Right Click Tools Roles

When the Right Click Tools console extension is connected to a Recast Management Server, you can set up role-based permissions that give users or user groups access to specific actions.

Assign a Right Click Tools Role

You can grant an Active Directory user or user group Recast permissions by assigning a specific role, such as an Administrator role. Right Click Tools Enterprise must be connected to a Recast Management Server to set up role-based permissions.

ROLE NOTES:

  • When a user is assigned multiple roles, their permissions for each role are aggregated
  • A user's role is also constrained by any user or group limiting rules that are applied

Add an Active Directory User or User Group in RMS

To add an AD user or user group:

1. In your Recast Management Server, navigate to Administration > Permissions.

2. In the Recast Users section, click Add User or Add Group.

3. In the window that opens, search for your AD name or AD user group and click the Add button.

NOTES:
  • Search is limited to the users or groups in the same domain as your Recast Management Server.
  • Search looks to match the user logon name (SamAccountName) not the display name.

Use a wildcard (*) to facilitate your search

Wildcard examples:

John Connor returns strings that match exactly

John C*  returns strings beginning with 'John C', such as 'John Connor', 'John Connors', and 'John Cranston'

*Connor returns strings ending with 'Connor', such as 'John Connor' and 'Carol O'Connor'

*Support* returns strings that include 'Support' plus whatever is on the left and right, such as 'Customer Support Team' and 'Enterprise Support Group'

Assign a User or Group a Role

Each user or user group must be assigned at least one role.

To assign a user a role:

1. On the Permissions page, click the Edit icon to the right of the user or group.

2. In the Role Assignments window that opens, under Roles, select a role to assign to the user/group.

To learn about the individual permissions granted by a role, see View or Edit User Role Permissions.

3. Under Assigned Roles, enable Limit this user to specific objects and select a Service Connection to add a limiting rule that restricts user permissions to a set of devices (optional). To learn more, see Limiting Rules.

4. Click Save.

NOTE: Beginning with Recast Software Version 5.9.2502.2105, you no longer have to set a Refresh Interval to repopulate your limiting rules (formerly known as scopes). The scheduled Discovery Sync will keep your service connection data up to date.




Custom Role Templates for Right Click Tools

Custom role templates offer a quick way to create permission sets for Right Click Tools users. You can find three custom role templates in your Recast Management Server and then adjust to suit by adding or removing individual permissions. 

Available custom role templates:

  • Read Only - This security role grants users read access to all of the Right Click Tools and web dashboards. This includes the Right Click Tools Insights Report Viewer role. For the complete list of permissions granted with this role, see Read-Only Analyst Role Permissions.

TIP: You can view or edit the permissions granted by a role by clicking the Permissions button.

Assign a Custom User Role

To assign a custom role to a user or user group:

1. On the RMS Permissions page, click the Edit icon to the right of a user/user group.

2. Under Role Assignments, select Read Only, Remote Software Center, or Content Distribution Monitor Dashboard.

3. Under Assigned Roles, enable Limit this user to specific objects and select a Service Connection to add a limiting rule that restricts user permissions to a set of devices (optional). To learn more, see Limiting Rules.

4. Click Save.




Read-Only Analyst Role Permissions

Read-only access lets users view Right Click Tools actions, console dashboards, web dashboards and trends, and the audit log, without the ability to make changes to any devices. Users given this role will not see permissions, routes, or limiting rules in the Recast Management Server interface. 

You can assign users a RCT Read Only Analyst role on the RMS Permissions page. Click the Permissions button to the right of the role to view or change individual permissions granted by the role.

Read-Only Role Permission List

Active Directory Active Directory Cleanup Tool
Get AD Computer
Get AD Computer With LAPS Data
Get AD Computers
Get AD Computers BitLocker Status
Get AD Computers In Group
Get AD Containers
Get AD Group
Get AD Groups
Get AD Groups In Group
Get AD OUs
Get AD User
Get AD Users
Get AD Users In Group
Get Account Group Membership
Get BitLocker Recovery Data
Get Group Members
Get Primary Group For Account
Is Account Enabled
Search AD Computers
Search AD Groups
Search AD Users


AdministrationGet All Settings
Get Action Execution Group
Get Active Directory Service Connection
Get Execution History
Get Execution History For Job ID
Get MEMCM Service Connection


BitLockerGet BitLocker Status
Get Recovery Password From Device


ConfigMgr Client Get Configuration Baselines
Get Deployed Programs
Get Deployed Task Sequences
Get Device ID
Get Service Windows
Get User Policy Endpoint
Missing Software Updates
Package Information


