When creating an object (such as a collection or advertisement), the user might want to allow other users (or groups) to use or manage the object. This is possible if the user has the class-level Administer right, but that also allows them to do anything they want to with any instance of that object type. A better solution is to give the user the class-level Delegate right, which allows them to grant rights to users and groups for objects they create. However, users can only grant rights that they are explicitly granted at the instance level; they cannot grant rights that they are granted through group membership or at the class level.

For example, a user might have the class-level Create and Delegate rights for Collections. The user also has instance-level Read, Read Resource, and Advertise rights for the “All Windows XP Systems” collection. The user can then create a new collection based on the membership of the “All Windows XP Systems” collection. The user can then grant the Read and Read Resource rights to the new collection—but not Create or Delegate rights—to another group so that the members of that group can view members of the new collection.

Note
Grant permissions to each administrator carefully at the instance level, unless they require permissions at the class level. Create a collection of the resources that each administrator manages and grant permissions only to that collection. As a result, each administrator sees only those security objects to which access is granted.

Often, the rights you set on collections affect your ability to perform tasks in other nodes in the Configuration Manager 2007 console. For example, granting the Read object security right on a collection not only gives the user the right to see that collection but also to see resources within that collection. The user can view the properties of the resource and can invoke the Resource Explorer, but they cannot see the values of the Resource Explorer groups. For that level of detail, the user also requires the Read Resource right. To further manage computer resources, give the user the Use Remote Tools or View Collected Files rights. To remove the resource from Configuration Manager 2007 altogether (as opposed to just removing the collection rule that makes that resource a member of the collection), the user must have the Delete Resource right.

You can manage resources through queries, but the Read right on queries gives you the privilege only to see and run the queries. The right to view resources in a query result window and to manage those resources is granted by the rights set for collections that those resources are in.

To manage the site database, site maintenance Microsoft SQL Server commands can be created in the Configuration Manager 2007 console, under the Site Settings node for each site. These commands have complete rights in the site database and can manipulate the data and database in any way. To prevent malicious use of this powerful facility, you should limit the Manage SQL Commands instance of the Site class to only those senior administrators that require this right.

Note
To add, delete, or modify SQL commands, you must also have the Modify right on the Site object.

One of the primary software metering tasks is to create software metering rules. Software metering rules can apply not only to the site they are created for but also to the child sites of that site. To manage software metering rules, the Configuration Manager 2007 administrator must have appropriate software metering rule object security rights. For those rules to apply to a site, the administrator must also have the Site class Meter instance right, or the class-level site Meter right, in which case the rules apply to all sites the rule is distributed to. The Meter rights that are relevant are the rights at the site where the rule originates, not the rights at the sites the rule is distributed to.

To add software updates to a template or to a deployment, either by dragging and dropping or by using the Action menu, you must have the following rights.

Because advertisements involve the package and the collection, you must have the following rights to create an advertisement:

• Read rights on the collection receiving the advertisement
  
  
• Advertise rights on the collection receiving the advertisement
  
  
• Read rights on the package containing the advertised program
  
  

You must have the following rights to delete an advertisement:

• Delete rights on the advertisement
  
  
• Advertise rights on the collection receiving the advertisement
  
  
• Read rights on the package containing the advertised program
  
  

Some operating system deployment tasks require access to packages, collections, advertisements, and site objects.

Note
If a task sequence requires a software distribution package or an OS image, Configuration Manager 2007 must have Read to the Package class, not just the instance of the package to be distributed.

Some actions might appear to work even if the user does not have sufficient rights. For example, even with no rights to create objects in the Boot image package class, a user can start the import process, but the wizard will fail due to insufficient rights.

In Configuration Manager 2007 Service Manager, you must have the Administer right on the primary site object to perform the following tasks:

• Query a service
  
  
• Stop a service
  
  
• Start a service
  
  
• Configure service logging
  
  

On a secondary site, you must be a member of the local Administrators group to perform these tasks.