Orchestrator 2012 Web Console shows no details

Posted: February 28, 2013 in Orchestrator, Solved
Tags: , ,

On a brand new System Center Orchestrator 2012 install the web console was showing the basic site, but would show no details for Runbooks or Runbook Servers.

It would work fine if I connected using the “Orchestrator Admin” account used during install, but other accounts were all having problems. It seemed obvious that permissions were the problem, but where exactly? All those same users could use the Orchestrator Designer console without any problem, so it seemed they had all the permissions needed.

SOLUTION:

It would appear the the issue is something to do with the way I had nested groups granting permissions and the way pass-through authentication works in IIS.

The user accounts were members of an AD group (AD\OrcAuthors) and that group was in turn a member of the Management servers local “OrchestratorUsersGroup”. In the Designer console, opening properties on the “Runbook” folder showed that the “OrchestratorsUsersGroup” had full control permissions. This is fine for the Designer Console, but it didn’t work with the Web Console

To resolve, the AD (OrcAuthors) group was given direct permissions to the Runbook folder and from that point the Web Console worked fine.

So, just apply permissions for AD groups directly to the required Runbook folders, don’t nest them in the local server OrchestratorUsersGroup.

Comments
  1. Scott says:

    it is also worth checking that during installation you specify an ActiveDirectory group to use for the Orchestrator Users group instead of letting the install create a local group.
    It is possible to change this after the installation if required by using the details in the following article
    http://technet.microsoft.com/en-us/library/hh463588.aspx

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s