protect against a mistaken mass deploy of a job

pdumbelton · 11-13-2008, 02:06 PM

Is it possible to configure permissions such as a user can only deploy a job to 1 system at a time only?
I want to protect against a mistaken drag & drop of a job (script) onto a group of system & the havoc that can cause.
I know I can disable scheduling altogether but I need the team to be able to deploy but I want to protect against mistakes.

ztruelove · 11-18-2008, 06:32 AM

You could remove the permissions from your existing groups related to running commands and create only a single group with permissions to run jobs. That way any time someone wants to deploy a job, they have to move the computer(s) into the group that has permissions. Then it would be procedure to move those computers back to their original groups after the deployment is completed.

This adds an extra step to each deployment, but it mitigates the risk of having an accidental drag and drop.

pdumbelton · 11-18-2008, 12:14 PM

Thank you, ztrulove.
Good idea & I might implement this strategy for the interim.
Did some further research & it seems 6.9sp1 has additional access permissions which address this issue. I'm due to do a rebuild of my ADS soon anyway so I'll migrate to 6.9sp1 at the point.
Thanks again.

Brandon · 11-19-2008, 03:52 AM

Even if there is an accidental drop they still have to hit okay again to schedule it. Would probably be better in the long run to fix this on the user training side. You can disallow scheduling to the All Computers group.

pdumbelton · 11-19-2008, 04:12 AM

Thanks Brandon.
Yes I agree there would seem to be plenty of warning not to prompt you that you are deploying a job but I've learned the hardway as I'm sure most have that even with good documentation & training you can still have brain fart moments where accidents can happen. he only true way is to limit or disallow & that is what I'm aiming for. I thank both you & Mr.ztuelove for your comments, very appreciated.
Pete.