0)) as "Amount(LC)" FROM JDT1 T0 INNER JOIN OJDT T1 ON T0.TransId = T1.TransId and T0.TransType IN (13,14)
INNER JOIN OCRD T2 ON T2.CardCode = T0.ShortName
WHERE T1.[RefDate] BETWEEN [%0] and [%1]
GROUP BY T2.[GroupCode]
how can I link Item Groups to JDT1?

Hi Carlo
Try This
SELECT t5.ItmsGrpNam AS ItemGroup,
   t7.GroupName AS BPGroup,
   SUM(ISNULL(T0.Debit,0) - ISNULL(T0.Credit,0)) AS "Amount(LC)"
FROM JDT1 T0
INNER JOIN OINV T1 ON T0.transid = T1.transid
LEFT OUTER JOIN INV1 T3 ON T1.docentry = T3.docentry
LEFT OUTER JOIN oitm T4 ON t4.itemcode = T3.itemcode
LEFT OUTER JOIN oitb T5 ON T4.ItmsGrpCod = T5.ItmsGrpCod
INNER JOIN ocrd T6 ON T0.ShortName = T6.CardCode
INNER JOIN OCRG T7 ON t7.GroupCode=t6.GroupCode
WHERE T1.DocDate BETWEEN [%0] AND [%1]
GROUP BY t5.ItmsGrpNam,
   t7.GroupName
Rgds

"Make proxy settings per-machine (rather than per user)" Group Policy setting not applied until login as a local Administrator

We want to deploy to all our desktop the pac file to configure proxy. We have a Windows 2008 R2 server, and i've enabled the GPO "Make proxy settings per-machine (rather than per user)", and i've add a registry key AutoConfigURL in "HKLM\Software\Microsoft\Windows\Current
Version\Internet Settings" with the pac file link.
I've tested on my pc, and all was configured without any problem. I've try to login to my computer with another user (without admin rights) and the automatic configuration proxy was compiled and not modificable. It's seems that all works.
But, our users are not local admin, so i've tried to deploy the GPO in a collegue computer. I've forced the update of GPO, checked on registry that all new keys are added, and i've reboot the pc. When i've check on IE settings, autoconfig URL was empty and
grey. I'm disconnected from user and i've login to the pc with a local admin. With my surprise, the IE settings was compiled. When i'm come bac to the user profile the IE settings was compiled and not modificable.
The problem is: i've over 750 users in 3 countries, and i don't want grant them the local admin permissions. How can i configure proxy settings via GPO without login to every machine at least one time?

> have a Windows 2008 R2 server, and i've enabled the GPO "Make proxy
> settings per-machine (rather than per user)", and i've add a registry
> key AutoConfigURL in "HKLM\Software\Microsoft\Windows\Current
> Version\Internet Settings" with the pac file link.
In the past, we experienced various issues with machine proxy settings,
so we don't use them anymore. The simple approach:
Block access to the connections page through ADM template settings and
deploy the proxy through GPP Internet Settings.
This is what we do (with a pac file, too), and it works well :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Cisco ACS Group Settings per NDG

I am trying to figure out if there is a way to make certain settings that fall under a group configuration such as:
Usage Quotas,
Time of Day Access,
Max Sessions
to apply differently depending on which network device group the user is coming from.
So for example if Jsmith belongs to group Staff and is coming from the VPN he will have one time of day access rules configured, where if he 802.1x's on a device in another NDG he gets another time of day access rule?
I know you can apply ACL's based on the NDG the user is coming from, but it seems like the other options I mentioned above should be able to be controlled by NDG as well.
We are running v3.3 of ACS.
Any suggestions?

I dont think so that is possible. You have option of NAP where in you can define what database to be used for specific user. Or if users comes from wireless use AD and if users comes for VPN use RSA DB.
Please see this link,
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/NAPs.html
Regards,
~JG
Do rate helpful posts

HT1918 Hello! Staff of E4 Group JSC use Apple devices for call, reading email and calendars. When the user open event in calendar of iPhone or iPad, he does not see attachments (picture №1, picture №2). But it is possible on Blackberry (picture №3).

Hello!
Staff of E4 Group JSC use Apple devices for call, reading email and calendars. When the user open event in calendar of iPhone or iPad, he does not see attachments (picture №1, picture №2). But it is possible on Blackberry (picture №3). How user of Apple can see these attachments? Recommend please any apps for it.

Hello!
Staff of E4 Group JSC use Apple devices for call, reading email and calendars. When the user open event in calendar of iPhone or iPad, he does not see attachments (picture №1, picture №2). But it is possible on Blackberry (picture №3). How user of Apple can see these attachments? Recommend please any apps for it.

Adding a domain user to Local Admin Groups using MDT 2012

I don't know if this will help anyone, but it did me after weeks of searching. If you are trying to add a domain user or domain groups to the local administrators group using MDT, simply go to the cs.ini and add "SkipAdminAccounts=No".
But the administrators accounts page will only appear if you choose to join a domain.

Correct, if you were to go into the %DeployRoot%\Scripts\DeployWiz_Definition_ENU.xml file you would see the entry for the DeployWiz_AdminAccounts.xml page as follows:
<Pane id="AdministratorAccounts" reference="DeployWiz_AdminAccounts.xml">
<Condition><![CDATA[ UCase(Property("SkipAdminAccounts")) = "NO" and UCase(Property("DeploymentType"))<>"REPLACE" and Property("DeploymentType")<>"CUSTOM" and Property("JoinDomain") <> "" ]]></Condition>
</Pane>
Most Wizard Pages are displayed by default, and you can turn them off by using the SkipXxxXxxxxx Page variable to hide them during wizard execution. This page is different, since it was added for MDT 2012, the MDT team decided to leave it *OFF* by default,
instead you must explicitly turn off the SkipAdminAccounts variable by setting it to "NO".
Additionally, you would not need to display this page if you were running a Refresh or a Custom Task Sequence.
Finally, this page does not actually *create* accounts, instead it just adds pre-existing user accounts and adds them to the local Administrators group. This scenario is only valid when you are joining the machine to a domain, so you must Join to the Domain.
If you are interested in adding other local users to the Administrators Group, you should write a script to create the account(s) and add them to the local group. Windows 8.1 has some *gotchas* that have to do with Microsoft Accounts, but that's a different
Story :^).
Keith Garner - keithga.wordpress.com

CSM per admin group using per device group

Similar Messages

Maybe you are looking for