How to simplify the Window AD Security admin?

Question

Does anyone use window AD security? We use window AD, so we created group like BOE report writer, BOE admin. I also created application group, like Application webi. Application desktop, etc., The BOE report writer is member of Application WEBI, since the window AD group canu2019t create the subgroup. However, I also have these Business function groups, for example, the Executive User that can access particular universes and reports. How to simplify to tie to these together, so BOE report writer user can assign to different business functional groups besides assigned user one by one?

Answer 1

Hi Sharon,
So in enterprise you will have 2 group types it sounds like from your description.
AD groups that are mapped into the CMC from Active Directory
and Enterprise Groups created in BO CMC.
You can make AD groups members of Enterprise groups but not the other way around.
You can assign permissions to AD groups directly or make the AD group a member of enterprise groups as you stated so they can inherit permissions.
If you are going to assign permissions to AD groups please make sure you are on XIR2 SP2 FP 2.4 as the way the CMS queries AD and updates the graph was fixed in that version to allow the AD plugin to function if something happens on the AD side.
You can assign any group any permission (folders, users, applications, universes, etc)
Is there something more specific you are looking to do?
Also to note: Permissions have been greatly enhanced in XI 3.0 You may be interested in trying this out as well where you can create custom access levels that have access to any combination of access rights in the CMC.
Regards,
Tim