Admin console install and user rights

Question

We have just rolled out Adaxes and a few of our Help Desk techs (i.e. non-admins) will be responsible for creating the logic behind some customized 'business rules' and 'custom commands' in the Admin console.

I'm guessing we can install just the Admin console to the respective Help Desk tech's workstations to give them access to the 'business rules' and 'custom commands.' When we bind the console to the server hosting the Adaxes Service, can we use the account credentials belonging to the Help Desk technician? The concern is that using our Adaxes service account (which has domain admin rights) to bind the console may grant the Help Desk techs with more access to our AD infrastructure than is appropriate.

Answer 1

Hello,

Yes, you can install Adaxes Administration Console only without installing the other Adaxes components. For this purpose, on the Select Features step of Adaxes Installation Wizard, you need to unselect all features except the Service Administration Console.

Your helpdesk technicians will be able to log in using their own credentials, and the actions that they can perform will be limited to only the rights granted to them with the help of Security Roles. So, if you want them to be able to modify Business Rules and Custom Commands, you need to grant them the appropriate permissions. However, if you grant the rights to modify Business Rules and Custom Commands to your helpdesk staff, it will be actually almost the same as giving them unrestricted access to your AD. If you grant them such rights, they will be able, for example, to create Custom Commands to modify any property of any AD account, even if they don't have sufficient permissions to modify such a property. Then, they will be able to execute the Custom Command on any AD account they have access to.

Nevertheless, if you would still like to grant rights to modify Business Rules and Custom Commands, we can provide you with instructions on which specific permissions they need.