Currently we have around 100 Sessions groups.
Primarily set to group devices by client based on parameters such as "(GuestMachineDomain = 'DOMAINNAME') OR (CustomProperty1='ORGANIZATIONNAME')".

Our techs security is set to "HostSessionWithoutConsent: AllSessionGroups, OwnedAndUnowned".

What I need to do is reconfigure the security so that if a device is a WORKSTATION OS it will require a prompt for consent and if it is a SERVER OS to then NOT prompt for consent.

I am pretty sure I have to create 2 Session Groups per client.
One for Workstations that does not have "HostSessionWithoutConsent" and one for Servers that has "HostSessionWithoutConsent"
I would then have to update the Security Role for Each of the 2 new Session Groups per client.
This is doable but will be a management pain and time sink on configuration. If there is an alternative method I'm not thinking of, please chime in.

The next part to figure out is...
Is there a parameter in "manage session groups" that would be able to include a device if it is a workstation or server? I've searched the forums and support sections but haven't found what I am looking for.

NOTE: We use the default Unattended MSI installer and use the Manage Session Group filters to auto assign any new device to the appropriate client group. This has worked flawlessly so far and would like to keep the same process as part of solution.

Has anyone else gone down this rabbit hole?

Any help is appreciated.

Thank you, that worked just as needed.
Been playing with the roles and I think I got it ironed out.

For our Techs Global Roles I have the following.
CreateSupportSession
CreateMeetingSession
BuildAccessInstaller
ManageSharedToolbox
ViewSessionGroup: AllSessionGroups
JoinSession: AllSessionGroups, OwnedAndUnowned
EndSession: AllSessionGroups, OwnedAndUnowned
TransferSession: AllSessionGroups, OwnedAndUnowned
EditSession: AllSessionGroups, OwnedAndUnowned
RunCommandOutsideSession: AllSessionGroups, OwnedAndUnowned
AddNoteToSession: AllSessionGroups, OwnedAndUnowned
RemoveNoteFromSession: AllSessionGroups, OwnedAndUnowned
ReinstallSession: AllSessionGroups, OwnedAndUnowned
UninstallSession: AllSessionGroups, OwnedAndUnowned
TransferFilesInSession: AllSessionGroups, OwnedAndUnowned
RunSharedToolInSession: AllSessionGroups, OwnedAndUnowned

And then create one additional role for "HostSessionWithoutConsent" and add JUST the Client Server Groups
HostSessionWithoutConsent: 'CLIENT-A SERVERS', OwnedAndUnowned
HostSessionWithoutConsent: 'CLIENT-B SERVERS', OwnedAndUnowned
HostSessionWithoutConsent: 'CLIENT-C SERVERS', OwnedAndUnowned
etc,..

The Techs Global Roles do not have the Manage Session right nor the HostSessionWithoutConsent.
Devices are grouped automagically based on the Manage Session rules. Techs cannot move a device from one session group to another.

Manage Session Groups:
SERVER: (GuestOperatingSystemName LIKE '*Server*') AND ((GuestMachineDomain = 'DOMAINNAME') OR (CustomProperty1='OrganizationName'))
WORKSTATION: (GuestOperatingSystemName NOT LIKE '*Server*') AND ((GuestMachineDomain = 'DOMAINNAME') OR (CustomProperty1='OrganizationName'))

Now comes the fun part. Creating a second group for each client for just Servers. Updating the original group for just workstations. And then finally updating the Security Role for the Servers to host without consent.

Time for more in depth testing. I'll post any other insights I may find on way. Any comments or other ideas are welcome. Thanks guys

I don't think so. The option is HostSessionWithoutConsent, and I think you would have to add that right to every group BUT the one you want prompted for consent.

I think HighTech's solution reflects our view of roles best. Role based Security is a permissions based system: http://help.screenconnec...r_roles_and_permissions. We need to specify which permissions each role will carry and then assign them to our users. Roles are stackable, so when minor adjustments are needed, creating additional roles is an efficient way of adjusting permissions.

I would recommend:

1. Delete the "HostSessionWithoutConsent: AllSessionGroups, OwnedAndUnowned" permission from the role you wish to edit.
2. Create a new role with the ability to "HostSessionWithoutConsent: AllSessionGroups, OwnedAndUnowned"
3. Create a second role with the ability to "HostSessionWithoutConsent: 'Name of Session Group', OwnedAndUnowned" for each group you wish to allow "HostSessionWithoutConsent".
4. Now you can assign a second role as necessary to techs to allow or deny access to the specific group.

This will allow you to dynamically assign access to the group of machines in question. I hope this information is helpful.Please feel free to call in if you need a walk through.

Here's a link to setting up session groups, jic: http://help.screenconnec...Managing_session_groups.

Does setting up security restrictions also apply to sessions created/joined from an RMM (such as Labtech)? I edited the base Security Role to only allow HostSessionWithoutConsent on specific groups and have one excluded. This works as expected when going through the web-interface; however, when trying to connect to that same machine through Labtech there is no consent required. I verified that the Security Role is the same for both the individual user as well as the global user that Labtech uses to connect.

This is a bit of an old thread but has Labtech/Automate gotten to the point where it can leverage the role based security options? I was hoping to be able to disable file transfers but only for specific organizations and was hoping to do this with a session group. It works using the ScreenConnect web page but I can still transfer files when accessing the systems through Labtech.

Thanks

Edited by user Wednesday, December 20, 2017 6:45:39 PM(UTC)  | Reason: Not specified