Dynamic Groups - Deny changes

Hi craig mcfarlane 

There are a couple of ways of doing that

1) Don't grant uses permissions over the (dynamic) groups objects they shouldn't be able to manage. As Johnny says if they are all ARS Admin, people delegated permissions appropriate for the relveant sets of teams, the ARS Full Admin group is for the Active Roles product administrator, not for normal day to day, as it give configurational access to the product, meaning anyone with it could change anything.

2) Have a workflow which intercepts changes made to dynamic groups, set its start condition by for members of particular groups, within an area of AD, where the attribute used to store DG rule is updated. Then remove the change from the request, or just use a Break/Stop activity step to make it error... (removing the value from the request just makes it so that an attribute isn't changed, however the person making the change would assume its happened).

There are a couple of other ways, but from my point of view, its better to not grant users permissions in the first place, rather than add deny permissions. For everything else there are workflows and script modules.

Hi craig mcfarlane 

There are a couple of ways of doing that

1) Don't grant uses permissions over the (dynamic) groups objects they shouldn't be able to manage. As Johnny says if they are all ARS Admin, people delegated permissions appropriate for the relveant sets of teams, the ARS Full Admin group is for the Active Roles product administrator, not for normal day to day, as it give configurational access to the product, meaning anyone with it could change anything.

2) Have a workflow which intercepts changes made to dynamic groups, set its start condition by for members of particular groups, within an area of AD, where the attribute used to store DG rule is updated. Then remove the change from the request, or just use a Break/Stop activity step to make it error... (removing the value from the request just makes it so that an attribute isn't changed, however the person making the change would assume its happened).

There are a couple of other ways, but from my point of view, its better to not grant users permissions in the first place, rather than add deny permissions. For everything else there are workflows and script modules.