The ADMIN Class

Endpoint Administration Guide for Windows › Scope of Administration Authority › Sub Administration › The ADMIN Class

The ADMIN Class

Sub administrators—users listed in the access control list (ACL) of records in the class ADMIN—have privileges similar to users with the ADMIN attribute. However, the privileges of users in the ACL for records in the class ADMIN are limited to the particular class represented by the record. For example, the SURROGATE record in the ADMIN class determines which users can administer records of the SURROGATE class.

Note: For more information about CA ControlMinder classes, see the Reference Guide.

A user in the ACL for a particular record in class ADMIN can execute the following commands:

Access	Description	Commands
Read	Show the properties of the record in the class.	showusr, showgrp, showres, showfile, find
Create	Create new database records in the class.	newusr, newgrp, newres, newfile
Modify	Change properties in the class.	chusr, chgrp, chres, chfile
Delete	Remove existing class records from the database.	rmusr, rmgrp, rmres, rmfile
Connect	Add users to and remove users from groups. This access is valid only in the ACL of the GROUP record.	join, join‑
Password	Control the password of all users within the database, and their password attributes. This access grants the same authority as the access permitted a user with the PWMANAGER attribute. This is valid only in the ACL for record USER.	chusr

Users with ADMIN class privileges have the following limitations:

Users defined in the ACL of the USER record in class ADMIN cannot delete the last ADMIN user in the database.
ADMIN class users cannot set the global authorization attributes-ADMIN, AUDITOR, OPERATOR, and PWMANAGER-for the users they own.
ADMIN class users cannot necessarily update the audit mode. Only an ADMIN class user with the AUDITOR attribute can update the audit mode.
ADMIN class users cannot delete superuser (the root account on UNIX or the Administrator account on Windows), but they can set root to be NOADMIN.
ADMIN class users cannot make resources inaccessible to themselves, so:
- ADMIN class users cannot assign a security level to a resource that is higher than their own security level.
- ADMIN class users cannot assign a security category or security label that they do not have.

These limitations are part of the B1 security level certification.

More information:

B1 Security Level Certification