What is the reason for '$UCpowerConflictPolicy' in Directory and Resource Administrator? (NETIQKB25837)

  • 7725837
  • 02-Feb-2007
  • 19-Jun-2007


What is the reason for '$UCpowerConflictPolicy' in Directory and Resource Administrator?

Directory and Resource Administrator 6.x

Directory and Resource Administrator 7.x

The following information was taken from the User Guide, which can be accessed from the following link: https://www.netiq.com/support/dra/extended/documentation.asp

"...prevents escalation of power by making User Clone and User Create powers mutually exclusive."

The intent of assigning the UserClone power is to force the Assistant Admin (AA) to clone accounts that have predetermined values, keeping consistency for new accounts.  If the UserCreate power is also assigned in the same ActiveView, during a user clone process, the AA can modify many more property values than if he or she has just the UserClone power.  This diminishes the advantage of assigning just the UserClone power.  Conversely, if you assign the UserCreate power in an ActiveView, assigning the UserClone power adds needless overhead to the server process.  Having both powers in the same ActiveView forces the Directory and Resource Administrator (DRA) server to determine which power should be used to process the property change.  UserClone and UserCreate in the same ActiveView requires the DRA server to do processing that is not needed, increasing the time needed to complete a task.

Additional Information

Formerly known as NETIQKB25837