re: Registering user as an Admin for device

Damir Dobric — Sun, 10 Aug 2008 10:29:48 GMT

I would like to reference to this Kalyan's post, which is related to our discussion about required admin permissions: blogs.msdn.com/.../device-security.aspx.

re: Registering user as an Admin for device

kalyanaj — Tue, 29 Jul 2008 02:49:30 GMT

Hi Damir,

Would like to comment/clarify on a couple issues mentioned in this post:

1) The above post seems to incorrectly indicate that you need admin privileges to use ANY of the DeviceManagerProxy operations even if it is not an admin task. Actually, admin privileges are needed only for state changing operations; a non-admin caller can perform any of the other operations: e.g. executing a command to print tags or executing a command to get property etc. can be done by a non-admin user.

2) Also, on a similar note, DeviceConnection can be used for both admin and non-admin tasks. For e.g. you can use DeviceConnection.SetProperty() provided the caller has admin rights on the device.

In fact, for synchronous command execution, it is recommended to use DeviceConnection over DeviceManagerProxy (DeviceConnection internally uses DeviceManagerProxy) and you can do both admin and non-admin operations using it.

To summarize:

Any operation that can potentially affect/change the state of the device requires the caller to have administrative privileges on the device. Having administrative privilege on a device means that atleast one of the following should be true:

a) The caller is a member of the builtin administrators group (OR)

b) The caller's account is a member of the device's custom administrator list (To view/modify this using RFID Manager, right click on a device -> Security). This account also should be added to the RFID_USER group on the server machine.

Once this has been setup, one can use DeviceConnection.OpenConnection() and execute the required operation.

Thanks,

KalyanaJ

Microsoft BizTalk RFID team.