The security views in Configuration Manager 2007 contain information about the permissions that are granted to users and user groups to perform operations on secured Configuration Manager object classes and instances, such as collections, packages, deployments, and reports.

Security Views

Security views can be used to query for Configuration Manager class or instance permissions for secured objects. In each SQL view, class and instance permission values are listed as a decimal value that is the result of converting bit fields reserved for each security right. More information can be found in the next section. The security views are described in the following table.

Security View Description

v_SecuredObject

Describes the different types of objects in the Configuration Manager system that can be secured: collection, package, advertisement, status message, site, query, report, software metering rule, software updates, configuration item, operating system installation package, template, update list, state migration, image package, boot image package, task sequence package, device setting package, device setting item, driver package, deployment package, driver, and Asset Intelligence software list.

The view lists the Configuration Manager objects by object key and name, as well as the default class permissions, default instance permissions, and the available instance permissions. The default permissions for Configuration Manager classes and instances are set to Read (0), and the available instance permissions for each object vary depending on what permissions are appropriate for the specific object.

The view can be joined to the other security views by using the ObjectKey or ObjectName columns.

v_UserClassPermissions

Lists the object key, user name, and class permissions the user has to each specific secured object.

The view can be joined to the other security views by using the ObjectKey column and to other views by using the UserName column.

v_UserClassPermNames

Lists the Configuration Manager object key, user name, permission name the user has for each specific secured object, and the permission number. This view contains the same information as the v_UserClassPermissions view, but instead of using one decimal value for combined permissions, it lists each permission individually by name.

The view can be joined to the other security views by using the ObjectKey column and to other views by using the UserName column.

v_UserInstancePermissionInfo

Lists the Configuration Manager instance key (collection ID, advertisement ID, deployment ID, and so forth.), instance permissions the user has to a specific instance of a secured object, object key, user name, read flag, and display name for the instance.

The view can be joined to the other security views by using the ObjectKey column, and to other views by using the InstanceKey and UserName columns. The InstanceKey column contains Configuration Manager object ID’s, such as collection ID, advertisement ID, query ID, package ID, update assignment ID, and so on. The secured objects are listed in the v_SecuredObjects view.

v_UserInstancePermissions

Lists the Configuration Manager object key, user name, instance key, and permissions the user has to a specific instance of a secured object.

The view can be joined to the other security views by using the ObjectKey column and to other views by using the InstanceKey and UserName columns. The InstanceKey column contains Configuration Manager object ID’s, such as collection ID, advertisement ID, query ID, package ID, update assignment ID, and so on. The secured objects are listed in the v_SecuredObjects view.

v_UserInstancePermNames

Lists the Configuration Manager object key, user name, permission name the user has for the specific instance of a secured object, instance key (collection ID, advertisement ID, deployment ID, and so forth), and permission value. This view contains the same information as the v_UserInstancePermissions view, but instead of using one decimal value for combined permissions, it lists each permission individually by name.

The view can be joined to the other security views by using the ObjectKey column and to other views by using the UserName or InstanceKey columns. The InstanceKey column contains Configuration Manager object ID’s, such as collection ID, advertisement ID, query ID, package ID, update assignment ID, and so on. The secured objects are listed in the v_SecuredObjects view.

Configuration Manager Secured Objects

Class and instance permissions can be set on more than 20 secured objects in Configuration Manager 2007. These Configuration Manager secured objects and their associated object keys are listed in the following table.

Object Key Object Name

1

Collection

2

Package

3

Advertisement

4

Status message

5

(Not used)

6

Site

7

Query

8

Report

9

Software metering rule

10

Applicable updates summary

11

Configuration items

12

(Not used)

13

(Not used)

14

OS install package

15

Deployment template

16

Deployment

17

Computer association

18

OS image

19

Boot image package

20

Task sequence package

21

Device setting package

22

Device setting item

23

Driver package

24

Deployment package

25

Device driver

How to Interpret Decimal Permission Values

In the security views, there are decimal values that equate to a specific class or instance permissions. Each individual permission uses one of 28 bits. The following table lists each of these permissions, the bit that is used, and the decimal value of that bit.

Permission Name Bit Value Bit Position Decimal Value

Read

1

1

1

Modify

10

2

2

Delete

100

3

4

Distribute

1000

4

8

Create Child

10000

5

16

Use remote tools

100000

6

32

Advertise

1000000

7

64

Modify resource

10000000

8

128

Administer

100000000

9

256

Delete resource

1000000000

10

512

Create

10000000000

11

1024

View collected files

100000000000

12

2048

Read resource

1000000000000

13

4096

Delegate

10000000000000

14

8192

Meter

100000000000000

15

16384

Manage SQL commands

1000000000000000

16

32768

Manage status filters

10000000000000000

17

65536

Manage folders

100000000000000000

18

131072

Network access

1000000000000000000

19

262144

Import computer entry

10000000000000000000

20

524288

Create task sequence media

100000000000000000000

21

1048576

Modify collection setting

1000000000000000000000

22

2097152

Manage OSD and ISV Proxy Certificates

10000000000000000000000

23

4194304

Recover user state

100000000000000000000000

24

8388608

Manage management controllers

1000000000000000000000000

25

16777216

View management controllers

10000000000000000000000000

26

33554432

Manage Asset Intelligence

100000000000000000000000000

27

67108864

View Asset Intelligence

1000000000000000000000000000

28

134217728

To interpret a permission value, you can convert the decimal value to binary and use the preceding table to get the specific permissions. To help understand this process, see the following examples.

Decimal Conversion Example 1

In the v_SecuredObject view, the SMS_Site secured object has a value of 638983 in the AvailableInstancePermissions column. To find out what this means, first convert the decimal number to binary. This equates to 10011100000000000111, in which the 1st, 2nd, 3rd, 15th, 16th, 17th, and 20th bits are used. Use the bit values from the preceding table to calculate the values in the following table. When the decimal values are added, they will total the initial 638983 value.

Permission Name Binary Position Decimal Value

Read

1

1

Modify

2

2

Delete

3

4

Meter

15

16384

Manage SQL commands

16

32768

Manage status filters

17

65536

Import computer entry

20

524288

Decimal Conversion Example 2

In the v_SecuredObject view, the SMS_Collection secured object has a value of 52435687 in the AvailableInstancePermissions column. This decimal number results in 11001000000001101011100111 when converted to binary. This is interpreted as shown in the following table.

Permission Name Binary Position Decimal value

Read

1

1

Modify

2

2

Delete

3

4

Use remote tools

6

32

Advertise

7

64

Modify resource

8

128

Delete resource

10

512

View collected files

12

2048

Read resource

13

4096

Modify collection setting

22

2097152

Manage management controllers

25

16777216

View management controllers

26

33554432

See Also