Limit change access to all useres exept the one that created the document

Hi,
I wonder if it's possible to limit the change access only to the user that has created the document when it's in a specific status.
This is what the customer wants:
When a document is set to status K the document should be locked and no other users should be able to create a new version.
There should be a admin group that can create new versions and change the document. - This is solved
Best regards Kristoffer

Hi Krip,
generally I would recommend you to maintain one status of type 'O' for a document type in your system. This kind of status will allow a second user to display an already checked out original. If user A checks out the original and there is such a status maintained for this document type the system will change the status automatically to this status of type 'O'. Then a second user is able to display the last checked in version of this original in CV03N too. Without such status type the second user is not able to display the checked out file. This was implemented to avoid that two users may be able to change the same original at the same time. I hope this information could be useful for you.
Best regards,
Christoph

Similar Messages

The kerberos PAC verification failure when all users of only one RODC Site, trying to get access iis webpage of different site using Integrated Windows Authentication

The kerberos PAC verification failure when all users of only one Site which having only one RODC server(A), trying to get access iis webpage of different site which having WDC server(B) using Integrated Windows Authentication. But when they accessing the
website using IP address, it is not asking for credentials as I think it is using NTLM Authentication at that time which is less secure than Kerberos.
Note that:- All user accounts and Computers of the RODC has been allowed cache password on the RODC. Nearest WDC for the RODC (A) is the WDC (B).
The website is hosted on a windows server 2003 R2 and generating below system event log for those users of the RODC site :-
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 7
Date:
<var style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">date</var>
Time:
<var style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">time</var>
User: N/A
Computer:
<var style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">computer_name (the 2003 server)</var>
Description: The kerberos subsystem encountered a PAC verification failure. This indicates that the PAC from the client<var style="color:#333333;font-family:'Segoe
UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">computer_name</var> in realm <var
style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">realm_name</var> had
a PAC which failed to verify or was modified. Contact your system administrator.
This issue has been raised for last one week. Before that everything was fine. No Group Policy changed, Time also same.
In this situation do I need to do Demotion of the RODC and re-promote it as RODC again or is there any other troubleshooting to resolve it.
Thanks in Advanced
Souvik

Hi Amy,
Thanks for your response
I noticed that Logon server could become incorrect again after user re-login or restart of a workstation.
It seems root cause is different. Need a permanent solution.
The Workstations of the RODC site are getting IP from a DHCP server by automatic distribution of IP from a specific subnet for the site only. The RODC is
the Primary DNS server for the site.
I have checked the subnet and it is properly bound with only with that AD site. The group of users and workstations are in the same site AD organisational Unit.
Sometime I restarted the NET LOGON service and DNS server service on ther RODC server and sometime rebooted the server. But the Logon server issue has not fixed permanently.
The internal network bandwidth of the site is better than the bandwidth to communicate with other site.
The server is Windows server 2008 R2 standard and hosting the below roles
RODC
DNS
File server
The server performance is Healthy in core times when maximum users usually logins.
Any further support would be much appreciated Amy
Thanks
Souvik

Where do I put a workflow so that all users on the Mac can access?

Where do I put a workflow so that all users on the Mac can access it from Automator?
Also. why does the search pattern "users" AND "workflows" return results whitch math "and" (lowercase)? I thought "AND" (in caps) is for boolean searches.

Hi, Mike.
1. You wrote: "Where do I put a workflow so that all users on the Mac can access it from Automator?"Either:
• Macintosh HD > Users > Shared
• Macintosh HD > Applications (if you're the Admin user).
All users (unless restricted by Parental Controls) have access to those folders.
2. You wrote: "Also. why does the search pattern "users" AND "workflows" return results whitch math "and" (lowercase)? I thought "AND" (in caps) is for boolean searches."It's unclear as to what search facility you are referring, and a bit hard to follow given the spelling errors in your question.
Do you mean Discussions search? If so, have you reviewed the Search Tips? They're also available from the search page, where one can click "Tips" under the Search Terms field.
Good luck!
Dr. Smoke
Author: Troubleshooting Mac® OS X

