This section includes information about the effective rights in the following situations:
The rights of a folder and the rights of its parent folder are effective always. The most restrictive right is always the most effective right.
Example 1-1 For example, consider the following scenario:
Parent folder A has the View Leaf right set as Allow
A1 and A2 are subfolders of folder A and have the View Leaf right set as Deny
A3 is a subfolder of folder A2 and has the View Leaf right set as Allow
In this scenario, the View Leaf right will be denied to the A3 folder because the View Leaf right is denied for A2, which is a parent folder of A3. If the right is denied for any of the parent folders, it will be denied for all folders that are inside the parent folder.
The rights of a folder, by default, are the rights configured directly for it. If no rights are configured for the folder, it inherits the rights that are assigned to its parent folder.
Example 1-2 For example, consider the following scenario:
Parent folder A has the View Leaf right set as Allow.
A1 and A2 are subfolders of folder A and have the View Leaf right set as Deny.
A3 is a subfolder of A2 and has the View Leaf right set as Allow.
The View Leaf right will be available for subfolder A3 because it is directly assigned to A3, even though the View Leaf right is denied at the parent folder level.
On the other hand, if there are no rights assigned to a particular subfolder, its effective rights will be inherited from its parent folder.
Example 1-3 For example, consider the following scenario:
Parent folder A has all the rights assigned.
A3, one of the subfolders of folder A, has no rights assigned.
Folder A3 inherits all the rights available to its parent folder A.
The effective rights prior to ZENworks 11 SP3 are different from the effective rights after the ZENworks 11 SP3 upgrade.
Prior to ZENworks 11 SP3, the View Leaf right was not assigned, but was given to all folders and administrators by default, thus allowing the administrators to view all the objects in all folders.
In ZENworks 11 SP3, administrators will be able to view leaf objects in a context or folder only if the View Leaf right is assigned to them.
NOTE:As an exception, administrators are able to view all the folders soon after the ZENworks 11 SP3 Upgrade, because the View Leaf right is seen as an assigned right given to the root folders. The subfolders inherit the same rights from the root folders. However, the super administrators can revoke the View Leaf right given to the parent folder and assign it to any subfolder, so that the administrator can see objects of only that subfolder.
For information about assigning rights to administrators, groups, and roles, see Section 6.0, Assigning Rights.