This section lists the permissions granted to each user role.
The Default role provides operating system access to Windows applications that do not require administrator privileges. In general, it provides the operating system access generally granted to the Windows user group "Everyone". The Default role provides access to all DeltaV applications which allows users in this role to launch most DeltaV applications. The Default role provides all of the same user access privileges available in previous versions of the DeltaV software. If you do not want different levels of operating system access for your DeltaV users, assign the Default role to all users.
DeltaV applications also have internal security that restricts what the user can do with the application. For some applications such as DeltaV User Manager, non-administrators are not allowed access to the application at all (that is, you must be either a Windows or DeltaV administrator to run User Manager). This is application security and not operating system security. Application security is beyond the scope of this document but is included here to ensure that users understand that permission to launch an application does not necessarily grant full access to the application's functionality. Application access is granted using DeltaV locks and keys.
The Basic Configuration role is intended to provide a level of operating system access between the unrestricted Default role and the more restricted Basic Operator role. The Basic Configuration role has the same operating system permissions as the Default Role; however, the user permissions can be modified for different levels of operating system access.
The Basic Configuration role is intended to give administrators the ability to custom configure a set of user privileges that are more restrictive than the Default role but not as restrictive as the Basic Operator role. As an example, administrators might modify the user permissions for the Basic Configuration role to restrict users from performing some actions in the operating system or to block access to DeltaV applications for which they do not need access. Users who are responsible only for creating DeltaV configurations might be assigned to this role. Typically, these users do not have operational responsibilities beyond testing configurations. Similarly, users assigned to this role might not require administrative access to the operating system.
Users in the Basic Configuration role have access to the Windows desktop and can run most applications. The Basic Configuration GPO can be used to deny access to operating system functions such as MSPaint or Powershell that would never be used on any DeltaV workstation regardless of the user's responsibilities.
The Basic Operator role has only those privileges needed to access applications, folders, and files required to perform its specific job functions. Depending on the DeltaV application, this can include Read/Write or just Read permissions in the application's folder. Additionally, access to folders outside of the application's folder is restricted. Because this role has very restricted access to DeltaV files and has GPO settings that deny access to most operating system features, only operators should be assigned to this role.
File security settings (that is, NTFS) provide a first level of defense against adverse user actions and GPO settings provide a second level of defense. This is the DeltaV system providing different layers of security to defend your system. Users assigned to the Basic Operator role are restricted from any of the administrator account types (DeltaV Administrator, DeltaV Batch Historian Administrator, DeltaV Event Chronicle Administrator) and from Windows Desktop Access.