NCM Device Group owner

We are currently running NCM 1.3 (Build 4045-112607). I am wondering if it is possible to define a default owner for Sites, Parent Device Groups, and Device Groups? Our dilemma is we have several engineers with the ability to create these containers. Once an engineer leaves you cannot delete their account as long as they are owners of a Site, Parent Device Group, or Device Group. I know if you have admin privileges you can select the owner of the Device Group at creation. Is there a way or is it possible to select/change the owner of a Site or Parent Device Group?

Hello Thorsten, I checked your helpful link, but it doesn't change the situation.
In my opinion I have an inconsistency in the ccr repository, but it is not my intention to edit it directly.
On node is left, and the diskset is Online:
! root@pixtest1:/ # scstat -D
-- Device Group Servers --
                         Device Group        Primary             Secondary
Device group servers: jboss-set           pixtest1            pixtest2
-- Device Group Status --
                              Device Group        Status
Device group status:        jboss-set           Online
-- Multi-owner Device Groups --
                              Device Group        Online Status
! root@pixtest1:/ # metaset -s jboss-set -d -h pixtest2
metaset: pixtest1: jboss-set: host pixtest2 is not in the set
! root@pixtest1:/ # metaset -s jboss-set -d -h pixtest1
metaset: pixtest1: Failed to delete hosts from DCS service: No such file or directory
! root@pixtest1:/ # metaset -s jboss-set
Set name = jboss-set, Set number = 2
Host                Owner
pixtest1      No messages are logged in syslog as I execute the commands.
-- Nick

Similar Messages

NCM Dynamic Groups

We are currently runing CiscoWorks Network Compliance Manager 1.3.SP2 (Build 4755-070308) and our dynamic groups are limited by 10 "Search Criteria" and because some of the devices dont follow the same naming standard and NCM is case sensitive I am having issues getting all the correct devices into the correct groups. Is there a way to use linux grep commands to add devices to groups? I see NCM has a command line but it does not appear to allow any type of grep or regular expression commands.

Hey josephenix, it sounds like you have a very reasonable need and use. Be aware that dynamic groups do require higher CPU resources because of the need to process conditional logic on the device inventory. I would think that having 10 conditional rules puts you at the extreme case.
I can appreciate your need to have the inventory dynamically updated as multiple users are adding/changing things. However, you might be negatively impacting normal use with your current process.
I might suggest this...
Using the method I described earlier, connect to the NCM proxy and issue a 'list device" - this will get you a list of all devices in inventory - put this into an array. Iterate over the array and send each into a query for the NCM proxy with command "list groups -type device -host $DEVICENAME" - this will show you the device groups the device is in - this can go into another array. You can use your Linux grep commands to determine if it's in the right group. Then use the 'add device to group' command we discussed earlier, if it isn't in the right group.
You could automate/cron this to run once every 2 hours or so. This would allow you to programmatically map devices to static device groups and get the benefits of performance with that, but still allow you some flexibility in dynamic naming...
I hope that helps!

I see "Enrollment Settings" under device groups but it doesn't seem to do anything. Is that normal?

Hello, first time poster.
I'm new to most things apple aside from basic use of ipads and iphones. I was put in charge of the ipads for my school district and after some research and effort, I've gotten a mac server (on mavericks) up and running.
I have setup an MDM, gotten the token, gotten the VPP, etc...
Everything is working as it seems to be working. But...
In Device groups, under settings for a device group I see "Enrollment Settings" with things like "prompt user to enroll device" and "Supervise (IOS only)". So I added a device to a new group, reset the device in question and nothing. The settings appeared to do nothing. Is that normal or am I missing something?

Which version of Server.app? 3.1.2?
Verifty local DNS services. Invalid DNS causes other OS X Server components to have issues. You'll need DNS on your local network somewhere, whether that's served by OS X Server, or another DNS server doesn't matter.
Launch Terminal.app from Applications > Utilities and issue the following harmless, diagnostic command:
sudo changeip -checkhostname
That'll require an administrative password for the sudo, might generate a one-time message about the use of sudo, and will then display some configuration information and then an indication that no changes are required, or that there are network or DNS issues. If you're not in .local or .arpa, that'll usually give you a good view of your local network configuration.
The device has to be enrolled with Profile Manager server. How you do that depends on how you want to manage your devices. There are various overviews of how this stuff works too, if you're getting started: here is one video.

