Limited administrator with read-only rights cannot remotely run commands on groups in the SEPM

Article Id: 156082
Status: Published
Updated On: 10-09-2012 06:40
Legacy Id: TECH183977
Products:
Endpoint Protection
Issue/Introduction:

Command failed to run when trying to update content from the Symantec Endpoint Protection Manager console (SEPM) using a limited administrator account with read-only rights.
 
This option was working in version 11.0.4 but does not in 12.1 RU1.

- When running a scan from the SEPM: Monitors / log tab / view "computer status" log, the following error message appears:

 

- When right clicking on the client to run a command, the option is greyed out:

Cause:

Work as designed

Resolution:

- To resolve this, limited administrators require "Full access" rights in the "Manage groups" section instead of "Read Only"

 

- However, this means that giving limited administrators full access will also allow them to delete groups, subgroups or move clients.

- There is a product enhancement topic created regarding this issue on Symantec Forum, do not hesitate to vote:

www-secure.symantec.com/connect/idea/allow-limited-administrator-read-only-group-rights-remotely-run-commands

 


Applies To

Impact all SEPM versions released after 11.0.4

- Actions followed to reproduce the issue:

1. Create a test account in the SEPM as "limited administrator"

2. Edit the administrator access rights as follow:

    * Limited access rights ticked:
          - "View reports" (all of them "*")
          - "Manage groups" and give "Read only" access to the specific group
          - "Remotely run commands" (rights are as follow: All of them except "restart client computers")
 
3. Log off and log on using the test administrator account
 
4. Click on Monitors / log tab / view "computer status" log
 
5. Select one of the client and click on run scan command
 
6. Select any type of scan and click on "OK": Error message "The command failed to run"
 
7. Verify in the client group if it is possible to right click on the client to run a command: No, option greyed out