The DeltaV system uses user roles to provide different levels of access to the system. Users are assigned roles in the DeltaV User Manager application. There are three user roles: Default, Basic Operator, and Basic Configuration. In a workgroup environment, user roles use NTFS access permissions to control access to DeltaV applications and to some Windows applications. In a domain environment, user roles use NTFS access permissions plus GPO settings to further restrict the Windows features from users.
Users cannot be assigned GPOs in workgroups. In workgroups, all security settings must be made and managed at each local computer. If you want to use GPOs and centrally manage user access, the DeltaV system must be installed in a domain.
The DeltaV roles of Basic Operator and Basic Configuration cannot be Windows Administrators. However, users with either of these roles that have been migrated from versions prior to implementing this restriction maintain their existing privileges. This preserves DeltaV functionality after the migration. To remove the Administrator privileges, set the user to the Default role, remove the Administrator privileges, save the user, and then reassign the appropriate role.