{"id":2918,"date":"2012-04-10T10:29:01","date_gmt":"2012-04-10T08:29:01","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=2918"},"modified":"2012-04-10T10:29:01","modified_gmt":"2012-04-10T08:29:01","slug":"remote-work-with-the-runbook-designer-console-and-security-roles-in-orchestrator","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=2918","title":{"rendered":"Remote work with the Runbook Designer console and security roles in Orchestrator"},"content":{"rendered":"<p>In this post I will show you what you need to configure to allow engineers connect remote\u00c2\u00a0to the Orchestrator\u00c2\u00a0environment\u00c2\u00a0without Orchestrator administrator permissions. After Orchestrator installation we have one security group, the Orchestrator User Group. If your Orchestrator environment is in an Active Directory domain you should use an Active Directory security group as the Orchestrator User Group. The Orchestrator User Group has full access to the Orchestrator environment. If you enabled remote connection during installation, members of the Orchestrator User Group can also remote connect to the Orchestrator environment, for example run the Runbook Designer console from a workstation. A common scenario is that other engineers and experts need access to the Orchestrator environment too, for example the Service Manager team wants to author some runbooks. At the same time the Service Manager engineers should not have access to every runbook, only runbooks created by the Service Manager team. In other Words you cant add the Serivce Manager team to the Orchestrator User Group.\u00c2\u00a0To solve this we need to perform the following steps<\/p>\n<ul>\n<li>Assign general Orchestrator permissions to a &#8220;Orchestrator Remote Users&#8221; security group. There are a number of general permissions that everyone that will work with Orchestrator remote needs. We will assign these permissions to a Orchestrator Remote Users group. By using one general group for this kind of permissions the administration gets a bit easier. In this example my group is named SKYNET\\grp-sco-remoteusers.<\/li>\n<li>Assign specific Service Manager team permissions to a &#8220;Service Manager Team&#8221; security group. We will most likely have more teams then the Service Manager team working with runbooks. Each team will need specific permissions, which will result in one specific security group for each team. In this example my Service Manager team group is named SKYNET\\grp-sco-scsmteam.<\/li>\n<\/ul>\n<p>We will start by assign the Orchestrator Remote Users Group suitable DCOM permissions<\/p>\n<ol>\n<li>On the Orchestrator Management Server, start Component Services from the start\u00c2\u00a0menu<\/li>\n<li>In the Component Services console, expand Component Services, expand Computers and expand DCOM Config<\/li>\n<li>In the list of DCOM applications scroll down and select omanagement. Right-click the omanagement DCOM application and select properties from the context meny<br \/>\n<img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2921\" title=\"20120409_01\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_01-300x194.jpg\" alt=\"\" width=\"300\" height=\"194\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_01-300x194.jpg 300w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_01.jpg 398w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/li>\n<li>In the omanagement Properties window, click the Security tab<\/li>\n<li>Click Edit in the Launch and Activation Permissions area, click Add and add the grp-sco-remoteusers security group from Active Directory. Assign the grp-sco-remoteusers\u00c2\u00a0security group Remote Launch and Remote Activiation permissions. Click OK<\/li>\n<li>Click Edit in the Access Permissions area, click Add and add the grp-sco-remoteusers\u00c2\u00a0security group from Active Directory. Assign the grp-sco-remoteusers\u00c2\u00a0security group Remote Access and Local Access permissions. Click OK<\/li>\n<li>In the Component Services console, right-click My Computer and select properties from the context menu<\/li>\n<li>In the My Computer Properties box, select the COM Security tab<\/li>\n<li>Click Edit Limits\u00e2\u20ac\u00a6 in the Access Permissions area. Click Add and add the grp-sco-remoteusers\u00c2\u00a0security group from Active Directory. Assign the grp-sco-remoteusers\u00c2\u00a0security group Remote Access permissions. Click OK<\/li>\n<li>Click Edit Limits\u00e2\u20ac\u00a6 in the Launch and Activation Permissions area. Click Add and add the grp-sco-remoteusers\u00c2\u00a0security group from Active Directory. Assign the grp-sco-remoteusers\u00c2\u00a0security group Remote Launch and Remote Activation permissions. Click OK<\/li>\n<li>Close the Component Services console 12.\u00c2\u00a0After all permissions are configured, on the Orchestrator Management server, start the Services console and restart the Orchestrator Management Service (ManagementService.exe ). If a user dont have correct DCOM permissions to access Orchestrator you will see a error message in the Runbook Designer console, like the one below<\/li>\n<\/ol>\n<p><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_031.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2927\" title=\"20120409_03\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_031-300x112.jpg\" alt=\"\" width=\"300\" height=\"112\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_031-300x112.jpg 300w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_031.jpg 471w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a> and on the Orchestrator management server you will see a event like this <a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_04.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2928\" title=\"20120409_04\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_04-300x190.jpg\" alt=\"\" width=\"300\" height=\"190\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_04-300x190.jpg 300w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_04.jpg 561w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>All users that will work with the Orchestrator Runbook Designer console needs read permissions to the top level of the Runbooks folder navigation tree. To assign the grp-sco-remoteusers\u00c2\u00a0security group permissions to the root level follow these steps<\/p>\n<ol>\n<li>Start the Orchestrator Runbook Designer console as an Orchestrator administrator<\/li>\n<li>Right-click the Runbooks folder and select Permissions from the context menu<\/li>\n<li>In the Permissions for Runbooks dialog box, click Add.. and add the grp-sco-remoteusers\u00c2\u00a0security group from Active Directory<\/li>\n<li>In the Permissions for Runbooks dialog