Granting and revoking
Administrative permissions are granted on the Administrative Permissions tab when adding or editing a user or user group. Permissions can be either:- Inherited from a user group — automatic; revoke by removing the user from the group.
- Granted directly to the user — independent of group membership.
If an Active Directory user is added as an independent internal user and as a member of a Windows domain user group, the user’s own permissions take priority over the domain-group-inherited ones.
The seven permissions
Management Tool Access
Allows the user to open and use the Management Tool. This permission is a prerequisite for every permission below — without Management Tool Access, the other administrative permissions don’t take effect.Client Installation and Management
Grants a wide set of operational capabilities:- Install Clients and manage them.
- Manage Client groups.
- Manage alerts.
- Define Global Alert Settings.
- Create and manage Scheduled Report rules.
- View the list of generated reports.
- Define Email Sending Settings.
- Create and manage USB monitoring & blocking rules.
- Block users.
This permission is also required for a user to assign or unassign licenses to/from Clients — even if they have the License Management permission.
Database Management
Allows the user to:- Access information about the database.
- Perform database cleanup operations.
- Delete Clients from the database.
License Management
Allows the user to assign licenses to Clients and unassign them.Privileged Accounts Management
Allows the user to:- Access the Account Discovery page and use the feature.
- Configure Syteca Web Connection Manager.
Tenant Management and System Configuration
Only available for users in the built-in default tenant. Allows the user to:- Manage tenants and grant or ungrant licenses to them.
- Define the system configuration.
- Activate and deactivate serial keys.
- View the System State tab on the System Health page.
- Download the Application Server and Management Tool log files.
User Management
Allows the user to:- Manage users and user groups and define their permissions.
- View the Audit log.
Viewing Archived Data
Allows the user to view and export sessions from archived databases.Viewing Monitoring Results
Allows the user to:- Open Client sessions — including archived sessions — to view recorded screen captures and metadata.
- Generate dashboards.
- Generate reports.
This is the canonical separation-of-duties permission. Granted alone (without Client Installation and Management), it lets an investigator review activity without being able to change the deployment — useful for restricting system administrators from viewing sensitive monitoring data, or vice versa.
PAM User Access
A separate permission for PAM users who don’t otherwise have Management Tool Access. Allows them to log in to the Management Tool with limited access — to the Password Management page only — so they can create and manage their own Workforce Password Management (WPM) secrets. Use this when you have many users of Syteca Connection Manager who need to manage personal WPM vaults but shouldn’t see the rest of the Management Tool.Permission combinations
Related
Users and user groups
Where permissions are actually granted — Add/Edit User and Add/Edit User Group.
Client permissions
Per-Client permission grants — narrower scope than administrative permissions.
Disable the default admin
Harden the deployment by eliminating the built-in
admin account.Multi-Tenant overview
Tenant Management and System Configuration only applies in Multi-Tenant mode.