Assign Administrator Roles

 

Applies To: Windows Server 2012 R2, Windows Server 2012

Checklist: Assign Roles > Configure IPAM Server Roles > Assign Administrator Roles

Important

IPAM in Windows Server 2012 R2 includes a role based access control feature that enables detailed control of the procedures that IPAM users are able to perform. Role based access control adds permissions to the user’s existing access permissions. You cannot deny permission for a user with an access policy. If a user already has permission granted to perform a procedure because they are a member of one or more IPAM administrator groups, they will continue to have that permission even if they have only limited rights granted by role based access polices. If you have deployed IPAM on Windows Server 2012 R2, it is recommended to use the new access control feature available in this version of IPAM. Do not assign IPAM administrator roles using the procedures in this topic unless you do not need to enable fine-grained access control for IPAM tasks. For more information, see Access Control.

Membership in the Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).

Assigning IPAM administrator roles

Use the following procedures to assign IPAM administrator roles using built-in local security groups on the IPAM server:

To assign IPAM administrator roles

1. On the IPAM server, click Tools on the Server Manager menu and then click Computer Management.

2. In the Computer Management console tree, open Local Users and Groups and then click Groups. The following local IPAM security groups are displayed:

   • IPAM Administrators: IPAM administrators can view all IPAM data and manage all IPAM features.

   • IPAM ASM Administrators: IPAM address space management (ASM) administrators can manage IP address blocks, ranges, and addresses.

   • IPAM IP Audit Administrators: IPAM IP audit administrators can view IP address tracking data.

   • IPAM MSM Administrators: IPAM multi-server management (MSM) administrators can manage DNS and DHCP servers.

   • IPAM Users: IPAM users can view information in IPAM, but cannot manage IPAM features or view IP address tracking data.

3. To add a user or group to the group, double-click the group, click Add, type the username under Enter the object names to select, and then click OK.

4. Verify that the user you added is displayed under Members.

   

5. To remove a user or group from the group, click the user under Members and then click Remove.

6. To add or remove another user or group, repeat this procedure.

7. Click OK when you are finished, and then close the Computer Management console.

The following table summarizes IPAM actions and functions that are permitted or denied with membership in the specified security group. Access rights are additive if a user or group is a member of multiple security groups.

Security Group	Server Inventory	IP Address Space	Monitor and Manage	Event Catalog	IP Address Tracking	Common Management Tasks
IPAM Administrators	Manage	Manage	Manage	View	View	Manage
IPAM ASM Administrators	Manage*	Manage	View	View	Denied	Manage
IPAM IP Audit Administrators	Manage*	View	View	View	View	Manage
IPAM MSM Administrators	Manage*	View	Manage	View	Denied	Manage
IPAM Users	View	View	View	View	Denied	View

*If the Group Policy-based automatic provisioning method is used, GPO access permission must be delegated to add or remove servers from GPO security filtering.

Common management tasks include:

• Connect to an IPAM server

• IPAM settings:

  • Configure server discovery

  • Configure custom fields

  • Configure utilization threshold

• Starts server discovery

• Retrieve all server data

Members of the local Administrators group on the IPAM server also have permission to modify the server inventory and perform common management tasks.

If a user does not have sufficient privileges to perform an action, they will receive an alert that is unique to the action they are attempting to perform.

See Also

IPAM Server