Building a custom Configmgr 2007 admin console
The work that needs to be done in the Configuration manager 2007 admin console is often spread out amongst different team members. Not all of these team members require access to the full admin console. Most environments do configure the permission set in a somewhat restrictive member so that team members only have the permission they need, but what is often forgotten is building a custom minimal admin console with just access to the features people need.
This shouldn't be done from a security point of view, the additional security this brings is neglectable, but more from a usability point of view. It makes the admin console easier to use, and avoids access denied errors, or empty detail panes because someone clicks on a heading in the admin console for which he doesn't have permission.
Now how do you build such a custom Configmgr 2007 admin console you might ask.
Step 1) You launch mmc.exe
Step 2) In the File menu, you select Add/remove snap-in
Step 3) Add the system center configuration manager snap-in, and select the "Select console tree items to be loaded (custom)" radio button.
Step 4) Select the console tree items you want
Step 5) Click Next, Finish and Ok, below is a screenshot of the tree pane of the custom console I created
Step 6) Select "System Center Configuration manager" in the tree pane, right-click it and select "New Window from here"
Step 7) In the File menu select options
Step 8) Name your console "Custom Configmgr admin console"
Step 9) In the console mode select "User mode - Limited access, single window"
Step 10) Clear the checkbox for "Allow the user to customize view"
Step 11) Tick the checkbox for "Do not save changes to this console"
Step 12) In the file menu save your snap-in
Step 13) In the prompt about multiple windows being open click "Yes"
Step 14) Launch your customized mmc console and verify whether everything looks according to plans.
PS: a similar option was already available in sms.
--
Enjoy.
The work that needs to be done in the Configuration manager 2007 admin console is often spread out amongst different team members. Not all of these team members require access to the full admin console. Most environments do configure the permission set in a somewhat restrictive member so that team members only have the permission they need, but what is often forgotten is building a custom minimal admin console with just access to the features people need.
This shouldn't be done from a security point of view, the additional security this brings is neglectable, but more from a usability point of view. It makes the admin console easier to use, and avoids access denied errors, or empty detail panes because someone clicks on a heading in the admin console for which he doesn't have permission.
Now how do you build such a custom Configmgr 2007 admin console you might ask.
Step 1) You launch mmc.exe
Step 2) In the File menu, you select Add/remove snap-in
Step 3) Add the system center configuration manager snap-in, and select the "Select console tree items to be loaded (custom)" radio button.
Step 4) Select the console tree items you want
Step 5) Click Next, Finish and Ok, below is a screenshot of the tree pane of the custom console I created
Step 6) Select "System Center Configuration manager" in the tree pane, right-click it and select "New Window from here"
Step 7) In the File menu select options
Step 8) Name your console "Custom Configmgr admin console"
Step 9) In the console mode select "User mode - Limited access, single window"
Step 10) Clear the checkbox for "Allow the user to customize view"
Step 11) Tick the checkbox for "Do not save changes to this console"
Step 12) In the file menu save your snap-in
Step 13) In the prompt about multiple windows being open click "Yes"
Step 14) Launch your customized mmc console and verify whether everything looks according to plans.
PS: a similar option was already available in sms.
--
Enjoy.
No comments:
Post a Comment