In XI, we are having users add clients to groups which they will administer moving forward. The users requested me to add their required hostgroups for them to start adding clients to. They started adding clients (with my help) over the past month or so. We are now running into an issue where one of the users runs through a wizard to add a client, when they get to the last step or so when they select which group the client should be part of, they do not see the group, they see many other groups (that they have been adding to), but they do not see one of the new groups I added. This group is new, has no clients in it, it's fresh. How do I give the user permission to add to this group? Could they only add to other groups because there was other clients in those groups with his contact on it? This user swears that he has added to groups in the past that had 0 clients in it.
The only way the hostgroup will show up is if you edit the user in Admin > Manage Users, set Core Config Manager access to Limited, and then under Limited Access CCM Permissions check the box next to Host Groups to give them hostgroup editing permissions.
Would this give them permissions to royally destroy everything I've built? Also, why can they see these specific hostgroups? Is it because there are clients in these groups that they manage? So they can only add to groups that have clients that they manage in them if they don't have this added permission?
I just tested this again and the hostgroups do show up without giving them modify hostgroup privileges if there is already a host that the client is a contact of in that hostgroup.
I you give the edit hostgroups permissions then they would be able to see all of them. If you have different clients using the multi-tenancy functionality then I probably would not grant that edit hostgroup functionality.
So say I have multiple teams all using one instance of XI. A Network Team, Windows Team, etc. If I gave the Windows users the edit hostgroups permissions, they could, in theory, mess up the monitoring for the Network team if they felt like making my and the Network teams day bad.
Yes, that would be correct. Without doing that you're currently forced to create the hostgroup and add a host they are a contact of on it for them, then they would be able to use it.
