list sde users permissions/privileges

[Anonymous User]

Original User: alnesbit

Hello all,

I'm using 9.3 ArcGIS Server sql server sde. Is there any way to get a list of the users permissions/privileges to which feature classes? Basically I would like a list of the feature classes and which users have edit rights, viewing rights etc to them. I see this old post: http://forums.esri.com/Thread.asp?c=158&f=2284&t=282912&mc=2#msgid877028

Thanks

[VinceAngelo]

Even if you have the list of users, you'd still need to know the passwords of each to have the
database report permissions though ArcObjects or ArcSDE.  So you'd need to use database
techniques to obtain this, as Rob's post suggests.

- V

[Anonymous User]

Original User: alnesbit

Ok, so do you have any idea how I would do this? And I would do it in sql server, right? Or do you know where I could find out how to do this?

Thanks

[VinceAngelo]

I generally manage permissions through roles from creation scripts, so I know exactly what
permissions should exist on each table.  Exploring this from the database side is a rather
involved task; I would need to review the entire database security architecture, consult
experts (as found in a database vendor's forums), and then once I had the database matrix
of tables/users/roles/permissions, I'd need to reconcile that with feature datasets and
ancillary/support tables.  It's not an impossible task, but it is likely to be tedious and
painstaking. 😞

Good luck.

- V

[Anonymous User]

Original User: alnesbit

Ok.

So if I re-put on permissions on each feature class for a user it will reset it to that level, right? For example, if User4 had edit permissions on parcels but I didn't want that, if I right click parcels and say that User4 only has read permissions, then they'll only have read permissions? Seems like that's how it would work.

Then I guess I don't need to know what privileges they currently have as long as I can reset it that way.

Thanks,

[VinceAngelo]

I always manage permissions by role (create a role, grant table access to the role,
grant the role to users), so editing access through users would make my life much
harder, but if you don't have any roles, then you could do it that way.  You might
need to revoke all access first, just to clear the previously granted access.

- V

[Anonymous User]

Original User: alnesbit

You might
need to revoke all access first, just to clear the previously granted access.

- V

Ok, how do I revoke all access first? Do I just go to set permissions to the user and leave them all unchecked?

Thanks

[RobertHu]

You are right if you are using ArcCatalog 9.3.1 or early version. But before doing it, ensure no one is on the the feature class.

If you use 10, you have to explicitly select "REVOKE".

Thanks!

[Anonymous User]

Original User: alnesbit

ah ha! Found it with the awesome help of Jonathan from Tech Support. About to install it, hope it works. http://arcscripts.esri.com/details.asp?dbid=15123

Cheers,

[JimBergstrom]

At ArcGIS 9.x, there were 2 ArcSDE Privileges tools available as ArcScripts: the "ArcSDE User Privileges Report" mentioned by alnesbit above, and the "ArcSDE User Privileges Tool", which was my preference because it allowed the owner of a feature dataset to not only view privileges, but also to add and remove them in a compact little window.  However, there is apparently no update for v10, and the 9.x version doesn't install in v10.

The loss of this tool (and the GDBT) has forced me to keep a 9.3.1 install on one of my servers just to do the SDE admin tasks that these tools made a lot easier. 

Has anyone heard any rumors of v10 updates for these privilege tools?  (The Privileges tool in the Toolbox at 10 is really clunky, and no more functional than the right-click Privileges option at v9.)

Thanks.
JMB