Delivery Assignment to Device group in standalone deployment?

Hi,
I am using the standalone deployment of SAP AII 2.1. I have the following two queries regarding assignment of deliveries to device groups.
1. I am able to assign the same delivery to multiple device groups with same business roles as well as different business roles at the same time.
For example, I am assigning the delivery to a device group that handles tag commissioning and I also assign the same delivery to a device group that handles the loading at the same time. Is this the correct behavior?
Or is it that once a delivery is assigned to a device group, it should be first processed by that device group or unassigned before the same delivery can be assigned to a different device group?
If this is the case, then is there any configuration setting in AII that can control the delivery assignment to device groups?
2. Logically I believe that only one delivery can be assigned to a device group.
I assign a delivery to a device group. Then I immediately assign another delivery to the same device group. I believe that the first delivery gets unassigned from the device group, but there is no message to this effect
Again is there any configuration setting for handling this situation?
Regards,
Dhananjay

What you are deploying is a Client Settings policy, not the client itself. This is akin to a Group Policy Object being linked to an OU. The machines in the collection which already have the ConfigMgr client will process those policies, but additional non-client
machines added to the collection will not automatically install the client.
As Torsten indicated, you can deploy the client to these machines using the manual client push method. Simply right click on the clients themselves (or the collection) and select Install Client. If doing it at the collection level, I recommend
against selecting "Always install the client software" in the wizard as it will force an unnecessary repair of the existing ConfigMgr clients. I would recommend testing this on one machine in the collection in question before attempting to do them in bulk.
Note that this requires that a Client Push Installation account be configured (Administration > Site Configuration > Sites > Client Installation Settings > Client Push Installation > Accounts tab) which has admin rights on the clients.
You *DO NOT need to enabled site-wide client push installation* to be able to use the Install Client method in the console. Enabling this will force the client to attempt installation on ALL systems that ConfigMgr sees.

How to track changes made to a group owner for Distribution/Security Group in FIM 20101 R2?

We have a requirement where we have to send a consolidated email to the new group owner which lists all the groups that are tagged to him/her.
This requirement is needed so that the new group owner can be notified of the groups that he/she owns. Group owner information can be updated in AD which would then sync with FIM, Bulk updates for groups in FIM.
So first we would have to basically track the group owner change in FIM, retrieve the owner information, then list all the groups listed under him, consolidate an email and trigger the notification.
Can someone help me and let me know how this can be achieved?
Thanks in advance!!

Hello,
you can not do with only OOB functions. You will need a custom activity to enumerate all group a specific persons owns.
First part is easy, create a MPR which triggers a workflow activity on owner attribute changes.
The custom activity should then search for all groups new owner owns in addition.
Pass that information through the WorklowDictionary to a notification activity.
If your are not familar with developing workflow activities you could use PowerShell Activity for example.
/Peter
Peter Stapf - ExpertCircle GmbH - My blog:
JustIDM.wordpress.com

How to create a Set of Group Owners

Step 1: Create and bind an attribute called GroupOwner to user objects in the Portal
Step 2: Run the following Powershell script as an administrator of FIM.
Step 3: Create your set based on the updated GroupOwner attribute which will now be true for all your Group Owners
Step 4: Make workflows! :)
The Code:
$uri
=
http://NameofYourServer:5725
$attributeName
=
"GroupOwner"
# load FIM snapin, ignore errors if already loaded
Add-PSSnapin
FIMAutomation
-ErrorAction
SilentlyContinue
# gets the value of a single-valued attribute from an exported object
function
GetAttributeValue($exportObject,[string]
$name) {
$attribute
=
$exportObject.ResourceManagementObject.ResourceManagementAttributes |
Where-Object {$_.AttributeName
-eq
$name}
if ($attribute
-ne
$null
-and
$attribute.Value) {
$attribute.Value
$users=Export-FIMConfig
-CustomConfig
"/Person[ObjectID = /Group/Owner]"
-OnlyBaseResources
foreach ($user
in
$users) {
$objectID2=$user.ResourceManagementObject.ResourceManagementAttributes
| Where-Object {$_.AttributeName
-eq
"ObjectID"}
$objectID2=$objectID2.Value
$ImportOperation
= [Microsoft.ResourceManagement.Automation.ObjectModel.ImportOperation]
$ImportState
= [Microsoft.ResourceManagement.Automation.ObjectModel.ImportState]
$importChange
=
New-Object
Microsoft.ResourceManagement.Automation.ObjectModel.ImportChange
$importChange.Operation
=
$ImportOperation::Replace
$importChange.AttributeName
=
${attributeName}
$importChange.AttributeValue
=
$true
$importChange.FullyResolved
= 1
$importChange.Locale
=
"Invariant"
$importObject
=
New-Object
Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject
$importObject.ObjectType
=
"Person"
$importObject.TargetObjectIdentifier
=
$objectID2
$importObject.SourceObjectIdentifier
=
$objectID2
$importObject.State
=
$ImportState::Put
$importObject.Changes
= (,$importChange)
$importObject |
Import-FIMConfig
-uri
$uri

