McAfee EPOCDE-AA-BA - ePolicy Orchestrator - PC Product Manual page 48

6 Setting up permission sets
How users, groups, and permission sets fit together
An example access configuration
As an example, let's say you want to give all users from your "Dallas" Active Directory
server access to a specific group of reports, and you want one particular engineer (let's call
her "ElaineG") to be able to create and modify queries in that group. To accomplish this,
you'll need to create two permission sets and one group, and edit ElaineG's user account.
1 Create a permission set called "Dallas Users."
2 Add the Dallas Active Directory server to the list called Active Directory groups mapped to this
permission set.
3 Make sure they have the Queries and Reports permission Use all public groups and the shared groups
below; create and edit personal queries/reports. as well as other permissions you want to grant.
4 Duplicate the "Dallas Users" permission set and call the new set "Dallas Report Creators".
5 Create a query group called "Dallas Reports" and give it By permission set (Shared Groups)
visibility to the "Dallas Users" and "Dallas Report Creators" permission sets.
6 In the "Dallas Users" permission set, select the "Dallas Reports" group under Queries and
Reports permissions. Do the same for the "Dallas Report Creators" permission set.
7 Change the Queries and Reports permission in this new permission set to Edit public groups and
the shared groups below; create and edit personal queries/reports; make personal queries/reports public. The
list of selected groups should not change.
8 Edit ElaineG's user account and assign her to the "Dallas Report Creators" group.
You've now got an entire class of users (members of the "Dallas" Active Directory server)
with access to a specific query group, and an individual with the ability to create and
modify queries and reports within that group.
®
48 McAfee ePolicy Orchestrator
®
4.6.0 Software Product Guide