Windchill Group Permissions

[Paul123]

Version: Windchill 13.0

Use Case: users can not see the library unless they are in the Organization Administrator group

Description:

First I am NOT a windchill expert, far from it, I just need this to work.

We upgraded from an older version and I am trying to cleanup the previous configuration. All users were administrators in the old config and when I put them in the correct groups they can not see the library or the library only list 37 objects out of the over 1000 objects. If I put the user in the Organization Administrator group they can see all the library objects.

Is this a permissions issue?

What would need to change?

[ScottMorris]

If everyone used to be an Administrator, you must have had chaos 😮

You mentioned adding people to groups. To provide the right level of access, you need to check your container roles and their associated Access Control Policies.  Go to the Org or Site level (depending on how your configured) and check the policies for the items people cannot access. If its CAD, search for EPM.Document policies to see who has what type of access. Most admins create a set of container roles that align with the permissions they want to enable and then create the associated policies to grant those permissions. 

Sounds like your Windchill system was never configured properly and could use a rethink on the implementation.  

[Paul123]

Thanks.

The EPM.Document policies look good.

I did find where the Team WTObject State "In Work" was set to Deny Full Control, I set it to Grant full control to test and it correct the issue of not seeing all the objects. 

Do you know if there is a set of best practices for setting permissions or is it just a case by case setup?

[TomU · Accepted solution]

Start here:

Solved: Where to create Access Control Rules? Context or ... - PTC Community

Make sure you have a good understanding of roles, groups, teams, ACLs, etc.

• About Roles and Groups
• About Access Control Lists
• Deriving ACLs from Access Control Policies