Security on User forms

(0) Share

Report

Posted on by Community Member

We are running an on-premise CRM 2013 and this has happened a couple of time, typically with new employees. The new employee, Joe, accidentally clicks on another users name, Carl, which then takes him to the Administration -> Users screen for Carl. Joe sees Carl's name there and think, 'oh, this should be my name instead.' and changes Carl's name to his. Now thankfully they only change the display name, not the actual username.

My question is what security settings are needed to prevent anyone from changing anyone else's user screen? Under Security Roles -> Core Records, all the User entities are set to User, but that doesn't seem to make a difference. Under Security Roles > Business Management there is the User entity there, which when I remove the Write privileges, makes the User screen Read-Only, but there isn't an option to set it to User, it just jumps from None to Business Unit.

Is this something unique to our system or is there something that I'm missing? I suppose I could set Field Security on the fields that I don't want changed, just curious if that is the only way to go?

Thanks

*This post is locked for comments

I have the same question (0)

All responses (3)

Answers (0)

ashlega 34,477 on at

Like (1)

Report

RE: Security on User forms

+1 for Aamer. This is exactly how out of the box roles are set up (have a look at the SalesPerson role, for example - they have no "write" permissions on the user entity)

Was this reply helpful? Yes No
Suggested answer

Community Member on at

Like (0)

Report

RE: Security on User forms

Hi Lindsay,

Why are we trying to give User access level on Write permission to the User records?

Logically & technically, end users will not be creating user records and should not be updating them.

I would prefer removing the Write permission altogether.

Was this reply helpful? Yes No
Suggested answer

Aric Levin - MVP 30,188 Moderator on at

Like (0)

Report

RE: Security on User forms

Hi Lindsay,

User Entity does not have User scope. Only scopes that are available are BU, Parent-Child BU and Organization.

You can create another form for the user entity which only contains the fields that you want to have your users see, and set the fields as read-only in form designer.

You can then enable security roles for the form and set the appropriate permissions.

System Administrators will have access to both forms.

Hope this helps.

Was this reply helpful? Yes No