account creation

[JCY8096]

First of all here is what I want to do: I want a full access admin account, but I just dont want the account to be able to have the access to create new accounts. Is this possible?

[Lee Smith]

You have to have at least one Account that has Full Assess. It doesn't have to be Admin though.

Create a Full Assess Account, and call it what you want.

Change the Admin to the privileges of what you wont.

Lee

[JCY8096]

Well I have filemaker authenicating to active directory and I need someone to have admin rights, but as the administrator I dont want them to create any accounts.

[Steven H. Blackwell]

Whoops.

OK, there has to be at least one internally authenticated [Full Access] account. That Account, by definition, can create other Accounts. That privilege cannot be removed from that Account.

All other Accounts are usually subordinate level ones, whether internally or externally authenticated. Their actions are controlled by their Privilege Set. It is possible to give those Privilege Sets, and by extension the Accounts attached to them, the power to create new accounts, to delete existing accounts, and to enable or disable existing Accounts. By further extension that privilege can be given to a single Account within a Privilege Set and not given to other Accounts attached to the same Privilege Set.

Such subordinate Accounts as a general rule do not have access to Privilege Sets absent the optionally granted power to manage Extended Privileges.

Please read the Security Tech Brief:

http://www.filemaker.com/support/upgrade/techbriefs.html

or see http://www.filemakersecurity.com

Steven