Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
creating a new role from System Admin role RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Appreciate a quick response. Thanks, in advance.

    I recently had a problem whereby a user was unable to access Report Wizard in CRM 4.0. He kept getting permissions error. I double checked to make sure that his role allowed full report functionality across the board. He did have this yet he was unable to access the Report Wizard. I finally found a blog that said that you should create a new role based on Sys Admin role because there are hidden privs not captured when you create a role from another lower level role. 

    I went ahead and recreated the role based on Sys Admin role and changed all appropriate settings to accommodate what he should see, etc.. He now can access Report Wizard.

    Q: Should that be the standard procedure when creating a CRM role?

    Thank you

     

    Apps
    Wednesday, June 8, 2011 7:08 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Search the trace file for the w3wp process, it should have multiple lines but the latest error is at the end (there are also timestamps so you can correlate). Then you will get the exception error message and stack trace. You can post it here if you need help.

     

    I don't know the diagnostics.exe, I always use the steps described in this article: http://support.microsoft.com/kb/907490 to get the trace. The trace is usually stored under %CRMInstallDir%\Trace

    Gonzalo | gonzaloruizcrm.blogspot.com

    Thursday, June 9, 2011 12:22 PM
    Moderator

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    While it is true that there are hidden privileges that you will not be able to assign in the application when creating a role from scratch, you also should be careful about what role you copy. So yes, sometimes you need to copy a role instead of starting from scratch. However, I would never start from the system administrator role, I would pick a role that is the "closest" to what the user actually is.

     

    If you try to do the same but start from a "manager" or even "CEO" role it might work. It is safer than copying the administrator role because the administrator has every possible privilege, and since some privileges are hidden, you will not be able to remove them for the new role.

    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, June 8, 2011 7:17 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    thanks for the prompt reply. So, it really isn't a good practice to copy from Sys Admin role. Understood and makes sense. However, is there not another way to see what this role's privs are? Can I put the specific priv that allows report wizard to run in this role? if not, I guess I will have to use a manager's role to redo this person's role from and hope that it has Report Wizard privs.

    thanks

    Apps
    Wednesday, June 8, 2011 7:53 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    When you get a permissions error, you can look into the traces to see exactly what privilege is missing. Then you can go into the privilege settings to see if you can find it (but it might be hidden).

    In any case, I personally think copying the administrator role should be avoided.

    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, June 8, 2011 7:55 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    OK. Thanks. Create trace file on server and reopen trace file and look for what priv setting?

    Apps
    Wednesday, June 8, 2011 7:59 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    From the CRM Server traces you should see details on what privilege is missing. If you are not familiar with traces you can check this link: http://support.microsoft.com/kb/907490

    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, June 8, 2011 8:00 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thank you. I just can't figure the tracing out.

    Here is what I have done:

    From diagnostics exe on dev server

    • started the trace
    • clicked on 'create support file'
    • with user's role assigned to me, I opened the report wizard, got the error msg
    • stopped the trace
    • opened the file and could not figure out how to see what privs are missing.

    Did I perform the procedure properly? 

    Thanks

    Apps
    Thursday, June 9, 2011 12:14 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Search the trace file for the w3wp process, it should have multiple lines but the latest error is at the end (there are also timestamps so you can correlate). Then you will get the exception error message and stack trace. You can post it here if you need help.

     

    I don't know the diagnostics.exe, I always use the steps described in this article: http://support.microsoft.com/kb/907490 to get the trace. The trace is usually stored under %CRMInstallDir%\Trace

    Gonzalo | gonzaloruizcrm.blogspot.com

    Thursday, June 9, 2011 12:22 PM
    Moderator