The security views in Configuration Manager 2007 contain information about the permissions that are granted to users and user groups to perform operations on secured Configuration Manager object classes and instances, such as collections, packages, deployments, and reports.
Security Views
Security views can be used to query for Configuration Manager class or instance permissions for secured objects. In each SQL view, class and instance permission values are listed as a decimal value that is the result of converting bit fields reserved for each security right. More information can be found in the next section. The security views are described in the following table.
Security View | Description |
---|---|
v_SecuredObject |
Describes the different types of objects in the Configuration Manager system that can be secured: collection, package, advertisement, status message, site, query, report, software metering rule, software updates, configuration item, operating system installation package, template, update list, state migration, image package, boot image package, task sequence package, device setting package, device setting item, driver package, deployment package, driver, and Asset Intelligence software list. The view lists the Configuration Manager objects by object key and name, as well as the default class permissions, default instance permissions, and the available instance permissions. The default permissions for Configuration Manager classes and instances are set to Read (0), and the available instance permissions for each object vary depending on what permissions are appropriate for the specific object. The view can be joined to the other security views by using the ObjectKey or ObjectName columns. |
v_UserClassPermissions |
Lists the object key, user name, and class permissions the user has to each specific secured object. The view can be joined to the other security views by using the ObjectKey column and to other views by using the UserName column. |
v_UserClassPermNames |
Lists the Configuration Manager object key, user name, permission name the user has for each specific secured object, and the permission number. This view contains the same information as the v_UserClassPermissions view, but instead of using one decimal value for combined permissions, it lists each permission individually by name. The view can be joined to the other security views by using the ObjectKey column and to other views by using the UserName column. |
v_UserInstancePermissionInfo |
Lists the Configuration Manager instance key (collection ID, advertisement ID, deployment ID, and so forth.), instance permissions the user has to a specific instance of a secured object, object key, user name, read flag, and display name for the instance. The view can be joined to the other security views by using the ObjectKey column, and to other views by using the InstanceKey and UserName columns. The InstanceKey column contains Configuration Manager object ID’s, such as collection ID, advertisement ID, query ID, package ID, update assignment ID, and so on. The secured objects are listed in the v_SecuredObjects view. |
v_UserInstancePermissions |
Lists the Configuration Manager object key, user name, instance key, and permissions the user has to a specific instance of a secured object. The view can be joined to the other security views by using the ObjectKey column and to other views by using the InstanceKey and UserName columns. The InstanceKey column contains Configuration Manager object ID’s, such as collection ID, advertisement ID, query ID, package ID, update assignment ID, and so on. The secured objects are listed in the v_SecuredObjects view. |
v_UserInstancePermNames |
Lists the Configuration Manager object key, user name, permission name the user has for the specific instance of a secured object, instance key (collection ID, advertisement ID, deployment ID, and so forth), and permission value. This view contains the same information as the v_UserInstancePermissions view, but instead of using one decimal value for combined permissions, it lists each permission individually by name. The view can be joined to the other security views by using the ObjectKey column and to other views by using the UserName or InstanceKey columns. The InstanceKey column contains Configuration Manager object ID’s, such as collection ID, advertisement ID, query ID, package ID, update assignment ID, and so on. The secured objects are listed in the v_SecuredObjects view. |
Configuration Manager Secured Objects
Class and instance permissions can be set on more than 20 secured objects in Configuration Manager 2007. These Configuration Manager secured objects and their associated object keys are listed in the following table.
Object Key | Object Name |
---|---|
1 |
Collection |
2 |
Package |
3 |
Advertisement |
4 |
Status message |
5 |
(Not used) |
6 |
Site |
7 |
Query |
8 |
Report |
9 |
Software metering rule |
10 |
Applicable updates summary |
11 |
Configuration items |
12 |
(Not used) |
13 |
(Not used) |
14 |
OS install package |
15 |
Deployment template |
16 |
Deployment |
17 |
Computer association |
18 |
OS image |
19 |
Boot image package |
20 |
Task sequence package |
21 |
Device setting package |
22 |
Device setting item |
23 |
Driver package |
24 |
Deployment package |
25 |
Device driver |
How to Interpret Decimal Permission Values
In the security views, there are decimal values that equate to a specific class or instance permissions. Each individual permission uses one of 28 bits. The following table lists each of these permissions, the bit that is used, and the decimal value of that bit.