You do not have sufficient privileges to complete this installation for all users of the machine. Log on as administrator and then retry this installation

Hi all
Have seen a couple threads regarding this but unfortunately nothing that solves my problem thus far!
Right now, our developers are using the Domain Admin account to promote their website code using MSI files. I'd like to change this as I feel the Domain Admin account should be on lock down and only used when absolutely necessary, pretty common. The
same goes for my account too, I would like to absolve as much use of the Domain Admin as I can.
Problem is, when they run installers from their own accounts, they receive this error: You do not have sufficient privileges
to complete this installation for all users of the machine. Log on as administrator and then retry this installation
The accounts they are using are part of the Built In Administrators group and the Domain Admins group... I'm not sure what other permission you'd need in a domain? We've gone as far as explicitly giving them local admin access on this server and still
nothing changes.
Is there a Group Policy or something that I can change to provide install rights and possibly remove these accounts as Domain Admin and more along the line of Power User?
Thanks much for your help!
Ryan

Hi,
You could use Software Restriction Policies (SRP’s) or Applocker(supported on Windows server 2008 R2/Windows 7 only) to restrict the running
of the application for specific user.
Description of the Software Restriction Policies
http://support.microsoft.com/kb/310791
HOW TO: Restrict Users from Running Specific Windows Programs
http://support.microsoft.com/kb/323525
How to Implement Group Policy Security Filtering
http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.htmlPlease remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

HELP needed on Remote Management set to allow access for all users

my mac mini snow leopard server runs in a data center and i use screen sharing to interact with it. i played with the sharing settings remotely yesterday and changed "allow access for" to all users. i was disconnected immediately and i couldn't logon again. i have no luck changing to other users. i don't want to make a special trip to the center to change it back to whatever it used to be. i can still use afp to connect but the screen sharing option is no longer available. what does "allow access for all users" mean anyway?
thanks!

As its name implies, allow access for all should allow any valid user account to access the server. I'm not sure why it's no longer working. It almost sounds like the ARDAgent crashed.
Either way there's a command-line interface to the ARD preferences:
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/ki ckstart
man kickstart discusses the options, including examples of how to enable access for specific users.

Exchange 2013 Give domain Admin access to all users inbox

In the old 2007 exchange server we had domain admin access to everyones mailbox so we could open anyones email box using outlook client.
But in 2013 exchange the mailbox delegation does not give us the option to add a "group" to the full access area, old allows to add a "user" who has a mailbox setup in exchange. I see there is Exchange Server group listed under Full Access
, but it does not work added our domain Admin user to that group rebooted exchange and the test machine but did not work.
Only option that works to allow mounting of xyz users mailbox via abc admin user is to actually add that abc admin user to the xyz mailbox under mailbox delegation > Full Access.
Is there a work around this, so we can simply have a group ABCD with user ABC or DEF etc. etc. so they can access everyones mailbox instead of going in and changing all users mailbox delegation one by one for the new user etc. ?

