ControlPoint User Groups
When ControlPoint is installed for the first time:
·the six default user groups described in the table below are automatically created, and
·the ControlPoint Service Account is added to each group.
|
Group |
Description |
Default ControlPoint Configuration Site Permission(s) |
|---|---|---|
|
ControlPoint Application Administrators |
Individuals within IT responsible for the administration of the ControlPoint application, as well as most or all of the farm. |
Full Control access NOTE: You should also place administrators in this group into the Site Collection Administrators group to enable them to manage other ControlPoint groups. |
|
Administrators |
Individuals (generally within IT) with administrative responsibilities for most or all of the farm. |
Read access |
|
Business Administrators It is imperative that the name assigned to this group match the parameter value for the BADMIN configuration setting. If you change this group name, you will also need to update the BADMIN parameter value. Refer to the ControlPoint Administration Guide for instructions. |
Business users responsible for managing specific sites, but not most of the farm. See also Making ControlPoint Available to Business Users (Site Administrators). |
Read access |
|
Remote Service Account Administrators It is imperative that the name assigned to this group match the parameter value for the RSAADMIN configuration setting. If you change this group name, you will also need to update the RSAADMIN parameter value. Refer to the Metalogix ControlPoint Administration Guide for instructions. |
The Service Account of each farm involved in ·multi-farm installations, and ·cross-farm copy or move operations. |
Read access |
|
ControlPoint Compliance Administrators |
Individuals permitted to access ControlPoint Compliance (Sensitive Content Manager )functionality. |
Read access |
You can add users to ControlPoint groups using either of the following methods:
·Use standard SharePoint procedures. You can open the ControlPoint Configuration Site directly or access People and Groups pages through the ControlPoint application interface as follows:
a)From the SharePoint Hierarchy, expand the Web Application that hosts the ControlPoint Configuration site, then ControlPoint Configuration Root Site > Groups.
b)Click on the group to which you want to add users.
OR
·Use the ControlPoint action Add Users to SharePoint Groups.
ControlPoint Application Administrators can create additional groups at any time, configure ControlPoint to automatically add users to a ControlPoint group based on security privileges, and even create custom ControlPoint menus for different groups of administrators. See also Managing ControlPoint Users and Permissions in the ControlPoint Administration Guide.
Making ControlPoint Available to Business Users (Site Administrators)
ControlPoint Application Administrators can grant access to ControlPoint to business users who administer their own sites. To do so:
·make sure they have Full Control access (or any other permission level that includes the Manage Web Site permission) to any site they will be administering, and
·add them to the ControlPoint Business Administrators group in the ControlPoint Configuration site. (See ControlPoint User Groups.)
Once the Full Discovery process has run, the SharePoint Hierarchy will show only Web applications and site collections that contain sites that the user has permissions to administer.
NOTE: For the sake of performance, ControlPoint uses cached data to determine SharePoint sites to which Business Administrators have management permissions. If you grant or deny permissions to a Business Administrator, the change will not be visible in the SharePoint Hierarchy until after the next Discovery is run.
ControlPoint Security
By default, ControlPoint is security-trimmed to enforce SharePoint permissions. This means that administrators only have full access to site collections through ControlPoint if:
·they have been given site collection administrator privileges in SharePoint
·they have Full Control permissions granted to all zones in a Web application's policy.
EXCEPTION: The security model for business users (also referred to as Site Administrators) is somewhat different. See Making ControlPoint Available to Business Users (Site Administrators).
For users who are farm administrators, all of the site collections for which they are not the administrator may display in the SharePoint Hierarchy panel with a "disabled" icon. As farm administrators, they can give themselves permissions to those site collections via the ControlPoint Set Site Collection Properties action, which displays when the site collection icon is double-clicked.
For users who are not farm administrators (or are farm administrators but ControlPoint has been configured to suppress "super user" privileges), only site collections for which they are administrator display.
NOTE: The number that displays in parentheses represents the total number of site collections within the Web application, regardless of whether you have permissions for them.
ControlPoint users can also manage sites for which they have a permission level that includes the fine-grained permission ManageWebSite (which is part of the SharePoint built-in permission level Full Control). Unless the user is a member of the Business Administrators group, these sites do not display in the SharePoint Hierarchy unless the user is also the administrator of the site collection. Such sites would, however, be included in a ControlPoint operation if they are within the selected scope and can be selected via a simple, advanced, or hierarchical search.
ControlPoint Application Administrators can, however, choose to override ControlPoint default security. Details can be found in the ControlPoint Administration Guide.
The ControlPoint Interface
The ControlPoint interface employs a two-pane design. From the left (navigation) pane, you can select the SharePoint object(s) on which you want to operate and available functionality. The right (workspace) pane is where the feature you choose is displayed.
For SharePoint 2013 Standard or later installations, whenever you log into ControlPoint or refresh your browser, the right pane displays the SharePoint Summary Dashboard.
For SharePoint 2010 Standard and all Non-Standard installations, the workspace displays About inform ation.
ControlPoint Application Administrators can customize the page that displays via the ControlPoint Configuration Setting Initial Screen (INITSCREEN). For SharePoint 2013 or later Standard installations, the ControlPoint Configuration Setting No Dashboard (NODASHBOARD) must also be changed. See the ControlPoint Administration Guide for details.