box, un-selected everything except Read as permissions for the grp-sco-remoteusers\u00c2\u00a0group<\/li>\n<li>In the Permissions for Runbooks dialog box, click Advanced<\/li>\n<li>In the Advanced Security Settings for Runbooks dialog box, select the grp-sco-remoteusers\u00c2\u00a0security group and click Edit\u00e2\u20ac\u00a6<\/li>\n<li>In the Permissions Entry for Runbooks dialog box, change the Apply To drop-down menu to This object only<\/li>\n<li>In the Permissions Entry for Runbooks dialog box, click OK<\/li>\n<li>In the Advanced Security Settings for Runbooks dialog box, click OK<\/li>\n<li>In the Permissions for Runbooks dialog box, click OK<\/li>\n<\/ol>\n<p>Depending on your environment the different teams need different access to runbook servers. To assign the grp-sco-remoteusers\u00c2\u00a0access to all Runbook Servers follows these steps:<\/p>\n<ol>\n<li>Start the Orchestrator Runbook Designer console as an Orchestrator administrator<\/li>\n<li>Right-click the Runbook Servers folder and select Permissions from the context menu<\/li>\n<li>In the Permissions for Runbook Servers dialog box, click Add and add the grp-sco-remoteusers security group from Active Directory. Click OK<\/li>\n<li>In the Permissions for Runbook Servers dialog box, un-select all permissions for the grp-sco-remoteusers group\u00c2\u00a0except Read. Click Ok<\/li>\n<\/ol>\n<p>Your different teams will also need access to Global Settings. To give the grp-sco-remoteusers\u00c2\u00a0security group permissions to list Global Settings follow these steps:<\/p>\n<ol>\n<li>Start the Orchestrator Runbook Designer console as an Orchestrator administrator<\/li>\n<li>Expand Global Settings, one by one, right-click Counters, Variables and Schedules. Select Permissions from the context menu<\/li>\n<li>In the Permissions dialog box, click Add, add the grp-sco-remoteusers\u00c2\u00a0security group from Active Directory. Click OK<\/li>\n<li>In the Permissions dialog box, select the grp-sco-remoteusers\u00c2\u00a0group and click Advanced<\/li>\n<li>In the Advanced Security Settings dialog box, select the grp-sco-remoteusers\u00c2\u00a0security group and click Edit<\/li>\n<li>In the Permission Entry dialog box, change Apply To to This object only, and select only List Contents and Read Properties permissions. Click OK<\/li>\n<li>In the Advanced Security Settings dialog box, click OK 8. In the Permissions dialog box, click OK<\/li>\n<\/ol>\n<p>You have now configured the grp-sco-remoteusers\u00c2\u00a0security group with general permissions to remote connect to the Orchestrator management server with the Orchestrator Runbook Designer console. The security group doesn&#8217;t have access to anything in the Orchestrator Runbook Designer console (except Runbook Servers), when a user in this group click for example Variables an error like the own below will show.<\/p>\n<p><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_02.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2925\" title=\"20120409_02\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_02-300x143.jpg\" alt=\"\" width=\"300\" height=\"143\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_02-300x143.jpg 300w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_02.jpg 368w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The next step is to configure permissions for the different teams, in this example the Service Manager team, group grp-sco-scsmteam. We will create a new Runbook folder where the Service Manager team can work with Runbooks.<\/p>\n<ol>\n<li>Start the Orchestrator Runbook Designer console as an Orchestrator administrator<\/li>\n<li>Right-click the Runbooks folder and select new folder<\/li>\n<li>Name the folder Service Manager Team<\/li>\n<li>Right-click the Service Manager Team folder and select Permissions from the context menu<\/li>\n<li>In the Permissions for Service Manager Team dialog box, click Add and add the grp-sco-scsmteam\u00c2\u00a0security group from Active Directory. Click OK<\/li>\n<\/ol>\n<div>\n<p>The Service Manager team need access to global settings too<\/p>\n<ol>\n<li>Start the Orchestrator Runbook Designer console as an Orchestrator administrator. Navigate to Global Settings<\/li>\n<li>Under Counters, Variables and Schedules create a folder and name it Service Manager Team<\/li>\n<li>Right-click each new folder and select permissions from the context menu. Click Add and add the grp-sco-scsmteam\u00c2\u00a0security group from Active Directory. Click OK<\/li>\n<\/ol>\n<div>\n<p>\u00c2\u00a0We have now created a runbook folder for the Service Manager team runbooks and then created one folder for each kind of global setting.\u00c2\u00a0The Service Manager team can now work with their\u00c2\u00a0own runbooks but cant see or modify any other runbooks or settings.<\/p>\n<p>One thing to think about, that could result in multiple Orchestrator environments, is that the settings that are under the Options menu will be shared with everyone running the Runbook Designer console. There is no easy way to limit access to for example the Active Directory connection or the Virtual Machine Manager connection. This is something to think about when doing the security design for Orchestrator.<\/p>\n<p><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_05.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2937\" title=\"20120409_05\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_05-246x300.jpg\" alt=\"\" width=\"246\" height=\"300\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_05-246x300.jpg 246w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2012\/04\/20120409_05.jpg 301w\" sizes=\"(max-width: 246px) 100vw, 246px\" \/><\/a><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In this post I will show you what you need to configure to allow engineers connect remote\u00c2\u00a0to the Orchestrator\u00c2\u00a0environment\u00c2\u00a0without Orchestrator administrator permissions. After Orchestrator installation we have one security group, the Orchestrator User Group. If your Orchestrator environment is in an Active Directory domain you should use an Active Directory security group as the Orchestrator &hellip; <a href=\"http:\/\/contoso.se\/blog\/?p=2918\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[60],"tags":[],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2918"}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2918"}],"version-history":[{"count":15,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2918\/revisions"}],"predecessor-version":[{"id":2942,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2918\/revisions\/2942"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2918"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}