> Users Joe, Sally and Bill
>
> Joe can access start VM1 and remote control VM1 but can not start/stop or
> remote control VM2.
>
> Sally can remote control VM1 or VM2 but has not administrative control over
> the machines (this will probably be done using remote desktop).
>
> Bill has full control of VM1 and VM2 - that is; he can start/stop and remote
> control either one.
>
> Any ideas?

> Madrona wrote:
>> Users Joe, Sally and Bill
>>
>> Joe can access start VM1 and remote control VM1 but can not start/stop or
>> remote control VM2.
>>
>> Sally can remote control VM1 or VM2 but has not administrative control
>> over the machines (this will probably be done using remote desktop).
>>
>> Bill has full control of VM1 and VM2 - that is; he can start/stop and
>> remote control either one.
>>
>> Any ideas?
>
> Have you looked at the Virtual Server Admin guide? You can use NTFS
> permissions on the .vmc file to control vmrc access, device mgmt and power
> state mgmt, e.g.
>
> --- == no access
> r-- == VMRC read-only access
> rw- == VMRC access plus devices mgmt (add/remove vhds, isos, undo)
> rwx == full control including power state mgmt (start/stop)
>
> Then Virtual Server itself has an ACE list under Server properties for
> finer control.
>
> On stopping a VM, keep in mind that if a user is Administrator in a Guest
> they can always issue a shutdown. That's not a Virtual Server issue.

> More permisisons problems - This is really getting to me now, so any help
> would be appreciated! Sorry this is such a long post!
>
> What i'm trying to do is give default "view" permissions to all my staff,
> and the give specific users rights to start/stop/use/modify specific
> guests. I think the way to do this is to use the Admin Web site to give
> the general permissions, and then NTFS to give the specific permissions to
> each subfolder that holds peoples guest machines.
>
> Using the Admin Web site to set permissions, the default is VIEW +
> CONTROL. This equates to
> C:\documents and settings\all users\application data\microsoft\virtual
> server == Read+Execute,List Folder Contents,Read
> G:\ (my Default virtual machine configuration folder) ==
> Read+Execute,List Folder Contents, Read
>
> This means the following as far as users access to guests goes:
> Can see all guests via VMRC admin display
> Can see all guests via Web admin display
> Cannot turn guests on via VMRC
> Cannot turn guests on via Web admin display
> ** CAN interact/control guests via VMRC **
> ** CAN turn guests OFF via Web **
>
> This is clearly no good for a production system, as users who do not
> have specific rights to guests should not be able to interact or turn them
> off. It's to be expected that users can interact via VMRC as thats what
> the Read+Execute permissions is supposed to be for (in VS terms), but
> without WRITE should users be able to turn a guest off?
>
> Again using the Admin Web site, this time reducing permissions to just
> VIEW. This equates to:
> C:\documents and settings\all users\application data\microsoft\virtual
> server == Read
> G:\ (my Default virtual machine configuration folder) == Read
>
> This then means following:
> Can see all guests via VMRC
> ** CANNOT see any guests via Web admin display **
> Cannot turn guests on via web
> Cannot modify guests config
> Cannot turn on via VMRC
> Cannot control via VMRC
> Cannot turn on via VMRC
>
> This looks pretty good, but it would be nice if you could see all the
> other guests via the Web Admin, as then users would have some idea of how
> much load the host was under.
>
> Anyway, now we need to give a specific user access to a specific guest,
> using NTFS permissions on the folder that holds the guests files. Granting
> the user
> Read+Execute, List, Read, Write for the user should be OK, and they can
> use the VMRC etc. But they still can't see the system via the Web Admin
> page, so they can't configure it or start/stop it.
>
> To fix this, i can give All Users "List Folder Contents" to the path that
> holds the LINKS to the virtual machines, rather than to the drive that
> holds the actualy .VMC files etc. This gives:
>
> C:\documents and settings\all users\application data\microsoft\virtual
> server == List Folder Contents,Read
> G:\ (my Default virtual machine configuration folder) == Read
>
> Now everything looks pretty good, all users can see all machines but only
> interact with the ones they have specific rights to. Sadly, this mucks up
> the permissions when viewed by the Administartion website, and if an admin
> clicks on the OK button on the web site, the permissions are rewritten to
> be:
>
> C:\documents and settings\all users\application data\microsoft\virtual
> server == List Folder Contents,Read
> G:\ (my Default virtual machine configuration folder) == List Folder
> Contents,Read
>
> So the questions are:
> Why does the web page not give "List Folder" when you choose only VIEW,
> but it does when you choose "Control"
> Is there anything bad about giving "List Folder" that i've not found
> yet?
>
> You wouldn;"t think this would be so hard would you!
> Jim
>
> --
> Jim Watts
> Information Systems Services
> University of Southampton
>
>
> "Richard Cardona" <(email address - cut out)> wrote
> in message news:(email address - cut out)...
>> Madrona wrote:
>>> Users Joe, Sally and Bill
>>>
>>> Joe can access start VM1 and remote control VM1 but can not start/stop
>>> or remote control VM2.
>>>
>>> Sally can remote control VM1 or VM2 but has not administrative control
>>> over the machines (this will probably be done using remote desktop).
>>>
>>> Bill has full control of VM1 and VM2 - that is; he can start/stop and
>>> remote control either one.
>>>
>>> Any ideas?
>>
>> Have you looked at the Virtual Server Admin guide? You can use NTFS
>> permissions on the .vmc file to control vmrc access, device mgmt and
>> power state mgmt, e.g.
>>
>> --- == no access
>> r-- == VMRC read-only access
>> rw- == VMRC access plus devices mgmt (add/remove vhds, isos, undo)
>> rwx == full control including power state mgmt (start/stop)
>>
>> Then Virtual Server itself has an ACE list under Server properties for
>> finer control.
>>
>> On stopping a VM, keep in mind that if a user is Administrator in a Guest
>> they can always issue a shutdown. That's not a Virtual Server issue.
>
>

