security question

[bikerjohn]

I have an HR security group. I want this group to be able to create new
users and resources. If possible, they should be able to assign the new
users to a security group. For example, if we hire a new guy who is a pm, I
would like the HR person to be able to create the new user and add him to the
PM group. However, I really don't want to give the HR people the ability to
promote themselves to the admin group. Is there a way to do this. I noticed
there is a manage users / groups permission and a manage security permission.

 

[Andrew Lavinsky]

Unfortunately I don't think you can get that granular. If you can manage
groups, then you have the keys to the kingdom.

The manage security permission applies to security categories, which is a
slightly different beast.

You might be better off using AD synchronization. That way, new resources
can get added to AD groups and synch'd into the server - which might be under
HR control or guidance.

There's some challenges with that approach as well, but it might be closer
to what you need.

-A

 

[bikerjohn]

thanks for the explaination