-
Title
Permissions under VCR not working as expected. -
Description
I set some groups in some containers on VCR, a group is named Owner and another one is User, both with custom roles assigned on the container level, both users nested in those groups aren't getting proper permissions to manage the objects that are stored on the container level. -
Resolution
1) In GPOADmin as an administrator expand the Live Environment node and then right click on the domain itself , and select Properties.
2) Here make sure the Domain Users group for the domain shows in the Security for the domain, and has all options selected.
Note here that if a user does not have permissions on the domain object in the live environment, they will not be able to perform any actions on the domain that are listed in the domain security regardless of their role permissions in GPOADmin. This is done so that users who are managing multiple domain and separate domain access from general GPOADmin roles.
We set the Domain Users permissions on the domain by default. This will then let any users from that domain with the appropriate role to perform actions in GPOADmin.You could make this more specific if you wish, though any users granted a role to work in GPOADmin on the domain must then be given permissions on the domain. You can decide whether you want to keep Domain Users, switch to another designated group to which all users / admins in GPOADmin must belong, or to permission in another way that suits the organization.