Configure the "Manage" Module

In This Section

• Manage Super Administrator Task Collections
• Manage eDirectory Task Collections
• Manage Active Directory Task Collections
• Manage Identification Forms
• Manage System-Wide Help Desk Task Collections
• Modify Existing Task Collections and Assignments

Overview

The "Manage" module provides web-based user account and group management tasks for eControl operators. Complete granular control is provided through the eControl Administration panel where eControl administrators control who can carry out which tasks in specified containers.

Table of contents

• Overview
  • How it Works
  • Calculating Cumulative Authorities
  • Planning Concepts

How it Works

For the Manage Module:

1. Task collections are created and configured. This defines what tasks can be carried out.
2. Task collections are assigned to Directory groups. This defines who has the authority to carry out the assigned tasks in a task collection (we refer to this as "Task Authority").
3. Search paths are assigned to each Task Authority and task collection assignment. This determines where (in which containers and therefore against which users and groups) the assigned tasks can be carried out (we refer to this as "Search Authority").

Task Collections are based on the types of tasks available for the type of Directory and email system being managed. eControl 3 currently supports:

• eDirectory 8.5+ and GroupWise 7.0+
• Active Directory 2000+ and Exchange 2003/2007

The following tasks can be assigned to be managed by eControl operators based on their group memberships:

eDirectory and GroupWise	Active Directory and Exchange
1. Manage eDirectory and GroupWise Passwords	1. Reset AD account passwords
2. Enable / Disable User Accounts	2. Enable / Disable Accounts
3. Manage Groups and Group Membership	3. Manage Security Group Memberships
4. Manage GroupWise Distribution Lists Memberships	4. Manage Exchange Mail Group Memberships
5. Modify User Identification Information	5. Modify User Identification Information
6. Delete / Rename Users and Groups	6. Delete / Rename Users and Groups
7. Manage Organizational Roles and Membership
8. Release Intruder Lockout
9. Manage Login Restrictions
10. Manage Password Restrictions
11. Manage GroupWise Options
12. Manage GroupWise Internet Addressing

Calculating Cumulative Authorities

Important concepts to remember are:

• A user can be a member of multiple groups
• Task collections are assigned to groups
• A task collection can be assigned to more than one group
• A group can be assigned only one task collection but can be configured for multiple search contexts and exclusions
• Search contexts can be specific to a single container or can allow for sub-containers to be searched and containers can be excluded from a search context
• Each task collection assignment may be assigned more to multiple search contexts in multiple Directory systems

The cumulative affect is that a single user can be assigned conflicting task sets (e.g. a restricted set from task collection “A” and a fully-enabled task set from task collection “B”) for the same group of target users being managed. In that case, eControl calculates:

• Search Authority - the cumulative cumulative list of all containers in all managed directories that can be searched by the operator, and
• Task Authority - the cumulative list of tasks that can be performed by the operator against the selected user is based on adding together all of the assigned tasks for every task collection that applies to the selected user. eControl will apply the least restrictive (most permissive) set of tasks.

Planning Concepts

Careful planning is required to determine where to add, remove or adjust task.

When looking at what task collections to create, it is helpful to use the following strategy:

• STEP 1 – Determine which containers are going to be managed by eControl.
• STEP 2 – Determine the types of task collections that are needed to support the desired user account and email account management strategy, e.g. all tasks, tasks for office managers, tasks for user support staff. In this step, you should always have an “All Tasks” collection and a list of additional task collections that are required. Each task collection should have the exact set of tasks to be configured in that collection. (e.g. a set of minimal tasks that a junior level help desk operator can perform). Be detailed with this step and decide on an appropriate naming strategy for each task collection.
• STEP 3 – Determine which group of “operators” will be assigned to each task collection. You can choose existing Directory groups or create additional user groups as required. Decide on an appropriate naming strategy for each “eControl” group.

After the plan has been completed, the next step is to create the new task collections and assign them to groups to match the user account management strategy.

---