First I must apologize about the length of this beast of a post
I'm currently running 2011r3.3 on a CentOs 6.3 minimum install (with Gnome). I have configured the groupings as such:
Hostgroups: The country the host physically sits in.
Servicegroups: The service the host is providing to the region.
Each servicegroup and hostgroup has a generic admin account so that they may monitor all services throughout the region (e.g. dco_admins can log in and see all domain controllers regardless of hostgroup assignment, cz_admins can see all hosts in the Czech Republic regardless of servicegroup assignment). In the past, these regular user accounts could not see hosts / services they were not explicitly authorized to view. Now when a dco_admin logs in, they see all the domain controllers in the DCO service group (correct), but clicking on hostgroup summary, the screen displays all countries along with complete status of every host / service in each country as opposed to only domain controllers. The user can then click on a specific country, and they have a complete list of hosts / services, but see a "no matching services" message on everything but the domain controllers.
If this same user then clicks on the "hostgroup grid", they see all hosts and services regardless of their location / service, and the "no matching services" message is not displayed....they can simply see everything in the system just like an administrative account.
This appears to be happening on all user accounts - when this behavior started I'm not sure, but after the initial install a dco_admin could only see domain controllers. If they clicked on any of the hostgroup links, they would be presented with a list of all domain controllers sorted by country and could not see any information on hosts that were not domain controllers.
Hope this explanation was sufficient to describe the problem.
Thanks,
Brian
