Administrator rights in Scout Board
Scout Board uses the same administrator records as the legacy Scout Console, but it adds its own base rights and object rights for functions that only exist in Scout Board. Go to Security & permissions > Manage administrators, select an administrator, then Rights management.
In Base rights, Menu rights and Base object rights, you can change only rights that you hold yourself — this already applied when editing an existing administrator, and Duplicate admin gives the new administrator only the rights you hold. An administrator created in the Scout Console with minimum access, and never edited since, is denied the Rules rights and the four rights for running actions described below.
Dynamic Configuration rights
Dynamic Configuration in Base rights gates any access to Configuration labels and Configuration rules. Expand it for the individual rights:
| Right | Controls |
|---|---|
| View labels | Seeing the labels list |
| Create labels / Edit labels / Delete labels | Adding and duplicating, editing, deleting labels |
| View rules | Seeing the rules list |
| Create rules / Edit rules / Delete rules | Adding, editing, deleting rules |
| Activate / deactivate rules | The Active switch in the rules list; saving the change also needs Edit rules |
| Reorder rules | Dragging rules and Send to Top / Send to Bottom; saving the new order also needs Edit rules |
To give an administrator read-only access to labels or rules, allow Dynamic Configuration and View labels (or View rules), and deny the rest. Denying Dynamic Configuration hides both pages.
Rights for running actions
Four rights control how an administrator runs Scout commands:
| Right | Where | Controls |
|---|---|---|
| Execute action on multiple devices | Base rights | Execute action on an OU, a Dynamic Device Group, or more than one selected device — even when only one device is selected in that view |
| Execute action immediately | Base object rights > Schedule action | The schedule type Now |
| Schedule action (once) | Base object rights > Schedule action | The types Once and On Next System Start |
| Schedule action (recurring) | Base object rights > Schedule action | The type Repeat every |
Running an action also needs the command right for the target action itself (for example Restart, under Execute action). Only Base object rights count for the three schedule rights — customizing an OU’s or a device’s own object rights has no effect on them.
Without Execute action on multiple devices, Execute action is greyed out for OUs, Dynamic Device Groups and multi-device selections, with the tooltip You cannot execute actions on more than one device at once. The administrator can still act on a single device from that device’s own menu.
Existing rights Scout Board now enforces
Scout Board also honours several rights that previously had no effect in Scout Board:
| Function | Right needed |
|---|---|
| Download log files (system menu) | Menu rights Menu : View -> System diagnostic and Menu : View -> System diagnostics -> Server log |
| Command History | Menu right Menu : View -> Update history |
| Go to origin, for an inherited base application | Base right Edit base application |
| Export / Import in the OU menu | Object rights Export + Export of the OU tree; Import + Import of an OU tree |
| Export devices / Import devices | Menu rights Menu : File -> Export -> Devices; Menu : File -> Import -> Devices |
| Reactivate OU filter | Menu right Devices under Menu : Options -> Advanced options |
| Import a base configuration or an advanced configuration | Rights on the import’s target, plus the right for every section in the imported file. If any section is denied, nothing is imported, and the dialog shows You do not have permission to import configurations. |
| Changing predefined commands | Administration of predefined commands — the same right that shows predefined commands in Scout Board |
| Using the eLux Command Scheduler through the REST API | Device scheduler |
| Setting INI file entries through the REST API | Advanced file entries |
If an administrator’s existing rights already deny one of these functions, Scout Board now hides or blocks it, where it previously allowed it.
An administrator can delete only the Dynamic Device Groups they created themselves, not ones created by another administrator.
A user-defined command saved in the eLux Command Scheduler needs the device password,
wherever it is saved from. In Scout Board, the Import dialog for a configuration or an OU
asks for it when the imported file contains such a command: This file contains a user-defined
command. Confirm the device password to import it. Through the REST API, the write needs a
devicePassword field; a missing or wrong password gets HTTP 403.
Upgrade
Existing administrators are granted all of the rights above, so they keep their current access after upgrading. Review and restrict them where you want narrower access, for example to set up a “now only” administrator (allow Execute action immediately, deny both Schedule action rights) or a “one device at a time” administrator (deny Execute action on multiple devices).
Scout Console
The Scout Console lists these rights too, so you can set them for an administrator who also signs in to the Console. It does not restrict its own commands or schedules with them.
For the rights common to both the Console and Scout Board, see Administrator policy.