ConfigMgr Server






Get Accounts
Get Active Alerts
Get Active Directory Forests
Get Administrative Users
Get Alert Subscriptions
Get All Alerts
Get All Collections
Get All Content Status
Get All Deployment Types
Get All Device Collections
Get All Devices
Get All Devices In OU
Get All Distributed Content
Get All Software Updates
Get All User Collections
Get All Users
Get Application By Model ID
Get Application Revisions
Get Applications
Get Applications Deployed To Users
Get Approval Requests
Get Asset Intelligence Catalog
Get Asset Intelligence Hardware Requirements
Get Asset Intelligence Inventoried Software
Get Automatic Deployment Rules
Get Baseboard Information
Get Boot Images
Get Boundaries
Get Boundary Groups
Get Category Instance By ID
Get Certificates
Get Chassis Information
Get Client Operations
Get Client Settings
Get Collection Folder Information
Get Collection Variables for Device
Get Collections for Device
Get Collections for User
Get Compliant Update Statuses
Get Component Status
Get Computer System Information
Get Computer System Product Information
Get Computer Warranty
Get Computers With X64 Laps Client
Get Computers With X86 Laps Client
Get Computers Without Laps Client
Get Configuration Baselines
Get Configuration Items
Get Conflicting Records
Get Content Status
Get DP Group Task Sequence Content
Get DP Groups With Members
Get Deployed Applications For User
Get Deployment Packages
Get Deployment Types For Application
Get Deployments
Get Device Collection Folders
Get Device Collection Information for Device
Get Device Collection Members
Get Device Collections in Folder
Get Device Count For Licensing
Get Devices By Creation Date
Get Devices By MAC Address
Get Devices By Sm Bios Guid
Get Devices In Collection Scope
Get Devices In Site Scope
Get Discovery Methods
Get Distributed Software Updates
Get Distribution Point Configuration Status
Get Distribution Point Content
Get Distribution Point Group Status
Get Distribution Point Group Status for Package
Get Distribution Point Groups
Get Distribution Point Status for Package
Get Distribution Points
Get Distribution Points In Distribution Point Group
Get Driver Packages
Get Drivers
Get Endpoint Protection Antimalware Policies
Get Endpoint Protection Firewall Policies
Get Failed Content On Distribution Point
Get Global Conditions
Get Installed Software Updates
Get Machines With Cm Blm Keys
Get Malware Detected
Get Migration Jobs
Get Non Compliant Update Statuses
Get Object Container Items
Get Operating System Images
Get Packages
Get Power Configurations for Computer
Get Queries
Get Required Software Updates
Get Scope Memberships
Get Security Roles
Get Security Scopes
Get Servers and Site System Roles
Get Service Windows for Computer
Get Site Device Collections With Folders
Get Site Status
Get Sites
Get Software Metering Rules
Get Software Update Groups
Get Software Updates In Group
Get Status Message Queries
Get System Bios Information
Get System Console Usage Data
Get System Firmware Status
Get System Operating System Information
Get Systems BitLocker Encryption Status
Get Task Sequence Content
Get Task Sequences
Get Unknown Devices
Get User Collection Folders
Get User Collections in Folder
Get User Devices
Get User Devices By Username
Get User State Migrations
Get Virtual Hard Disks
Get Warranty Information


Endpoint InsightsOpen Recast EI Report Viewer


FilesystemGet Directory Entries
Get Directory Entries
Get Security By Name


Installed SoftwareList Software


Kiosk ManagerList Profiles


Local ActionsActive Directory Cleanup Tool


MBAMGet MBAM Compliance
Get MBAM Compliance For All Machines
Get Machines With MBAM Keys
Get Machines With MBAM Keys_v2
Get Recovery Keys For Device
Get TPM Hash
Get TPM Hash For User


NetworkPing Computer


RegistryGet Value
List Hives
List Subkeys
List Values


SCEPGet Defender Exclusions

Get Defender Status


ServicesList Services


System InformationGet All Local Group Members
Get Battery Information
Get Logged In Users
Get Running Processes
Get User Sessions
Read Only


Task SchedulerGet Task Results

Get Task Results For Date


Unified Write FilterGet File Exclusions
Get Overlay Configuration
Get Registry Exclusions
Get Unified Write Filter Feature Status
Get Write Filter Status


Windows SecurityGet All Virtualization Based Security Settings
Get Credential Guard Settings
Get Secure Boot Status
Get System Guard Secure Launch Settings
Get TPM Status
Get UEFI Secure Boot Status
Get Virtualization Based Security Settings
Get Windows Firewall Profiles
Get Windows Firewall Rules


Windows Task SchedulerList Tasks


WMIRead Only




Remote Software Center Role Permissions

You can assign users a RCT Remote Software Center role on the RMS Permissions page. Click the Permissions button to the right of the role to view or change individual permissions granted by the role.

Remote Software Center Role Permission List

Active Directory Get Account Group Membership


AdministrationGet All Settings


ConfigMgr Client 


Deployed Applications
Get Configuration Baselines
Get Deployed Programs
Get Deployed Task Sequences
Get User Policy Endpoint
Install Application
Install Application Or Program
Install Program
Install Software Updates
Install Software Updates By ID
Install User Application
Missing Software Updates
Package Information
Task Sequence Information
Uninstall Application


ConfigMgr ServerGet Comanaged Workloads
Get Deployed Applications For User
Get Applications Deployed To Users


Installed SoftwareList Software

Uninstall Software


NetworkPing Computer


System InformationGet Logged In Users


WMIRead Only
Invoke Method




Content Distribution Monitor Dashboard Role Permissions

You can assign users a RCT Content Distribution Monitor Dashboard role on the RMS Permissions page. Click the Permissions button to the right of the role to view or change individual permissions granted by the role.

Content Distribution Monitor Dashboard Role Permission List

Active Directory Get Group Members


AdministrationSet Role Permissions

Create Action Execution Group

List Memcm Service Connections

Get Enrollment Settings


BitLockerSuspend BitLocker Volume


ConfigMgr ClientTask Sequence Information


ConfigMgr ServerGet All Distributed Content
Get Manufacturer Counts


System InformationGet Logged In Users

Send Recast Toast Notification

Shutdown Computer


Task SchedulerSchedule Task Monthly By Occurrence