Have you tried using the Exchange Management Shell?
Get-Mailbox | Add-MailboxPermission -User Name_of_Group -AccessRights FullAccess -InheritanceType All
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
I did i tried get-mailboxpermission and other than NT Authority and the end user the Deny was set to True for all inheritance rights. I tried your command, added user to the group i wanted under Enterprise OU in AD and restarted transport on exchange and
logged in on the test machine again.
Still no go, the user I am trying to add when using get-mailboxpermission shows up as Denied for fullaccess so is that overriding the group permissions ?
RunspaceId      : 2xxxxxxx0
AccessRights    : {FullAccess}
Deny            : True
InheritanceType : All
User            : domain\abc
Identity        : domain/Users/xyzuser
IsInherited     : False
IsValid         : True
ObjectState     : Unchanged
And for the group i just added with the above abc user inside it:
RunspaceId      : 2xxxxxxxxx0
AccessRights    : {FullAccess}
Deny            : False
InheritanceType : All
User            : domain\newgroupadded
Identity        : domain/Users/xyzuser
IsInherited     : False
IsValid         : True
ObjectState     : Unchanged
So is the users deny is causing this ? Not really sure why ABC domain admin/enterprise admin is the only one listed as no deny, there are other mailbox users that do not show up, I am assuming I have to create a new user a domain local user and that might
work ? I wanted the Domain/Enterprise Manager/admin to have access so we would not have to keep toggling between users just to access someones inbox.
Also further down the list of mailboxpermission i see the user abc (the user i want to add to the group to have access) is listed with Full access and Deny flag is set to False instead of True.
So have two entries for user abc one with deny flag set to true and one with deny flag to false.
AccessRights    : {FullAccess, DeleteItem, ReadPermission, ChangePermission, ChangeOwner}
Deny            : False
InheritanceType : All

HT1660 how can I use one single library for all users on the same laptop?

how can I use one single library for all users on the same laptop?

You are most of the way there. Each user having access to hard drive is the key. If users are limited in file privileges this is harder.
Any files you add to your library and any files she adds to her library are available to the other. Just not automatically. Each user must add the files to their own library using the add file or add folder option from menu bar.
What I have done is set library location to a location outside of My Documents\My Music. On my network storage I have a folder names s:\itunes. Both accounts iTunes are set to use this location for the library.

How to change preferences for all users in a Citrix enviroment

Hello.
I need change some preference settings for all users in my Citrix enviroment.
I know change the preference settings for a user, of course, but a have 160 users and a need to change some settings configuration one time on the server for all users.
The preferents I need change are: 'disable javascript' and 'don't show pdf in IE'
Thanks.

Hi Arti,
In cProjects the authorizations can be managed either by authorization profile administration by system administrator for General authorizations or by Project specific authorizations for individual cProjects elements by Project owner.
Try the first one and I hope you will get the solution.
Regards,
Nishit Jani
Award points only if you find the information useful.

When Rating a Document it disapears from users exept the Author

Hi,
I created a Folder with Everybody Read permisions and the Owner Full Access(by default) and there is something happening, this Folder is into an Aproval Workflow and the documents in the folder gots into that workflow, I create a document, submit it for aproval, the aprovers do aprove it and then it is displayed to every user..... but when one user rates the document it disapears from the users view and the only one that can see the document is the owner and the status of the document become as if it has not been approved and I have to send the document again to the approval process so it can be displayed again.
Has this happened to somebody else? I have EP Portal & KMC SP17.
Thanx in Advanced!!
Gerardo J

Hi Gerardo,
yes, I can confirm this behavior on SPS17.
Please open a OSS ticket so that this bug can be fixed with an upcoming patch.
Best regards,
Robert

I am unable to change passwords for any users. The "change password" is grayed out.

I am unable to change passwords for any users. The "change password" is grayed out. I know there is a way to change them but I am having trouble finding it.
Message was edited by: dmw1975

If you're in the Users pane of the server app, and you select Network Users from the drop-down near the top, there's a small padlock icon at the bottom. Is it locked or open? If locked, click it and enter credentials into the authorisation box that opens

Adobe Captivate 7 - distributing settings to all users on the same computer?

