fbpx
1-888-310-4540 (main) / 1-888-707-6150 (support) info@spkaa.com
Select Page

How to lock down users on your PTC Integrity Server

Published by SPK Blog Post
on October 30, 2014

Recently I was doing some work for a customer, experimenting with allowing limited access to non-Administrator class users using the PTC Integrity Administration client. I discovered that once a standard user gained access to the PTC Integrity Administration client, there were plenty things they could potentially do that would cause an administrator all kinds of grief.

My task then was to lock down the PTC Integrity Administrator client so that if a standard user did somehow gain access to it, they wouldn’t be able to do anything to inadvertently damage the environment. The problem is that when you first install and configure the PTC Integrity server, many of the main ACLs (Access Control Lists) are set by default to allow “everyone” to have access to given portions of your server.

What I have provided below is a set of step by step instructions that can be followed to successfully lock down your PTC Integrity server by modifying a set of given ACLs. Each of these ACLs is accessed through the PTC Integrity Administration client.

1. Using the PTC Integrity Administration client, login as Administrator to the PTC Integrity server you wish to lock down.

2. Expand the permissions block, select “All” and right click on MKS and select “View ACL”

Note: Make sure you add the new principal to the system before you remove the permissions from the “everyone” group.  Failure to do this may accidentally remove your ability to administer the server altogether. 

3. This will open the ACL to edit.  From this window you can remove all the permissions from the “everyone” group (except login permissions) and add a new principal (i.e. an Administrator user or domain group) with permissions to administer the server.

Note: Make sure you add the new principal to the system before you remove the permissions from the “everyone” group.  Failure to do this may accidentally remove your ability to administer the server altogether. 

4. Similarly the ACL for Permissions -> All -> IM should be reset as follows:

Note: In place of using the “everyone” group, I’ve created a generic MKS Domain group to which every user in the system will be a member upon registration.

5. Similarly the ACL for Permissions -> All -> SI should be reset as follows:

Note: In this example I have chosen to forgo adding extra principals for SI.  On this particular server SI is not in use.

6. The next ACL to be updated is ACL Control.  As you can see below two new principals (“Administrator” and the generic user group) are first added to the ACL and granted read and update permissions. Once that is complete, read and update permissions can then be taken away from the “everyone” group.

Note: It is extremely important that this ACL is updated as described above.  Removing read and update permissions from “everyone” before you grant access to any other principal could result in you locking yourself out of your PTC Integrity server.

Conclusion

That’s pretty much all there is to it.  Implementing this procedure on your local PTC Integrity server will ensure that only those users or groups to whom you grant access to will have permission to make changes using the PTC Integrity Administration Client.

Please note that if a user or group is granted administrator access for any project or type they will be able to make changes to that project or type, including creating new fields or states.  In a future blog article I will look more closely at project based administrator permissions on your PTC Integrity server.

Next Steps:

Latest White Papers

Total Economic Impact for Atlassian Open DevOps

Total Economic Impact for Atlassian Open DevOps

Forrester's Total Economic Impact Study found that Atlassian Open DevOps could net your organization a potential ROI of 358%. Discover an overview of this Forrester research paper below and download your free copy. Forrester Research Into Atlassian Open DevOps Agile...

Related Resources

Smarter Engineering For Medical Devices

Smarter Engineering For Medical Devices

Medical devices are subject to some of the strictest design control regulations in the world. And for good reason. U.S. medical devices are governed by the Food and Drug Administration (FDA). In order to meet the high standards, teams must communicate - effectively....

SPK Accelerates Fortune 100 MedDevice Product Sale

SPK Accelerates Fortune 100 MedDevice Product Sale

Our client is Fortune 100 Medical Device manufacturer. SPKAA acts as a product cybersecurity managed service provider for their hospital products which have embedded Windows or Windows OS.   Fortune 100 MedDevice Problem For over 10 years, SPK has provided ongoing...

Windchill PTC Data Migration In Under 3 Months

Windchill PTC Data Migration In Under 3 Months

Data migration doesn’t always go to plan. Yet growing out of one system architecture and migrating to another is critical for a business to survive, thrive and grow as technology evolves.  When considering a  Windchill PTC RV&S migration in a company with over...