Administrator account permissions

To set permissions for a RAS administrator, do the following:

1. In the RAS Console, navigate to Administration > Accounts.
2. Select an administrator in the list and click Tasks > Properties.

When you click the Change Permissions button in the Administrator Properties dialog, the following happens depending on what is selected in the Permissions field:

• Root administrator. The Change Permission button is disabled because the root administrator always has full permissions.
• Power administrator. The Account Permissions dialog opens. In the left pane, select one or more sites for which to grant permissions to the administrator. In the right pane, select specific permissions. See the Power administrator permissions subsection below for details.
• Custom administrator. A different Account Permissions dialog opens where you can set custom permissions. Compared to the Power administrator role (see above), this option allows you to grant any permission (view, modify, add, etc.) for entire categories or specific areas or objects in the RAS Console. If a Custom administrator doesn't have permissions to even view a category or tab page, they will not even appear in the RAS Console. Using the Custom administrator role, you can limit permissions to one or more very specific tasks. For details, see Custom administrator permissions below.

Power administrator permissions

The following permissions can be set for a Power administrator:

• Allow viewing of site information. Whether the administrator can view the Site information.
• Allow site changes. Permissions to modify the following categories: Site, Load Balancing, Universal Printing, Universal Scanning. This option is disabled if the Allow viewing of Site information option is cleared.
• Allow session management. Permission to manage running sessions. This option is disabled if the Allow viewing of site information option is cleared.
• Allow publishing changes. Permission to modify the Publishing category.
• Allow connection changes. Permission to modify the Connection category.
• Allow viewing of RAS reporting. Permission to view reports generated by RAS Reporting.
• Allow client management changes. Permission to modify the Device Manager category.

In the Global permission area, set the following:

• Allow viewing of policies. Whether to allow the administrator to view the Policies category.
• Allow policies changes. Whether to allow the administrator to modify the Policies category.

Custom administrator permissions

To set custom administrator permissions, you must be either a root administrator or a power administrator with the "Allow site changes" permission granted.

When you first create an administrator of this type, they will have no permissions. To add permissions, select a Site in the left pane and then click the Change permissions button. The Account Permissions dialog opens. In the dialog, select a permission type in the left pane.

The permission types are:

• RD Session Hosts. The RD Session hosts tab in Farm > RD Session hosts.
• RD Session hosts groups. The Groups tab in Farm > RD Session hosts.
• Remote PCs. The Farm > Remote PCs view.
• Gateways. The Farm > Gateways view.
• Publishing Agents. The Farm > Publishing Agents view.
• HALB. The Farm > HALB view.
• Themes. The Farm > Themes view.
• Publishing. The entire Publishing category.
• Connection. The entire Connection category.
• Device manager. The entire Device manager category.
• Certificates. The Farm > Site > Certificates subcategory.

After you select a permission type, you can set the actual permissions in the right pane. Different permission types may have different sets of permissions. The following list describes all available permissions:

• View. View only.
• Modify. View and modify.
• Add. View, modify, and add new objects (e.g. servers).
• Delete. View, modify, and delete an object.
• Control. View and control an object. This permission enables the Tasks > Control menu (where available), which includes enable and disable logons, cancel pending reboot, install RDS role, reboot, and some other options. Also enables power operations (start, stop, etc., where available).
• Manage sessions. View and manage sessions.

The lower portion of the right pane lists individual objects (e.g. servers) if the selected permission type has them. Here, you can set individual permissions for a specific object (not the entire tab, for instance, which otherwise would include all available objects).

The Global permissions options at the top of the right pane enables all permissions for all objects for the selected permission type.

Clone permissions

As a root administrator (or a power administrator with sufficient privileges), you can apply (clone) permissions of an existing administrator account to another existing account. This way, you can configure permissions for one account and then quickly apply the same configuration to all other accounts that require them.

To clone permissions, select a source administrator account and click Tasks > Clone permissions. In the dialog that opens, select a destination account (or multiple accounts) and click OK.

Delegate permissions

There could be a situation when a power administrator needs to grant some permissions to a custom administrator. This cannot be done by modifying permissions because power administrators cannot manage administrator accounts directly. Instead, they can delegate some of their own permissions in a given Site to a custom administrator of their choice.

For example, if a power administrator wants the custom administrator to be able to manage a particular RD Session Host, he/she selects that host in the RAS Console and click Tasks > Delegate permissions. This opens a dialog where the administrator can select a custom administrator and specify which permissions (view, modify, etc.) that administrator should have. The Tasks > Delegate permissions menu option is available for many objects, such as RD Session Hosts, VDI providers, guest VMs (desktops), and some others. If the menu is not available for an object, it means that this functionality is not available for objects of this type.