> Answered my own question!
>
> The permissions i set screwed up the permissons on the folder that holds the
> ..VNC files, meaning that guests couldn't see/use the Virtual server network
> connections. Back to the drawing board (or VMWare.....)
>
> Jim
>
> --
> Jim Watts
> Information Systems Services
> University of Southampton
>
>
> "Jim Watts" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
> > More permisisons problems - This is really getting to me now, so any help
> > would be appreciated! Sorry this is such a long post!
> >
> > What i'm trying to do is give default "view" permissions to all my staff,
> > and the give specific users rights to start/stop/use/modify specific
> > guests. I think the way to do this is to use the Admin Web site to give
> > the general permissions, and then NTFS to give the specific permissions to
> > each subfolder that holds peoples guest machines.
> >
> > Using the Admin Web site to set permissions, the default is VIEW +
> > CONTROL. This equates to
> > C:\documents and settings\all users\application data\microsoft\virtual
> > server == Read+Execute,List Folder Contents,Read
> > G:\ (my Default virtual machine configuration folder) ==
> > Read+Execute,List Folder Contents, Read
> >
> > This means the following as far as users access to guests goes:
> > Can see all guests via VMRC admin display
> > Can see all guests via Web admin display
> > Cannot turn guests on via VMRC
> > Cannot turn guests on via Web admin display
> > ** CAN interact/control guests via VMRC **
> > ** CAN turn guests OFF via Web **
> >
> > This is clearly no good for a production system, as users who do not
> > have specific rights to guests should not be able to interact or turn them
> > off. It's to be expected that users can interact via VMRC as thats what
> > the Read+Execute permissions is supposed to be for (in VS terms), but
> > without WRITE should users be able to turn a guest off?
> >
> > Again using the Admin Web site, this time reducing permissions to just
> > VIEW. This equates to:
> > C:\documents and settings\all users\application data\microsoft\virtual
> > server == Read
> > G:\ (my Default virtual machine configuration folder) == Read
> >
> > This then means following:
> > Can see all guests via VMRC
> > ** CANNOT see any guests via Web admin display **
> > Cannot turn guests on via web
> > Cannot modify guests config
> > Cannot turn on via VMRC
> > Cannot control via VMRC
> > Cannot turn on via VMRC
> >
> > This looks pretty good, but it would be nice if you could see all the
> > other guests via the Web Admin, as then users would have some idea of how
> > much load the host was under.
> >
> > Anyway, now we need to give a specific user access to a specific guest,
> > using NTFS permissions on the folder that holds the guests files. Granting
> > the user
> > Read+Execute, List, Read, Write for the user should be OK, and they can
> > use the VMRC etc. But they still can't see the system via the Web Admin
> > page, so they can't configure it or start/stop it.
> >
> > To fix this, i can give All Users "List Folder Contents" to the path that
> > holds the LINKS to the virtual machines, rather than to the drive that
> > holds the actualy .VMC files etc. This gives:
> >
> > C:\documents and settings\all users\application data\microsoft\virtual
> > server == List Folder Contents,Read
> > G:\ (my Default virtual machine configuration folder) == Read
> >
> > Now everything looks pretty good, all users can see all machines but only
> > interact with the ones they have specific rights to. Sadly, this mucks up
> > the permissions when viewed by the Administartion website, and if an admin
> > clicks on the OK button on the web site, the permissions are rewritten to
> > be:
> >
> > C:\documents and settings\all users\application data\microsoft\virtual
> > server == List Folder Contents,Read
> > G:\ (my Default virtual machine configuration folder) == List Folder
> > Contents,Read
> >
> > So the questions are:
> > Why does the web page not give "List Folder" when you choose only VIEW,
> > but it does when you choose "Control"
> > Is there anything bad about giving "List Folder" that i've not found
> > yet?
> >
> > You wouldn;"t think this would be so hard would you!
> > Jim
> >
> > --
> > Jim Watts
> > Information Systems Services
> > University of Southampton
> >
> >
> > "Richard Cardona" <(email address - cut out)> wrote
> > in message news:(email address - cut out)...
> >> Madrona wrote:
> >>> Users Joe, Sally and Bill
> >>>
> >>> Joe can access start VM1 and remote control VM1 but can not start/stop
> >>> or remote control VM2.
> >>>
> >>> Sally can remote control VM1 or VM2 but has not administrative control
> >>> over the machines (this will probably be done using remote desktop).
> >>>
> >>> Bill has full control of VM1 and VM2 - that is; he can start/stop and
> >>> remote control either one.
> >>>
> >>> Any ideas?
> >>
> >> Have you looked at the Virtual Server Admin guide? You can use NTFS
> >> permissions on the .vmc file to control vmrc access, device mgmt and
> >> power state mgmt, e.g.
> >>
> >> --- == no access
> >> r-- == VMRC read-only access
> >> rw- == VMRC access plus devices mgmt (add/remove vhds, isos, undo)
> >> rwx == full control including power state mgmt (start/stop)
> >>
> >> Then Virtual Server itself has an ACE list under Server properties for
> >> finer control.
> >>
> >> On stopping a VM, keep in mind that if a user is Administrator in a Guest
> >> they can always issue a shutdown. That's not a Virtual Server issue.
> >
> >
>
>
>