May, 2013 Delegated Administration Project Excalibur Miho Hoshino, WW Support Readiness

© 2013 Citrix | Confidential – Do Not Distribute Document management CategoryTracking Information Company:Citrix Systems, Inc. Author(s):Miho Hoshino Owner(s):Worldwide Support Readiness Last modified:May, 2013 Version:Draft 3 Length:20 minutes

© 2013 Citrix | Confidential – Do Not Distribute Agenda Feature Description Enhancements from the previous versions Design considerations Troubleshooting References

© 2013 Citrix | Confidential – Do Not Distribute Delegated administration in XenDesktop 5.x There are five types of built-in administrator:  Full Administrator Has full administration roles  Machine Administrator Owns the catalogs  Assignment Administrator Can assign desktops to users  Read-only Administrator Can see all aspects of XenDesktop site  Help desk Administrator Can perform day-to-day monitoring and maintenance tasks No granular control for permission

© 2013 Citrix | Confidential – Do Not Distribute Delegated administration in Excalibur Provides an enterprise-class administration model and granular permission configuration Uses role and object-based control

© 2013 Citrix | Confidential – Do Not Distribute Delegated administration in Excalibur ScopesRoles Full Administrator Read Only Administrator Help Desk Administrator Machine Catalog Administrator Delivery Group Administrator Host Administrator Custom Objects can be in more than one scope Object Administrators Object All Win7Sales Object Full Admin All Help Desk Win7 Machine Catalog Delivery Group Win7 An administrator is associated with one or more role and scope pairs Sales A role has defined permissions

© 2013 Citrix | Confidential – Do Not Distribute How to create new administrator Select a role or create a new one Click Finish to enable the new administrator Click Create Administrator Type the name of the administrator user account or browse to it Select a scope or create a new one

© 2013 Citrix | Confidential – Do Not Distribute Creating a new scope

© 2013 Citrix | Confidential – Do Not Distribute Creating a new role

© 2013 Citrix | Confidential – Do Not Distribute Tips: Assigning multiple role and scope pairs Select and right-click an administrator Select Edit Administrator Click Add Select a scope and a role

© 2013 Citrix | Confidential – Do Not Distribute Resultant set of permissions (RSOP)

© 2013 Citrix | Confidential – Do Not Distribute RSOP report

© 2013 Citrix | Confidential – Do Not Distribute Delegated administration component interactions DDC server cmdlet PowerShell Desktop StudioDirector Delegated Administration Service Other Services Admin Config SDK WCF/Soap Call Inter-service Call SQL DB Access Cmdlets that change data ask the Delegated Administration Service if the user has the proper permission to perform the operation

© 2013 Citrix | Confidential – Do Not Distribute Delegated Administration Service Provides the core storage of delegated administration configuration Inherits many of the standard service behaviours of a normal XenDesktop Service:  Initial database creation  Schema versioning and updates  Service status and registration with the Configuration Service  A PowerShell admin service  A number of PowerShell cmdlets for managing service lifecycle and registration  Support for an inter-service WCF interface  Support for logging configuration changes

© 2013 Citrix | Confidential – Do Not Distribute Desktop Studio Director Active Directory XenDesktop Services Internal delegated administration objects RightRole Permission OperationScope Administrator User/Group Account Known Permission Known Permission Known Operation Scoped Object Indirectly Scoped Object Unscoped Object * * * * * * * **

© 2013 Citrix | Confidential – Do Not Distribute Internal delegated administration objects Descriptions AdministratorRepresents an individual person or a group of people identified by their Active Directory account RoleRepresents a job function, and has defined permissions associated with it. Roles can be built-in or custom ScopeRepresents a collection of objects RightRights determine what an administrator can do and where they can do it. They are expressed as a number of pairs associated with each administrator PermissionRepresents a unit of functionality that an administrator can perform OperationOperations are the indivisible unit of functionality

© 2013 Citrix | Confidential – Do Not Distribute PowerShell cmdlets for delegated administration Scope/Role/Permission/PermissionGroup/Administrator/Right cmdlets Get-AdminRevision Get-AdminEffectiveRight Get-AdminEffectiveAdministrator Test-AdminAccess Import-AdminRoleConfiguration Get-AdminRoleConfiguration

© 2013 Citrix | Confidential – Do Not Distribute Tracing delegated administration DelegatedAdminDAL DelegatedAdminFiltering DelegatedAdminLog DelegatedAdminLogging DelegatedAdminSnapIn DelegatedAdminDAL DelegatedAdminFiltering DelegatedAdminLog DelegatedAdminLogging DelegatedAdminSnapIn

© 2013 Citrix | Confidential – Do Not Distribute Questions? What happens when the service is down? What happens when the database dies? Does the service check users’ permission every time they run cmdlets?

© 2013 Citrix | Confidential – Do Not Distribute References delegatedadmin.htmlhttp://edocssand.citrix.com/proddocs/topic/xendesktop-7/cds-manage- delegatedadmin.html

Work better. Live better.