Is there a way to share preference to all users on the same computer?
Perference->General settings:
[ ] show welcome screen
Publish at: c:\newpublishdir\
Project cache: c:\projectcachedir\
Perference-> Recording->video demo:
Working folder: c:\testdir\
The dirs I listed is just for example

Hi there
If what you are asking is if there is a way to configure all users so they have identical preferences, you might try this:
From any account on the computer, open Captivate. Click Edit > Preferences and ensure the settings are pointing to a common location shared by all accounts on the computer. Dismiss preferences.
Now click File > Export > Preferences... and save them to a file in a known location that is also shared by all accounts.
Now open each of the other accounts on the computer, start Captivate and click File > Import > Preferences... and see if things are configured accordingly. If so, repeat the process for all accounts on the computer.
Cheers... Rick

Using Powershell to delete all users from the Portal

Summary
This script will delete all users from the Portal except for Administrator and the Built-In Sync account.
Based on Markus's "Delete a User" script.
Useful when developing your system if you want to quickly clear out the data and start again.
set-variable -name URI -value "http://localhost:5725/resourcemanagementservice' " -option constant
function DeleteObject
PARAM($objectType, $objectId)
END
$importObject = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject
$importObject.ObjectType = $objectType
$importObject.TargetObjectIdentifier = $objectId
$importObject.SourceObjectIdentifier = $objectId
$importObject.State = 2
$importObject | Import-FIMConfig -uri $URI
if(@(get-pssnapin | where-object {$_.Name -eq "FIMAutomation"} ).count -eq 0) {add-pssnapin FIMAutomation}
$allobjects = export-fimconfig -uri $URI `
–onlyBaseResources `
-customconfig "/Person"
$allobjects | Foreach-Object {
$displayName = $_.ResourceManagementObject.ResourceManagementAttributes | `
Where-Object {$_.AttributeName -eq "DisplayName"}
if([string]::Compare($displayName.Value, "Administrator", $True) -eq 0)
{write-host "Administrator NOT deleted"}
elseif([string]::Compare($displayName.Value, "Built-in Synchronization Account", $True) -eq 0)
{write-host "Built-in Synchronization Account NOT deleted"}
else {
$objectId = (($_.ResourceManagementObject.ObjectIdentifier).split(":"))[2]
DeleteObject -objectType "Person" `
-objectId $objectId
write-host "`nObject deleted`n" $displayName.Value }
Go to the FIM ScriptBox
http://www.wapshere.com/missmiis

The DeleteObject function opens and closes a connection for each object. This approach is faster:
http://social.technet.microsoft.com/wiki/contents/articles/23570.how-to-use-powershell-to-delete-fim-users-that-have-a-null-attribute-name.aspx
Mike Crowley | MVP
My Blog --
Planet Technologies

Creating an shortcut for all users on the desktop

I want to create a shortcut for all users on the desktop that will appear for all users that login to the computer. How is this done in Windows 7? In Widows XP this was done at the "All Users" profile, but I cannot find such a profile in Windows 7.

the users have windows vista , 7 or 8 have a chortcut i created and the users have windows xp isn't created on them desktop
Do you have a question? If so then your best bet is to create a new post (this one is 5 years old and marked as "answered"!) and spell it out there.

How do I change my apple id from an old one that does not exist anymore to the new one I use....Please help me I can't update any downloads for my apps.

How do I change my apple ID from an old one that doesnot exist anymore to a new old? When I purchased my macbook I had a mac.com email address but now have a me.com one. My computer is linked to the mac one. I cant update my apps....some one please help.

Well when I first purchased I had an mac address, which I have not used for a long time I started a me address about 18months ago. and up untill I updated my iPhone I have been able to use my mac.com now I cant and dont know what to do because it tells me to verify my apple ID. I put in the password etc and doesnot take me anywhere as I cant access the emails.

How to get number of records in all user tables in one select

Please advise how to retrieve the number of records in all user tables in one select. I would likt to extract the data to excel file.
Many thanks,
Andrew

You could always analyze the tables:
declare
begin
for X in (select owner, table_name from all_tables
             minus
            select owner, table_name from all_external_tables) LOOP
      dbms_stats.Gather_Table_Stats(X.Owner, X.Table_Name) ;
end loop;
end;
/Then: Select Owner, Table_Name, Num_Rows from All_Tables ;

Limit change access to all useres exept the one that created the document

Similar Messages

Maybe you are looking for