Skip to end of metadata
Go to start of metadata

In this article:

This article details the user management that is included in Macrium Site Manager and the roles that affect Macrium SiteDeploy®.

Macrium Site Manager can be configured to allow different users on the Site Manager server or a Windows Active Directory Domain to log in to the Site Manager console, access different parts of the SiteDeploy® UI, and log in to Site Manager on the deployment media allowing the user to access golden image stores, create golden images, and deploy golden images.

From SiteDeploy 8.1.7888, a 'User Management' section has been added to the Site Manager settings, from here all SiteDeploy user and permission management can be performed:

By default, members of the Administrators group on the Site Manager server and members of Domain Administrators on the Site Manager server's domain can log in. Additional domains and permissions can be configured as described below:

Login Providers

Login providers serve as the interface between Site Manager and an authentication resource. There is a unique login provider for each authentication resource so that permissions for each resource can be managed independently by configuring the associated provider. The types of login providers currently exist are:

Login Provider Type

Authentication Resource

Included by Default

Notes

Server LocalUser Account ControlYesAuthenticates local users. Local administrator accounts will always have permission to access Site Manager and SiteDeploy®, unless the 'Disable Default Admin Access' registry key has been set as described in this article.
Primary Server DomainActive DirectoryYes (if the Site Manager server is joined to a domain)

Authenticates users on the domain the Site Manager server is joined to. It is created automatically and can not be removed by the user. Domain Administrators can log in using this provider.

Domain disconnections

If the server is moved from its domain then the provider will be converted to a 'Domain' provider. A new 'Primary Server Domain' provider will be created when Site Manager reconnects to a domain.

Secondary Server DomainActive DirectoryYes (if the Site Manager server is joined to a domain in a forest)

Authenticates users on domains within the forest the Site Manager server is joined to. It is created automatically and can not be removed.

Domain disconnections

If the server is moved from its domain then the provider will be converted to a 'Domain' provider. A new set of 'Secondary Server Domain' providers will be created on startup.

DomainActive DirectoryNoThis provider interfaces with Active Directory domains other than the domain that the Site Manager server is connected to.

Active Directory compatibility

Site Manager must connect with a Domain Controller which supports LDAP v3 for permissions to be set for accounts on the Domain. LDAP over SSL will be used if available.

Managing Login Providers

Disabling Domain Forest Searching

Site Manager automatically creates 'Local', 'Primary Server Domain', and 'Secondary Server Domain' providers on startup. 

Users can stop Site Manager from creating domain providers by setting the registry value 'Configure default providers' in the key "HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\Site Manager" to 0. This will prevent Site Manager from creating any providers except the primary domain and local computer providers. 

While the automatic providers should cater to most needs, custom domain providers can be created to connect to domains outside of the forest the Site Manager server is in. Beware that members of authorized groups can only access Site Manager if they are on the same domain as the group. This differs from the automatic domain providers which support cross-domain authorization.

All providers are listed on the 'Login Providers' page of the settings. Providers can be configured or removed by clicking the respective buttons in the 'Actions' column of the table. New providers can be created by clicking the 'Add' button, which opens the dialog to configure a new domain provider.

A domain provider can be configured with the following fields:

Field

Notes

NameA friendly name that is displayed to users. If no name is provided then the provider will be named after the domain it is associated with.
Domain Controller

The hostname of a domain controller. This can be in the form of a DNS-style name, a NetBIOS address, or an IP address.

Custom ports

Site Manager will communicate with the domain controller using LDAP. To use custom ports (other than the default of 389 or 636) specify the domain controller in the hostname:port format.

UsernameThe username of an account on the domain. The credentials of this account will be used to perform any lookups against the LDAP server.
PasswordThe password of the account specified by the username entered in the previous field.
Display Order PriorityThe order that the provider will appear in dropdown lists like on the login page and the permissions modal. There is also an option to hide the provider from lists other than the table in the provider manager which may be useful if there are unused automatically generated providers.

After clicking 'Save', Site Manager will check the validity of the configuration. If a prover can be created then the configuration is saved and a provider is added to the list of providers in the previous window. Otherwise, an error message will appear explaining the problem.

Configuring Roles and Permissions

From Site Manager 8.1.7888, users can create their own custom roles can that can be assigned to users. Roles can be viewed and managed on the 'Roles' page of the Site Manager settings. The 'Roles' page is made up of two parts, the 'Roles' list will show the roles that are available and can be assigned to users this includes the 'Pre-Defined' roles and 'Custom Roles'. The 'Permissions' list shows the permissions that are enabled for the selected role:

There are eight pre-defined roles that are available by default, these are the same roles that were available prior to SiteDeploy 8.1.7888 and are shown below along with the permissions that are assigned to the role:

Role

Permission

AdministratorThis role has all permissions assigned and grants full administrative access to SiteDeploy® and Site Manager.
Viewer

This role has no permissions assigned and grants minimum access to the Site Manager and SiteDeploy® user. A user with this role can view the majority of information available in Site Manager and SiteDeploy®, but can't make changes beyond configuring their own instance of the dashboard and table layouts.

