RBAC doesn't respecting mapping

Question

My goal is to get SCCM operators can do only these actions:
- Create New Packages and distribute them to specific collections (Collection1,Collection2)
- They mustn't distribute existing packeges to any collection except some packages and only on a collection (collection3)
- They must be able to read/view all packages, collections, etc...
For that, I've done this actions:
- Set a scope "Scope1" for all packages. New packages will be configured with default Scope.
- Create a security Role "Security Role1" that allow read all SCCM Objects
- Create a security Role "Security Role2" that allow create/delete packages and distributed them to DP
- Create a security Role "Security Role3" that allow deploy packages
I've tried several ways to do this, but not luck.
When you assign several Security Roles with Several Scopes, the final Scope is the sum of all scopes and the final security Role is the sum of all security roles, not respecting mapping

Answer 1

Navigate through Administration –> Security –> Administrative Users –> User
Select administrative User and click on Properties
administrative User and click on Properties and check how many roles are assigned to that user?
then Go
to “Security Scopes” and check the scope details also provide a screenshot if possible.
I've had similar problem with RBA long back and I've documented it over
here . Probably more details with screenshots would help you.
Anoop C Nair (My Blog www.AnoopCNair.com)
- Twitter @anoopmannur -
FaceBook Forum For SCCM