Permission Name | Bit Value | Bit Position | Decimal Value |
---|---|---|---|
Read |
1 |
1 |
1 |
Modify |
10 |
2 |
2 |
Delete |
100 |
3 |
4 |
Distribute |
1000 |
4 |
8 |
Create Child |
10000 |
5 |
16 |
Use remote tools |
100000 |
6 |
32 |
Advertise |
1000000 |
7 |
64 |
Modify resource |
10000000 |
8 |
128 |
Administer |
100000000 |
9 |
256 |
Delete resource |
1000000000 |
10 |
512 |
Create |
10000000000 |
11 |
1024 |
View collected files |
100000000000 |
12 |
2048 |
Read resource |
1000000000000 |
13 |
4096 |
Delegate |
10000000000000 |
14 |
8192 |
Meter |
100000000000000 |
15 |
16384 |
Manage SQL commands |
1000000000000000 |
16 |
32768 |
Manage status filters |
10000000000000000 |
17 |
65536 |
Manage folders |
100000000000000000 |
18 |
131072 |
Network access |
1000000000000000000 |
19 |
262144 |
Import computer entry |
10000000000000000000 |
20 |
524288 |
Create task sequence media |
100000000000000000000 |
21 |
1048576 |
Modify collection setting |
1000000000000000000000 |
22 |
2097152 |
Manage OSD and ISV Proxy Certificates |
10000000000000000000000 |
23 |
4194304 |
Recover user state |
100000000000000000000000 |
24 |
8388608 |
Manage management controllers |
1000000000000000000000000 |
25 |
16777216 |
View management controllers |
10000000000000000000000000 |
26 |
33554432 |
Manage Asset Intelligence |
100000000000000000000000000 |
27 |
67108864 |
View Asset Intelligence |
1000000000000000000000000000 |
28 |
134217728 |
To interpret a permission value, you can convert the decimal value to binary and use the preceding table to get the specific permissions. To help understand this process, see the following examples.
Decimal Conversion Example 1
In the v_SecuredObject view, the SMS_Site secured object has a value of 638983 in the AvailableInstancePermissions column. To find out what this means, first convert the decimal number to binary. This equates to 10011100000000000111, in which the 1st, 2nd, 3rd, 15th, 16th, 17th, and 20th bits are used. Use the bit values from the preceding table to calculate the values in the following table. When the decimal values are added, they will total the initial 638983 value.
Permission Name | Binary Position | Decimal Value |
---|---|---|
Read |
1 |
1 |
Modify |
2 |
2 |
Delete |
3 |
4 |
Meter |
15 |
16384 |
Manage SQL commands |
16 |
32768 |
Manage status filters |
17 |
65536 |
Import computer entry |
20 |
524288 |
Decimal Conversion Example 2
In the v_SecuredObject view, the SMS_Collection secured object has a value of 52435687 in the AvailableInstancePermissions column. This decimal number results in 11001000000001101011100111 when converted to binary. This is interpreted as shown in the following table.
Permission Name | Binary Position | Decimal value |
---|---|---|
Read |
1 |
1 |
Modify |
2 |
2 |
Delete |
3 |
4 |
Use remote tools |
6 |
32 |
Advertise |
7 |
64 |
Modify resource |
8 |
128 |
Delete resource |
10 |
512 |
View collected files |
12 |
2048 |
Read resource |
13 |
4096 |
Modify collection setting |
22 |
2097152 |
Manage management controllers |
25 |
16777216 |
View management controllers |
26 |
33554432 |