Backup Operator

Backups:

  • Run Now Backups
  • Pause Active Backups
  • Cancel Active Backups
  • Toggle Scheduled Backup Plans

Repositories:

  • Access Repository Browser

Remote Sync:

  • Run Now Remote Syncs
  • Cancel Active Remote Syncs

Verification:

  • File Verification
Restore Operator

Repositories:

  • Access Repository Browser
  • Open Repository Browser Files

Restore:

  • Run Restores
  • Pause Restores
  • Cancel Restores

Rescue Media:

  • Manage Rescue Media & Tools
  • Download Rescue Media Files
  • Login via Rescue Media

Drivers:

  • Manage Drivers

Verification:

  • File Verification
Backup Manager

Backups:

  • Run Now Backups
  • Pause Active Backups
  • Cancel Active Backups
  • Manage Scheduled Backup Plans
  • Toggle Scheduled Backup Plans
  • Manage Definitions
  • Manage Schedules

Agents:

  • Computer Actions
  • Remote Agent Installation
  • Remote Agent Upgrade
  • Administrator Computer Actions
  • Add & Remove Agents
  • Manage Agent Tags

Repositories:

  • Manage Repositories
  • Access Repository Browser
  • Delete Repository Browser Files
  • Open Repository Browser Files

Remote Sync:

  • Run Now Remote Syncs
  • Cancel Active Remote Syncs
  • Manage Remote Syncs
  • Toggle Remote Syncs

Restore:

  • Run Restores
  • Pause Restores
  • Cancel Restores

Rescue Media:

  • Manage Rescue Media & Tools
  • Download Rescue Media Files
  • Login via Rescue Media

Drivers:

  • Manage Drivers

Verification:

  • File Verification
Deployment Operator

Rescue Media:

  • Login via Rescue Media

Deployment:

  • Run Deployments
  • Pause Deployments
  • Cancel Deployments
  • Manage Deployment Media
  • Download Deployment Media

Driver:

  • Manage Drivers
Deployment Manager

Rescue Media:

  • Login via Rescue Media

Deployment:

  • Run Deployments
  • Pause Deployments
  • Cancel Deployments
  • Manage Deployments & Golden Image Stores
  • Manage Golden Image Tags
  • Manage Deployment Media
  • Download Deployment Media

Drivers:

  • Manage Drivers
Server Manager

Agents:

  • Administrator Computer Actions

Repositories:

  • Manage Repositories
  • Access repository Browser

Rescue Media:

  • Manage Rescue Media & Tools

Drivers:

  • Manage Drivers

Licensing:

  • Manage Licenses

Settings:

  • Manage Settings
  • Update the Site Manager/SiteDeploy Server

The pre-defined roles themselves cannot be edited, however, the roles can be easily copied and used as the basis for a custom role by selecting the 'Copy' icon next to the relevant role. Alternatively, select '+ Add Custom Role' to create a new custom role with no permissions pre-selected.

Any combination of permissions can be selected from the permissions list to be assigned to the new custom role.

Select 'Save' to save the custom role with the selected permissions. The role will now be available when adding users to the Site Manager, or modifying the roles that are assigned to existing users.

Adding and Configuring Users

Users and groups can be managed on the 'Users & Groups' page of the settings. Here the names of authorized users and groups are displayed in the table. All members of an authorized group are given the permissions of that group (membership is applied transitively). Permissions can be deleted by clicking the bin icon. Click the pencil icon to change the roles that have been assigned to a user or group. Changes to permissions can be discarded by clicking 'Cancel'.

Additional users and groups can be granted access to Site Manager and SiteDeploy and assigned a role to control how much access they have. Permissions are configured separately for each provider, select the correct provider from the dropdown before configuring permissions.

The structure of the directory is navigable through the tree on the left, which shows the folders and organizational units which have been configured on the domain. On the right is a table listing the users and groups in the selected folder. Rows can be selected using the checkbox and added to the permissions list when the 'Add' button is pressed.

All users and groups that are added to the active permissions listing are given the 'Viewer' role by default, this role has the most restricted access. To increase a user's or group's access further, select the pencil icon shown next to the user or group in the 'Actions' column.

In the window that opens, the custom and pre-defined roles, described above, will be displayed. Select any combination of roles to control how much access the selected user or group will have:

  • No labels