Administrator account permissions

To set permissions for a RAS administrator, do the following:

1. In the RAS Console, navigate to Administration > Accounts.

2. Select an administrator in the list and click Tasks > Properties.

3. Click the Change Permissions button in the Administrator Properties dialog. The following happens depending on what is selected in the Permissions field:

   • Root administrator. The Change Permission button is disabled because the root administrator always has full permissions.

   • Power administrator. The Account Permissions dialog opens. In the left pane, select one or more sites for which to grant permissions to the administrator. In the right pane, select specific permissions. See the Power administrator permissions subsection below for details.

   • Custom administrator. A different Account Permissions dialog opens where you can set custom permissions. Compared to the Power administrator role (see above), this option allows you to grant any permission (view, modify, add, etc.) for entire categories or specific areas or objects in the RAS Console. If a Custom administrator doesn't have permissions to even view a category or tab page, they will not even appear in the RAS Console. Using the Custom administrator role, you can limit permissions to one or more very specific tasks. For details, see Custom administrator permissions below.

Power administrator permissions

The following permissions can be set for a Power administrator:

• Allow viewing of site information. Whether the administrator can view the Site information.

• Allow site changes. Permissions to modify the following categories: Site, Load Balancing, Universal Printing, Universal Scanning. This option is disabled if the Allow viewing of Site information option is cleared.

• Allow session management. Permission to manage running sessions. This option is disabled if the Allow viewing of site information option is cleared.

• Allow publishing changes. Permission to modify the Publishing category.

• Allow connection changes. Permission to modify the Connection category.

• Allow viewing of RAS reporting. Permission to view reports generated by RAS Reporting.

• Allow client management changes. Permission to modify the Device Manager category.

In the Global permission area, set the following:

• Allow viewing of policies. Whether to allow the administrator to view the Policies category.

• Allow policies changes. Whether to allow the administrator to modify the Policies category.

Custom administrator permissions

To set custom administrator permissions, you must be either a root administrator or a power administrator with the "Allow site changes" permission granted.

When you first create an administrator of this type, they will have no permissions. To add permissions, select a Site in the left pane and then click the Change permissions button. The Account Permissions dialog opens. In the dialog, select a permission type in the left pane.

The permission types are:

• RD Session hosts groups. The Groups tab in Farm > RD Session hosts.

Note: Starting from Parallels RAS 19, per-server RDSH permissions have been deprecated and must be manually replaced with per-group permissions. If you upgrade to Parallels RAS 19 or later from one of the previous versions, during the upgrade you will see a dialog that helps you with the process.

• Manage Sessions by AD Groups. Permission for managing user sessions for users that belong to the same AD group as the custom administrator.

Note: Parallels RAS checks all available AD groups to find the ones that include the custom administrator. If you don't want to check certain AD groups, you can exclude them from the search by clicking the Exclude AD groups button in the bottom-left corner of the Account Permissions window.

• Remote PCs. The Farm > Remote PCs view.

• Secure Gateways. The Farm > Secure Gateways view.

• Connection Brokers. The Farm > Connection Brokers.

• HALB. The Farm > HALB view.

• Themes. The Farm > Themes view.

• Publishing. Permissions for individual folders in the Publishing category.

• Connection. The entire Connection category.

• Device Manager. The entire Device manager category.

• Certificates. The Farm > Certificates view.

• Application Packages. The Farm > Application Packages view.

To change global permissions, instead of a specific Site select Global in the left pane and then click the Change permissions button.

The global permission types are:

• Monitoring. The Monitoring category.

• Reporting. The Reporting category.

• License. The License category.

After you select a permission type, you can set the actual permissions in the right pane. Different permission types may have different sets of permissions. The following list describes all available permissions:

• View. View only.

• Modify. View and modify.

• Add. View, modify, and add new objects (e.g. servers).

• Delete. View, modify, and delete an object.

• Control. View and control an object. This permission enables the Tasks > Control menu (where available), which includes enable and disable logons, cancel pending reboot, install RDS role, reboot, and some other options. Also enables power operations (start, stop, etc., where available).

• Manage sessions. View and manage sessions.

The lower portion of the right pane lists individual objects (e.g. servers) if the selected permission type has them. Here, you can set individual permissions for a specific object (not the entire tab, for instance, which otherwise would include all available objects).

The Global permissions options at the top of the right pane enables all permissions for all objects for the selected permission type.

Clone permissions

As a root administrator (or a power administrator with sufficient privileges), you can apply (clone) permissions of an existing administrator account to another existing account. This way, you can configure permissions for one account and then quickly apply the same configuration to all other accounts that require them.

To clone permissions, select a source administrator account and click Tasks > Clone permissions. In the dialog that opens, select a destination account (or multiple accounts) and click OK.

Delegate permissions

There could be a situation when a power administrator needs to grant some permissions to a custom administrator. This cannot be done by modifying permissions because power administrators cannot manage administrator accounts directly. Instead, they can delegate some of their own permissions in a given Site to a custom administrator of their choice.

For example, if a power administrator wants the custom administrator to be able to manage a particular RD Session Host, he/she selects that host in the RAS Console and click Tasks > Delegate permissions. This opens a dialog where the administrator can select a custom administrator and specify which permissions (view, modify, etc.) that administrator should have. The Tasks > Delegate permissions menu option is available for many objects, such as Providers, host pools (desktops), and some others. If the menu is not available for an object, it means that this functionality is not available for objects of this type.