You can grant an Active Directory user or user group Recast permissions by assigning a specific role, such as an Administrator role. Right Click Tools Enterprise must be connected to a Recast Management Server to set up role-based permissions.
ROLE NOTES:
- When a user is assigned multiple roles, their permissions for each role are aggregated
- A user's role is also constrained by any user or group limiting rules that are applied
Add an Active Directory User or User Group in RMS
To add an AD user or user group:
1. In your Recast Management Server, navigate to Administration > Permissions.
2. In the Recast Users section, click Add User or Add Group.

3. In the window that opens, search for your AD name or AD user group and click the Add button.
- Search is limited to the users or groups in the same domain as your Recast Management Server.
- Search looks to match the user logon name (SamAccountName) not the display name.
Use a wildcard (*) to facilitate your search
Wildcard examples:John Connor returns strings that match exactly
John C* returns strings beginning with 'John C', such as 'John Connor', 'John Connors', and 'John Cranston'
*Connor returns strings ending with 'Connor', such as 'John Connor' and 'Carol O'Connor'
*Support* returns strings that include 'Support' plus whatever is on the left and right, such as 'Customer Support Team' and 'Enterprise Support Group'
Assign a User or Group a Role
Each user or user group must be assigned at least one role.
To assign a user a role:
1. On the Permissions page, click the Edit icon to the right of the user or group.

2. In the Role Assignments window that opens, under Roles, select a role to assign to the user/group.
To learn about the individual permissions granted by a role, see View or Edit User Role Permissions.
3. Under Assigned Roles, enable Limit this user to specific objects and select a Service Connection to add a limiting rule that restricts user permissions to a set of devices (optional). To learn more, see Limiting Rules.

4. Click Save.
NOTE: Beginning with Recast Software Version 5.9.2502.2105, you no longer have to set a Refresh Interval to repopulate your limiting rules (formerly known as scopes). The scheduled Discovery Sync will keep your service connection data up to date.
Custom role templates offer a quick way to create permission sets for Right Click Tools users. You can find three custom role templates in your Recast Management Server and then adjust to suit by adding or removing individual permissions.
Available custom role templates:
- Read Only - This security role grants users read access to all of the Right Click Tools and web dashboards. This includes the Right Click Tools Insights Report Viewer role. For the complete list of permissions granted with this role, see Read-Only Analyst Role Permissions.
- Remote Software Center - This security role grants users access to all the actions within the Right Click Tools Remote Software Center. For the complete list of permissions granted with this role, see Remote Software Center Role Permissions.
- Content Distribution Monitor Dashboard - This security role grants users access to all the actions within the Right Click Tools Content Distribution Monitor (for Configuration Manager). For the complete list of permissions granted with this role, see Content Distribution Monitor Dashboard Role Permissions.
TIP: You can view or edit the permissions granted by a role by clicking the Permissions button.
Assign a Custom User Role
To assign a custom role to a user or user group:
1. On the RMS Permissions page, click the Edit icon to the right of a user/user group.
2. Under Role Assignments, select Read Only, Remote Software Center, or Content Distribution Monitor Dashboard.
3. Under Assigned Roles, enable Limit this user to specific objects and select a Service Connection to add a limiting rule that restricts user permissions to a set of devices (optional). To learn more, see Limiting Rules.
4. Click Save.
Read-only access lets users view Right Click Tools actions, console dashboards, web dashboards and trends, and the audit log, without the ability to make changes to any devices. Users given this role will not see permissions, routes, or limiting rules in the Recast Management Server interface.
You can assign users a RCT Read Only Analyst role on the RMS Permissions page. Click the Permissions button to the right of the role to view or change individual permissions granted by the role.