Changed the code to allow for skipping values that are already true to reduce FIM level overhead.
$uri = "http://FQDNofyourServer:5725"
$attributeName = "GroupOwner"
# load FIM snapin, ignore errors if already loaded
Add-PSSnapin FIMAutomation -ErrorAction SilentlyContinue
# gets the value of a single-valued attribute from an exported object
function GetAttributeValue($exportObject,[string] $name) {
$attribute = $exportObject.ResourceManagementObject.ResourceManagementAttributes |
Where-Object {$_.AttributeName -eq $name}
if ($attribute -ne $null -and $attribute.Value) {
$attribute.Value
$users=Export-FIMConfig -CustomConfig "/Person[ObjectID = /Group/Owner]" -OnlyBaseResources
foreach ($user in $users) {
$objectID2=$user.ResourceManagementObject.ResourceManagementAttributes | Where-Object {$_.AttributeName -eq "ObjectID"}
$objectID2=$objectID2.Value
$objectID3=$user.ResourceManagementObject.ResourceManagementAttributes | Where-Object {$_.AttributeName -eq "GroupOwner"}
$objectID3=$objectID3.Value
if ($objectID3 -ne $true) {
# write-host $objectID2
$ImportOperation = [Microsoft.ResourceManagement.Automation.ObjectModel.ImportOperation]
$ImportState = [Microsoft.ResourceManagement.Automation.ObjectModel.ImportState]
$importChange = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportChange
$importChange.Operation = $ImportOperation::Replace
$importChange.AttributeName = ${attributeName}
$importChange.AttributeValue = $true
$importChange.FullyResolved = 1
$importChange.Locale = "Invariant"
$importObject = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject
$importObject.ObjectType = "Person"
$importObject.TargetObjectIdentifier = $objectID2
$importObject.SourceObjectIdentifier = $objectID2
$importObject.State = $ImportState::Put
$importObject.Changes = (,$importChange)
$importObject | Import-FIMConfig -uri $uri

Group Owner unable to see members

Hello All,
I posted this question a while back but never got an answer so I thought I'd repost it. I've run into an issue where when a security group owner logs into the FIM portal they see the groups they are managing but are unable to see a list of
members of the group. However when I log in as an FIM administration and I look at the same group I see all members. How do I allow the group owner to manage his own group by granting him access to read the membership. Is there a specific Search Scope or MPR
that needs to be enabled besides the following.
MPR's that are enabled
Security group management: Owners can read selected attributes of group resources
Security group management: Owners can update and delete groups they own
Navigation Bar Resources that are enabled as BasicUI
Security Groups (SG's)
My SGs
My SG Memberships
Home Page Resources that are enabled as BasicUI
Security Groups (SG's)
My SGs
My SG Memberships
Search Scopes that have BasicUI
My Security Groups
My SG Memberships

Default values here:
Half-seen attributes are: Manager; MiddleName; Mobile Phone; Time Zone
Is this user a part of this group as well? If so maybe try to enable MPR named User management: Users can read attributes of their own
also?
Another way to check what should be enabled is:
In Management Policy Rules view, click Explore.
On Find tab, leave first option selected.
On Criteria tab, select: Read resource, Only permission granting...; Include disabled ...; Requestor: owner. Target Resource: group
Check MPRs listed and check which of them are disabled :)
Security group management: Owners can read selected attributes of group resources
Security group management: Users can read selected attributes of group resources
Group management: Group administrators can read attributes of group resources
If you found my post helpful, please give it a Helpful vote. If it answered your question, remember to mark it as an Answer.

