Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
How to track unwanted privileges? RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi every body

    Recently we faced to a new problem with MS CRM 4 User's access to others objects: Some users have unwanted access rights to other business units that they prohibited in their Roles definitions. Therefore we need to track and find out which Role, Sharing, or assignment is the root of this problem?! Can you help me? (any recommend in SQL will be helpful + I have the unwanted privilege ID with Access Checker)

    In addition is there any way to reset/reconfigure/rebuild every privileges to the whole of microsoft crm 4 database?



    • Edited by Soroosh81 Thursday, April 25, 2013 10:11 AM
    Thursday, April 25, 2013 9:54 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    First off, there is no such thing as "prohibited" in CRM security roles.  All roles are additive, and the most permissive role for any entity wins. (i.e. there is nothing analogous to the "deny" permission in Windows)

    So you're going to have to check the roles they're in, and the CRM User report is a good start.  It will report all roles a user is a part of, and then you can start testing which roles are too broad.

    As for resetting and re-configuring roles in CRM, just remove all roles from everyone and start fresh with new roles.

    The postings on this site are solely my own and do not represent or constitute Hitachi Solutions' positions, views, strategies or opinions.

    Thursday, April 25, 2013 8:44 PM