What might cause users in different roles to see different results for Serial Number in the Active Windows Systems view?

Question

I'm an SCSM administrator. In the SCSM console I select 'Configuration Items', expand 'Computers', then select the 'Active Windows Systems' view. I double-click any Windows 10 system in the list to show details (for illustration purposes, let's say I double-click a workstation named Win10Workst001.) On the 'General' tab under 'Computer Identity' there is an accurate value in the 'Serial Number' field.

Jeff is NOT an SCSM administrator. He's in an Active Directory group called 'Desktop Services Team', which makes him a member of the 'Desktop Services Team Operator' role in SCSM. This role is granted access to the Configuration Item group called 'Desktop Services'. That group includes all Workstations (not servers). The 'Desktop Services Team Operator' role is also granted access to the 'Active Windows Systems' view. When Jeff selects the 'Active Windows Systems' view in the SCSM console and double-clicks Win10Workst001, he finds that the 'Serial Number' field is empty.

What could be causing this? Jeff has access to the same view and the same computer (configuration item) that I do. Is there a granular permission somewhere that prevents Jeff from seeing the value in this specific field?

Answer 1

Hi,

The issue Jeff is experiencing could be related to the granular permissions set within the SCSM role definitions. Even though Jeff has access to the 'Active Windows Systems' view and the 'Desktop Services' Configuration Item group, it's possible that the 'Desktop Services Team Operator' role does not have permissions to view certain properties of the Configuration Items, such as the 'Serial Number' field.

In SCSM, permissions can be very specific, and they are often defined in the User Role profiles and scopes. A User Role in SCSM is a combination of a Profile and a Scope, where the Profile defines the operations that a User Role can perform, and the Scope defines the objects that can be operated on. If the scope or the profile for the 'Desktop Services Team Operator' role is limited, it may not include the permission to view certain fields like 'Serial Number'.

To resolve this issue, you may need to review the User Role profile and scope for the 'Desktop Services Team Operator' role to ensure that it includes permissions to view all the necessary fields of the Configuration Items. If the permissions are not set correctly, you might need to modify the User Role to include these permissions.

https://learn.microsoft.com/en-us/system-center/scsm/user-roles?view=sc-sm-2022

Answer 2

Hi, the Serial Number property is not part of the Windows Computer class, this is why your scope Desktop Services Team Operator users are not seeing any content. You need to grant access to the Microsoft.SystemCenter.ConfigurationManager.DeployedComputer class for the scoped role. The class display name is "Computer (Deployed)". I hope this helps.