Multiple Network Device Groups when importing to ISE using template

I have a question about importing a group of network devices into ISE using the template provided. The template only has a single column for Network Device Groups - is there a way to import devices and include more than one NDG? For instance, the NDG's we use are "Device Type" and "Location". I'd like to include both when doing my import and I've tried multiple ways to seperate the two strings within the column (comma's colons, semi-colons, spaces, pipes, tabs, etc), but i always get an error message that "NDG group does not exist". I also tried adding a new column into the template, but that just plain failed to import.
If there is any way to do this, I would appreciate any advice on how - I have to add about 40 devices per week to our ISE deployment and I'd rather not have to go in and add any parameters manually if it can be helped. Thanks very much!
Ross
BTW, we are running ISE ver 1.1.2 in case it is relevant.

Yes, you can do it. You have to use the pipe "|" to separate the groups. But please notice you must create the network device groups in advance.
For example, I have the following groups in my csv file to import a lot of network devices
Device Type#All Device Types#SWITCHES#375O-X|Location#All Locations#PERU#LIMA
But as a pre-requisite I have to create the network device groups.
If you have lots of network device groups, you can mass import them instead of creating them one by one.
Please rate if it helps

Extract group owners from group

How can you extract group owners from a group? ver. 3.0.9.8.5. I want to do two things; extract all groups that a user is the owner of, and find all the owners of a group.
The code below will extract out all the users of a group, but how do you get the owners? I can't figure out where the group owner flag is being set. There are two deprecated functions (get_list_members, user_in_group), which I've used and is extra coding than what's necessary, but we're also migrating to version 2 soon.
Thanks,
Rick
SELECT b.name,
a.user_name,
a.last_name,
a.first_name
FROM portal30.wwsec_person$ a,
portal30.wwsec_group$ b,
portal30.wwsec_member$ c
WHERE a.id = c.member_person_id
AND b.name = 'my_group'

Sorry, I got timed out and posted this to the wrong forum accidently. Is there a way to delete your own message?

Group owners can't manage own membership

I want to let group owners manage thier own membership (add and delete users from thier group only). Being assigned as "group owner" doesn't provide any mechanism that I could find to do this. However, assigning the group's "Privilege Assignments, Allow Group Editing" is too powerful, allowing membership management of all groups. We are using portal version 9.0.2.3.0B
What am i missing?

Applied patch but it did not help. Nor did the workaround work. I can logout, close the browser and upon logging back in I still cannot manage my group.
I am both the owner and a member of my group.
The error I get is:
Group Management Error!
No Privilege to Edit Group.

Changing group owner disables wiki/blog

For quite some time now the procedure for creating new groups with a single owner/moderator has worked well. I 1) go in to the directory app on the server, 2)create the group, 3) change the owner to the teacher who will manage the wiki/blog, 4) add the teacher to the list of users allowed to create wikis (in web services). Then everything works like a charm. As of a few weeks ago (and I have not run any updates--still on 10.5.6, etc.), as soon as I change the group owner from Directory Administrator the wiki/blog generates a no group with that name is hosted on this server. Changing the owner back to directory admin fixes this but I need the teachers to be owner/moderators. Any suggestions on what might be causing this problem?
Thanks,

Is there any solution to this problem? I am trying to set up the group owner but can't. I am set as the group owner in the group list and set as moderator in the list of users allowed to create wikis but when I go into the wiki site I am unable to change settings.

Printer device group and a label format in SAP AII

Hello @ all,
I try to configure a SAP OER System with SAP AII. Now I should configure the label printing with the transaktion /AIN/ASGN_PRF_FORMAT. I must take a profile name, a printer device group and a label format. The problem is now, that I can't chose a printer device group and also I don't know the label format. Where can I adjust the printer device group and which label format must be in that field?
Can anybody help me?
Thank you.
Peter

Hi Peter,
SAP AII sends the label format filename as part of the Command message xml to the printer during tag commissioning.
I assume you have configured the label format filename for SAP_PRINT_PROFILE using transaction /AIN/ASGN_PRF_FORMAT - Assign Format to Printer and Profile
Now you have to assign that profile to an ID type or GTIN, etc. using the menus under Profiles for Tag Commissioning and Label Printing.
Once this configuration is done, the xml command message containing the element WriteTagData is sent to the printer RFC destination configured against the Device controller as an HTTP message.
This command message will contain the label format and field names - value pairs as per the SAP_PRINT_PROFILE.

