Configuring User Policies

1. Click the Discovery > Domains > Domain Watch > Policies > Users tab.
   • Discovery user policies enable users to logon to the VSA or to Portal Access using their domain credentials.
   • Each domain credential can be applied to only one of two kinds of VSA logons:
     • VSA user logons - These logons are used by VSA administrators.
     • Portal Access logons - These logons are used by machine users who want to access their own machines remotely.
   • User groups are simply called "groups" in an Active Directory domain. Each group in this tab is identified by its canonical name. A canonical name provides the complete hierarchy of OUs/containers used to locate folders and items—such as computers, contacts or groups—in a domain, similar in format to the full path name of a file in a disk directory.
   • An additional column shows a count for the number of users in each group.
2. Select a user.
3. Select the Configure Users Policy button.
   • The Users Policy dialog displays.
4. Select a Member User Policy.
   • Each domain user in Discovery can be assigned one of three different VSA logon policies.
     • Do Not Include Users - Do not create VSA user logons or Portal Access logons for domain users listed in this user group.
     • Create Staff Members - Creates a staff member record. These users can be assigned Portal Access to a machine manually.

       Note: The user can only be manually assigned the Portal Access user of a machine—using the Users & Portal Users page—if the user was the last user logged on to that machine. The list of eligible machines are listed in the Last Logged-onto Machines field in the lower panel of this same page.

     • Create Staff and make Auto Portal Candidates - Designates domain users in this user group as Portal Access candidates. See Making Portal Access Candidates for details.
     • Create VSA Users - Creates VSA user logons for domain users listed in this user group.
5. If Create VSA Users is selected:
   • Role Lookup - Select the role these users will use.
   • Scope Lookup - Select the scope these users will use.
   • If a scope with the same name as the organization does not already exist, a displays to the right of the Scope Lookup drop-down list of the User Policy dialog. Clicking the icon enables you to create a new scope that has the same name as the organization associated with the domain. Once the scope is created the no longer displays to the right of the Scope Lookup drop-down list and text at the top of the dialog indicates the default scope already exists.
   • If the same user is assigned to multiple groups, and different roles and scopes are assigned to each group, then when the user logs on to the VSA, these roles and scopes will be available in the roles/scope selector in the upper-right corner of the VSA window.

   Note: Roles/scope assignments using the Groups tab and Users tab can be modified and reapplied multiple times. Successive changes will cause roles and scopes to accumulate, rather than be replaced. Discovery never removes records in the VSA.

6. Click Save to close this dialog.
   • The dialog closes and the policy you selected displays in the Users Policy column.
7. If you have already defined policies for other tabs, click the Apply Changes button.

   Note: You do not need to Apply Changes until all Policies tabs have been configured. Clicking the Apply Changes button on any tab applies Discovery policy changes for all tabs at the same time.

   Note: See Supported Domain Logon Formats.