HPOM group accounts

HPOM uses Windows group accounts to identify valid users of the product. During the installation, HPOM creates the following two groups, either locally on the management server (if you are performing a workgroup installation), or in the domain for domain installation:

• HP-OVE-ADMINS (HPOM administrators)
• HP-OVE-OPERATORS (HPOM operators)

You can also specify different names during the installation, or, instead of having HPOM create them for you, you can also create these groups yourself before or during the installation.

The purpose of these groups is to allow users to access the HPOM console and HPOM resources so that they can perform HPOM administrator or operator tasks. For example, you can add Rosa Galvez, who is not a Windows administrator, to the HP-OVE-ADMINS group so that she can perform HPOM administrator tasks, or add Sean Payne, another HPOM user who is not a Windows administrator, to the HP-OVE-OPERATORS group to perform operator tasks. Local or domain administrators by default cannot access HPOM.

NOTE:
No user should be part of both groups. An HPOM administrator should not be added to the HP-OVE-OPERATORS group.

HP-OVE-ADMINS

The HP-OVE-ADMINS group by default contains the following members:

• Installing user

  After the installation, an HPOM administrator can remove the installing user from the HP-OVE-ADMINS group by launching the Tools HP Operations Manager Tools Cleanup rights of the installing user tool (OvOWResetOVOWAdminRegKeyRights.exe). The installing user and HPOM operators do not have permissions to execute this tool.

• HP-OVE-User
• HP-OVE-Deleg-User

HPOM Administrator Tasks

Users classified as HP-OVE-ADMINS can perform the following HPOM administrator functions:

• Add managed nodes
• Configure managed nodes, tools, service types, and user roles
• Deploy policies and packages Required administrator privileges for package deployment

  By default, members of the HP-OVE-ADMINS group may not have sufficient rights to deploy, remove, and reinstall packages. Depending on the selected deployment option, the user who initiates the update must have the following privileges:

  • PMAD user deployment option

    This option requires the HP-OVE-Deleg-User account to be domain or local administrator on the node.

  • Impersonate user deployment option

    For this option, members of the HP-OVE-ADMINS group must be domain administrators or members of the local Administrators group on the node.

  • Use alternate credentials deployment option

    This option applies to HTTPS agents only. Members of the HP-OVE-ADMINS group can specify the user name and password of an alternate user with local administrator rights on the node.

• Create and modify policies, tools, services, and user roles
• Create automatic and operator-initiated commands
• Expand and navigate Policy Management in the console tree
• Run utilities (register packages, upload and download from user roles policies)
• Perform all operator tasks

HP-OVE-OPERATORS

The HP-OVE-OPERATORS group is initially empty.

HPOM Operator Tasks

Users classified as HP-OVE-OPERATORS can perform all HPOM tasks except those listed under HP-OVE-ADMINS tasks:

• All actions on messages
• Use message filters
• Change severity
• Modify message text
• With the proper authority, execute tools, view service maps, and access policy and package management.

As an administrator, after adding a user to the HP-OVE-OPERATORS group, you can further define the rights of that user with the User Roles Editor.

Related Topics:

• HPOM user accounts
• Configuring user roles