Device group and applications affinity

Hello all.
I have some device groups created with CFS configured on them.
I need to ensure that a clusterized application runs on the server that is primary for the device group. I need to set an affinity between the affinity and the device group/file system.
The problem is that the SUNW.HAStoragePlus does not indicates the real primary for the device group, for example:
# cldg status ufs_homedg
Cluster Device Groups ===
--- Device Group Status ---
Device Group Name Primary Secondary Status
ufs_homedg billbd2 billbd1 Online
# clrg status ufsg-home-rg
Cluster Resource Groups ===
Group Name Node Name Suspended Status
ufsg-home-rg billbd1 No Online
billbd2 No Offline
In this output, the resource group is online in billbd1 and the device group primary is billbd2.
If I failover the resource group, the device group is switched also, but it seems that at startup, the resource group does not check who is the primary to start on that node.
This means that the status of the resource group does not helps to identify who is the primary for a device group and I cannot use it for affinity configuration.
¿How can I ensure that an cluster application starts on the node who is primary for the device group on which the file system is created?
I was thinking on a SUNW.gds for this purpose, but I wonder if there is another way.
Thanks in advance.
Edited by: Ivan.Ferreira on Jun 19, 2008 8:04 AM

Hi Tim, thanks for your time.
Yes, I'm using AffinityOn=TRUE. After some testings, I can see that the device group is switched at startup, but I don't know under which circunstances it does not.
Also, I can force discrepancy with the device group and the resource group if a perform a cldg switch.
So, if I run clrg switch, the device group is switched also. If I run cldg switch, the device group is switched but the HAStoragePlus resource does not.
This means that HAStoragePlus cannot ensure that the node is the primary for a device group and cannot be used for affinity on applications.
�What do you think?

1) Device groups

First question:
Workstations (devices) are currently allocated under /Devices/Workstations to
folders that represent the office location of the workstation.
Is there a way to create device groups without removing the devices from their
primary location-related folder?
Is there a way to use AD device groups to assign bundles?
What's the latest thinking on to how to apply a constraint on a bundle to apply
both "user-membership-in-AD-group", and "device is approved for this app"?
e.g. I know I can add "specified devices" as a requirement, but that demands
adding individual workstations and I see no way to add device groups, which can
be very tedious if I want, for example, "this app can install for these users
on these 200 devices".
Thanks.
-- DE

Originally Posted by DE
thsundel wrote:
> Yes, create a workstation group and add the computers you want as
> members (they will not be removed from their "location-related" folder.
OK, so I want to be sure that I am understanding ...
Currently the workstations are in, say,
/Devices/Workstations/bigcity1/desktops
/Devices/Workstations/bigcity1/laptops
/Devices/Workstations/bigcity2/desktops
/Devices/Workstations/bigcity2/laptops
They need to stay in those folders, for obvious reasons. And unfortunately,
this will never match up to AD because it starts at the top level by
differentiating between workstations & servers, while AD identifies "computers"
that are placed into whatever AD structure you define.
In any case: So I can create device groups that won't result in them being
moved out of those folders?
IOW, I could define a device group that contained the systems that were allowed
to have a certain app installed, and that group membership won't disrupt the
above folders?
And are we talking about Dynamic device groups (which I've never used) or are
there other regular "device groups" that don't just represent the structure above?
Thanks again. I have a feeling that others before me have already requested an
enhancement that device groups be an option in Requirements, since I think I've
read discussions of these same issues here in the past.
-- DE
Yes, just create e "regular" Device Group where ever you want in the folder structure and add workstations as members.. You probably hava a test workstation that you can try with if your not confident.
Thomas

SSL Accelerated Service and device groups

I have a need to set up SSL accelerated services on a data center WAE and one edge WAE. In reading through the Cisco Wide Area Application Services SSL Application Optimiser Deployment Guide (2010), it states that best practice is to create an SSL device group and configure the SSL service and generate the keys through that group.
Simple question: Should only the data center WAE be placed in that group, or should also the edge WAE be in the group? The devices are running 4.3.3.

Only the data center wae's need to be placed in the SSL device group.
Regards
-Smita

NCM Device Group owner

Similar Messages

Maybe you are looking for