Return
-
Title
Local Administrators can access IT Security Search with full control without being a member of IT Security Search Administrators group -
Description
Accounts which are members directly or indirectly of the Administrators group on the IT Security Search server can access IT Security Search website with Administrator privileges. This allows users who may not be expected to be able to access IT Security Search administrative access. -
Cause
The current security model grants Administrator rights within IT Security Search website to members of the Administrators group on the IT Security Search server. -
Resolution
This has been resolved in version 11.3.2 and later of ITSS.
-
Defect ID
IS-857 -
Additional Information
The change request is to remove local Administrators group from inheriting IT Security Search Administrators permissions. This will ensure Administrator access is only procured via the IT Security Search Administrators group. The change is targeted for 11.3.2 release.