Read-Only Role Permission List
| Active Directory | Active Directory Cleanup Tool |
| Get AD Computer | |
| Get AD Computer With LAPS Data | |
| Get AD Computers | |
| Get AD Computers BitLocker Status | |
| Get AD Computers In Group | |
| Get AD Containers | |
| Get AD Group | |
| Get AD Groups | |
| Get AD Groups In Group | |
| Get AD OUs | |
| Get AD User | |
| Get AD Users | |
| Get AD Users In Group | |
| Get Account Group Membership | |
| Get BitLocker Recovery Data | |
| Get Group Members | |
| Get Primary Group For Account | |
| Is Account Enabled | |
| Search AD Computers | |
| Search AD Groups | |
| Search AD Users | |
| Administration | Get All Settings |
| Get Action Execution Group | |
| Get Active Directory Service Connection | |
| Get Execution History | |
| Get Execution History For Job ID | |
| Get MEMCM Service Connection | |
| BitLocker | Get BitLocker Status |
| Get Recovery Password From Device | |
| ConfigMgr Client | Get Configuration Baselines |
| Get Deployed Programs | |
| Get Deployed Task Sequences | |
| Get Device ID | |
| Get Service Windows | |
| Get User Policy Endpoint | |
| Missing Software Updates | |
| Package Information | |
| ConfigMgr Server | Get Accounts |
| Get Active Alerts | |
| Get Active Directory Forests | |
| Get Administrative Users | |
| Get Alert Subscriptions | |
| Get All Alerts | |
| Get All Collections | |
| Get All Content Status | |
| Get All Deployment Types | |
| Get All Device Collections | |
| Get All Devices | |
| Get All Devices In OU | |
| Get All Distributed Content | |
| Get All Software Updates | |
| Get All User Collections | |
| Get All Users | |
| Get Application By Model ID | |
| Get Application Revisions | |
| Get Applications | |
| Get Applications Deployed To Users | |
| Get Approval Requests | |
| Get Asset Intelligence Catalog | |
| Get Asset Intelligence Hardware Requirements | |
| Get Asset Intelligence Inventoried Software | |
| Get Automatic Deployment Rules | |
| Get Baseboard Information | |
| Get Boot Images | |
| Get Boundaries | |
| Get Boundary Groups | |
| Get Category Instance By ID | |
| Get Certificates | |
| Get Chassis Information | |
| Get Client Operations | |
| Get Client Settings | |
| Get Collection Folder Information | |
| Get Collection Variables for Device | |
| Get Collections for Device | |
| Get Collections for User | |
| Get Compliant Update Statuses | |
| Get Component Status | |
| Get Computer System Information | |
| Get Computer System Product Information | |
| Get Computer Warranty | |
| Get Computers With X64 Laps Client | |
| Get Computers With X86 Laps Client | |
| Get Computers Without Laps Client | |
| Get Configuration Baselines | |
| Get Configuration Items | |
| Get Conflicting Records | |
| Get Content Status | |
| Get DP Group Task Sequence Content | |
| Get DP Groups With Members | |
| Get Deployed Applications For User | |
| Get Deployment Packages | |
| Get Deployment Types For Application | |
| Get Deployments | |
| Get Device Collection Folders | |
| Get Device Collection Information for Device | |
| Get Device Collection Members | |
| Get Device Collections in Folder | |
| Get Device Count For Licensing | |
| Get Devices By Creation Date | |
| Get Devices By MAC Address | |
| Get Devices By Sm Bios Guid | |
| Get Devices In Collection Scope | |
| Get Devices In Site Scope | |
| Get Discovery Methods | |
| Get Distributed Software Updates | |
| Get Distribution Point Configuration Status | |
| Get Distribution Point Content | |
| Get Distribution Point Group Status | |
| Get Distribution Point Group Status for Package | |
| Get Distribution Point Groups | |
| Get Distribution Point Status for Package | |
| Get Distribution Points | |
| Get Distribution Points In Distribution Point Group | |
| Get Driver Packages | |
| Get Drivers | |
| Get Endpoint Protection Antimalware Policies | |
| Get Endpoint Protection Firewall Policies | |
| Get Failed Content On Distribution Point | |
| Get Global Conditions | |
| Get Installed Software Updates | |
| Get Machines With Cm Blm Keys | |
| Get Malware Detected | |
| Get Migration Jobs | |
| Get Non Compliant Update Statuses | |
| Get Object Container Items | |
| Get Operating System Images | |
| Get Packages | |
| Get Power Configurations for Computer | |
| Get Queries | |
| Get Required Software Updates | |
| Get Scope Memberships | |
| Get Security Roles | |
| Get Security Scopes | |
| Get Servers and Site System Roles | |
| Get Service Windows for Computer | |
| Get Site Device Collections With Folders | |
| Get Site Status | |
| Get Sites | |
| Get Software Metering Rules | |
| Get Software Update Groups | |
| Get Software Updates In Group | |
| Get Status Message Queries | |
| Get System Bios Information | |
| Get System Console Usage Data | |
| Get System Firmware Status | |
| Get System Operating System Information | |
| Get Systems BitLocker Encryption Status | |
| Get Task Sequence Content | |
| Get Task Sequences | |
| Get Unknown Devices | |
| Get User Collection Folders | |
| Get User Collections in Folder | |
| Get User Devices | |
| Get User Devices By Username | |
| Get User State Migrations | |
| Get Virtual Hard Disks | |
| Get Warranty Information | |
| Endpoint Insights | Open Recast EI Report Viewer |
| Filesystem | Get Directory Entries |
| Get Directory Entries | |
| Get Security By Name | |
| Installed Software | List Software |
| Kiosk Manager | List Profiles |
| Local Actions | Active Directory Cleanup Tool |
| MBAM | Get MBAM Compliance |
| Get MBAM Compliance For All Machines | |
| Get Machines With MBAM Keys | |
| Get Machines With MBAM Keys_v2 | |
| Get Recovery Keys For Device | |
| Get TPM Hash | |
| Get TPM Hash For User | |
| Network | Ping Computer |
| Registry | Get Value |
| List Hives | |
| List Subkeys | |
| List Values | |
| SCEP | Get Defender Exclusions |
| Get Defender Status | |
| Services | List Services |
| System Information | Get All Local Group Members |
| Get Battery Information | |
| Get Logged In Users | |
| Get Running Processes | |
| Get User Sessions | |
| Read Only | |
| Task Scheduler | Get Task Results |
| Get Task Results For Date | |
| Unified Write Filter | Get File Exclusions |
| Get Overlay Configuration | |
| Get Registry Exclusions | |
| Get Unified Write Filter Feature Status | |
| Get Write Filter Status | |
| Windows Security | Get All Virtualization Based Security Settings |
| Get Credential Guard Settings | |
| Get Secure Boot Status | |
| Get System Guard Secure Launch Settings | |
| Get TPM Status | |
| Get UEFI Secure Boot Status | |
| Get Virtualization Based Security Settings | |
| Get Windows Firewall Profiles | |
| Get Windows Firewall Rules | |
| Windows Task Scheduler | List Tasks |
| WMI | Read Only |
You can assign users a RCT Remote Software Center role on the RMS Permissions page. Click the Permissions button to the right of the role to view or change individual permissions granted by the role.
Remote Software Center Role Permission List
| Active Directory | Get Account Group Membership |
| Administration | Get All Settings |
| ConfigMgr Client | Deployed Applications |
| Get Configuration Baselines | |
| Get Deployed Programs | |
| Get Deployed Task Sequences | |
| Get User Policy Endpoint | |
| Install Application | |
| Install Application Or Program | |
| Install Program | |
| Install Software Updates | |
| Install Software Updates By ID | |
| Install User Application | |
| Missing Software Updates | |
| Package Information | |
| Task Sequence Information | |
| Uninstall Application | |
| ConfigMgr Server | Get Comanaged Workloads |
| Get Deployed Applications For User | |
| Get Applications Deployed To Users | |
| Installed Software | List Software |
| Uninstall Software | |
| Network | Ping Computer |
| System Information | Get Logged In Users |
| WMI | Read Only |
| Invoke Method |
You can assign users a RCT Content Distribution Monitor Dashboard role on the RMS Permissions page. Click the Permissions button to the right of the role to view or change individual permissions granted by the role.
Content Distribution Monitor Dashboard Role Permission List
| Active Directory | Get Group Members |
| Administration | Set Role Permissions |
| Create Action Execution Group | |
| List Memcm Service Connections | |
| Get Enrollment Settings | |
| BitLocker | Suspend BitLocker Volume |
| ConfigMgr Client | Task Sequence Information |
| ConfigMgr Server | Get All Distributed Content |
| Get Manufacturer Counts | |
| System Information | Get Logged In Users |
| Send Recast Toast Notification | |
| Shutdown Computer | |
| Task Scheduler | Schedule Task Monthly By Occurrence |