Delegating Session Management Permissions

If your organization has multiple user groups, all sharing centralized Parallels RAS resources, you have the ability to delegate session management permissions to an administrator of a particular group. When you do, the administrator can see and manage Parallels RAS sessions only for users who belong to that group.

Here's how this functionality works:

1. A separate Theme is created for each group. Session management permissions for the Theme are delegated to a custom administrator (see Managing Administrator Accounts).
2. When a custom administrator logs in to the Parallels RAS Console, they are presented with a limited user interface displaying sessions that belong to the Theme (or multiple Themes) that the administrator is allowed to manage.

The rest of this section describes how to configure and use this functionality.

Create a Theme and delegate session management permissions

If you don't have a Theme for a user group, you need to create it. Follow the instructions provided earlier in this chapter. To delegate session management permissions, you specifically need to do the following:

1. When specifying settings on the General page, select the Limit access to this Theme to members of these Active Directory groups option and add one or more groups.
2. After creating or configuring the Theme, close the Theme Properties dialog, then right-click anywhere in the list and choose Delegate Permissions.
3. If you already have a custom administrator account that you would like to use, it will appear in the list. If you don't have an account, create one as follows:
   1. Click Tasks > Add.
   2. In the Account Properties dialog, click the [...] button next to Name and select an account.
   3. The Permissions field is read-only and set to Custom administrator (the type that must be used here).
   4. Populate the rest of the fields (email, mobile, etc.) as needed.
   5. Click OK.
4. Back in the Delegate Permission dialog, select the administrator in the left pane.
5. In the lower portion of the right pane, select permissions (view, modify, manage sessions) for the desired Theme. You can also set permissions in the upper portion of the right pane, but they will apply to all existing Themes, and this is probably not what we are trying to do here.
6. Click OK.

Manage sessions

Once the above is complete, the custom administrator can manage sessions that belong to the specified Theme(s). To manage sessions:

1. Run the Parallels RAS Console and log in using the credentials of a custom administrator.
2. The right pane will contain sessions that belong to the members of the group(s) assigned to the Theme.
3. To manage a session, select it, then click the Tasks drop-down menu and choose a desired option (Disconnect, Log off, Send message, etc.).

Settings audit

Any changes to administrator permissions are recorded in the settings audit. Possible actions are create, update, and delete. You can view the changes by going to Administration / Settings Audit or Farm / Themes / Settings Audit.

Using Themes in Parallels Client for Windows

In order for a user to use a corresponding Theme, the connection properties must be properly set. To do so:

1. In Parallels Client for Windows, right-click a connection and choose Connection Properties.
2. On the Connection tab, the server name must be followed by the Theme name after a forward slash, as in Server-name/Theme-name.

When the administrator views sessions in the RAS Console, a client using a Theme can be identified by the Theme name in the Theme column. At the time of this writing, this only works with Windows clients.