Manage Groups

An administrator can create a group of users on the Autodesk Vault server or domain user groups can be imported, retaining the group membership and security settings. Groups can then be managed using Windows permissions. Importing a domain group imports all members of the group as well as sub-groups.

This allows for accounts to be created using Active Directory information and allows users to log into a data management client without requiring a new account. If a user account or group already exists on the vault server, it can be promoted to an Active Directory account or group. Likewise, an account or group created by importing an Active Directory account can be disconnected or demoted from the Active Directory domain, making the account or group unique to the vault server.

You cannot manage Active Directory accounts through the server console. You can only import Active Directory accounts, promote vault server accounts to the Active Directory domain, or demote Active Directory accounts to standard vault server user accounts. To manage Active Directory user accounts and Active Directory group membership, you must use the User Accounts controls in the Windows Control Panel.

1. Select Tools  Administration Global Settings.
2. In the Global Settings dialog, select the Security tab.
3. Click Groups.
4. In the Group Management dialog, you can list groups three different ways:
   • Select View  List to view the groups in a flat list.
   • Select View  By Vault to view the groups as a list grouped by the vaults to which they are assigned.
   • Select View  By Role to view the groups as a list grouped by roles.

1. Click New.
2. In the Group dialog box, specify the group settings, and then click OK.
3. Click Close.

1. Select a group from the list.
2. Click Edit.
3. In the Group dialog box, specify the group settings, and then click OK.
4. Click Close.

1. In the Group Management dialog, select a vault server group and then select Actions  Promote to Domain Group.
2. In the Select Groups dialog, click Locations to specify the domain containing the Active Directory group to which the selected vault server group will be mapped. In the Locations dialog, select the domain to use and then click OK.
3. In the Select Groups dialog, enter the name of the Active Directory domain group to which the vault server group will be promoted or click Advanced to search for the group.
4. Once the group has been specified, click OK in the Select Groups dialog. The vault server group information is replaced with the domain group information.

All members of the group as well as sub-groups are imported. Groups imported from an Active Directory domain retain the group name and e-mail address from Active Directory. The domain name is displayed in front of the group name.

Edit groups

1. In the Group Name field, enter a name for the group.
2. Enter an e-mail distribution list address for the group in the Email field. You can also enter a list of individual email addresses separated by a semicolon (;).
3. Click Roles and assign one or more roles to the group. Every member of the group is assigned the permissions of the group. Individual user roles are combined with the roles assigned to the group to which a user belongs. As a best practice, always assign roles to groups to make user permission management easier.
4. Click Vaults and select one or more vaults to which the group has access. Every member of the group has access to the vaults assigned to the group.
5. A group can be a member of another group. Click Groups and select one or more groups to which this group belongs.

Add members to groups

1. Click Add to add members to the group.
2. From the Add Users dialog box, select the users to include in the group, and then click OK.

Remove members from groups

1. Select a member from the Group Members list.
2. Click Remove.

Enable or disable groups

Similar to a user profile, a group can be enabled or disabled. A group must be enabled for the permissions of the group to be active. When a group is disabled, the roles and vault access assigned to the group are no longer available to the members of that group.

• Click the Enable group check box to make the group permissions available to all members.
• Clear the Enable group check box to deny the group permissions to all members.

The Add Groups dialog box displays the enabled groups which the current user profile or group belongs to and which groups they can be added to. A check next to the group name indicates that the user profile that is currently being added or edited belongs to that group.

• Clear the check box next to a group to remove the user profile from the group.

• Click the check box next to a group to add the user profile to the group.

A vault server group can be promoted to an domain group. Promoting a vault server group to an Active Directory group maps the vault server group to an existing domain group. Promoting a group replaces the vault server group information with the selected domain information.

1. In the Group Management dialog, select a group, select a vault server group and then select Actions Promote to Domain Group.
2. In the Select Groups dialog, click Locations to specify the domain containing the Active Directory groups to import. In the Locations dialog, select the domain to use and then click OK.
3. In the Select Groups dialog, enter the names of the groups to add from the Active Directory domain or click Advanced to search for the groups.
4. Once the groups have been specified, click OK in the Select Groups dialog. The vault server group information is replaced with the domain group information.

A vault server group that was imported from an Active Directory domain or promoted to an Active Directory domain can be demoted, creating a vault server-only group. Once demoted, the group is unique to the vault server and no longer associated with the domain group.

• In the Group Management dialog, select an Active Directory group and then select Actions  Demote Domain Group. When the group is demoted, the domain name is removed from the group name. As a result, the demoted group may collide with an existing vault server group with the same name. If the vault server group name already exists, you are prompted to rename the demoted group.

The vault server group retains the vault server group membership and permissions but is no longer associated with the Active Directory group.

If members have been added or removed from the Active Directory domain group, the vault server group can be updated to reflect the changes to the group.

1. In the Group Management dialog, select a group.
2. Select Actions  Update Domain Group.