McAfee EPOCDE-AA-BA Product Guide - Page 48

6 Setting up permission sets How users, groups, and permission sets fit together An example access configuration As an example, let's say you want to give all users from your "Dallas" Active Directory server access to a specific group of reports, and you want one particular engineer (let's call her "ElaineG") to be able to create and modify queries in that group. To accomplish this, you'll need to create two permission sets and one group, and edit ElaineG's user account. 1 Create a permission set called "Dallas Users." 2 Add the Dallas Active Directory server to the list called Active Directory groups mapped to this permission set. 3 Make sure they have the Queries and Reports permission Use all public groups and the shared groups below; create and edit personal queries/reports. as well as other permissions you want to grant. 4 Duplicate the "Dallas Users" permission set and call the new set "Dallas Report Creators". 5 Create a query group called "Dallas Reports" and give it By permission set (Shared Groups) visibility to the "Dallas Users" and "Dallas Report Creators" permission sets. 6 In the "Dallas Users" permission set, select the "Dallas Reports" group under Queries and Reports permissions. Do the same for the "Dallas Report Creators" permission set. 7 Change the Queries and Reports permission in this new permission set to Edit public groups and the shared groups below; create and edit personal queries/reports; make personal queries/reports public. The list of selected groups should not change. 8 Edit ElaineG's user account and assign her to the "Dallas Report Creators" group. You've now got an entire class of users (members of the "Dallas" Active Directory server) with access to a specific query group, and an individual with the ability to create and modify queries and reports within that group. 48 McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide