BCX Network Management Tools Non Domain Admin Access

Although BCX Network Management tools were developed to be used by a Domain Admin, there may be instances where you would like non-Domain Admins to be able to use them.

This is possible to varying degrees.

A non-Domain Admin user may open BCX and use limited functions of the software by adding rights on the BCXDB database in SQL.

Use of other functions may be enabled by delegating rights over specific OUs in Active Directory and through the use of GPOs.

The recommended process follows:

User Group

For ease of granting rights, we recommend creating an AD Group for Non-Domain Admin Users (BCXManagerUsers), to which you will add the required user accounts.

SQL

Once created and members assigned, the group can be added to your BCX SQL instance.

Add new logon for BCXManagerUsers group for bcxdb database and db_datareader/db_datawriter database role memberships.

BCXManagerV4 Directory

You will then need to add Security permissions (Read) for the group on the BCXManagerV4 Directory

Data Server Access

If you require the group members to view Home Directories from within BCX, you will need to give Security permissions (Read) on the relevant directories on your User Data Server

That covers the basic operations.

If you require permissions for Creating Users / Adding Stations / Remote Funcionality, read on.

Create/Manage Users

In order to Create/Manage Users you will need to delegate the required rights on specific OUs in AD:

AD Delegate Rights - Specific User OUs.

Delegate common tasks:

Create, delete and manage user accounts.

Reset user passwords.

Force password change at next logon.

Read all user information.

Create, delete and manage groups.

Modify the membership of a group.

Add/Manage Stations

Similarly to Add/Manage Stations:

AD Delegate Rights - Specific Station OUs.

Create a custom task to delegate.

Choose Only the following objects in the folder, and check the box Computer Objects.

Check the boxes:

Create selected objects in this folder.

Delete selected objects in this folder.

Permissions – Select checkboxes to show all permissions, and select:

Read.

Write.

Create All Child Objects.

Delete All Child Objects.

Read All Properties.

Write All Properties.

Remote Functions

There are several Remote functions launchable from BCX:

Remote Desktop connection

Create a RDP rights GPO:

Computer Configuration - Policies - Administrative Templates - Windows Components - Remote Desktop services - Remote Desktop session Host - Connections - Allow users to connect remotely by using Remote desktop Services.

And add your group to Remote Desktop Users:

Computer Configuration - Policies - Windows Settings - Security Settings - Restricted Groups.

Remote browse C$

If you wish to allow your group members to access Station C$:

Computer Configuration - Policies - Windows Settings - Security Settings - Restricted Groups.

Add Administrators as with the RDP policy above.

Please be aware this will make the users "Local Admins" of the stations.

Remote Assistance

To enable your group members to Offer Remote Assistance configure the following GPO:

Computer Configuration - Policies - Administrative Templates - System - Remote Assistance - Configure Offer Remote Assistance

Return to Contents page