HP Integrated Lights-Out User Manual page 203

Directory-Enabled Remote Management 203
In the example, security policy dictates general use is restricted to clients within
the corporate subnet, and server reset capability is additionally restricted to after
hours.
Alternatively, the directory administrator could create a role that grants the login
right and restrict it to the corporate network, then create another role that grants
only the server reset right and restrict it to after-hours operation. This
configuration is easier to manage but more dangerous because on-going
administration might create another role that grants users from addresses outside
the corporate network the login right, which could unintentionally grant the LOM
administrators in the server Reset role the ability to reset the server from
anywhere, provided they satisfy the time constraints of that role.