Managing groups

Predefined groups

If you want to, you can assign a user or domainuser to a predefined set of groups and roles provided by Data ONTAP. The predefined groups and roles are described in the following table:

Predefined Group	Default roles	Default privileges
Administrators	`admin`	Grants all CLI, API, login, and security capabilities.
Power Users	`power`	Grants the ability to Invoke all `cifs`, `exportfs`, `nfs`, `useradmin` CLI commands Make all `cifs` and `nfs` API calls Log in to Telnet, HTTP, rsh, and ssh sessions
Backup Operators	`none`	None
Users	`audit`	Grants the ability to make `snmp-get` and `snmp-get-next` API calls.
Guests	`none`	None
Everyone	`none`	None

Assigning roles to groups by creating or modifying a group

To create or modify a group, giving that group the capabilities associated with one or more predefined or customized roles, complete the following steps.

Note
When you use the useradmin group modify command to modify an existing group, whatever roles were previously assigned to that group are replaced with the roles you supply in the command.

Step	Action
1	Use the `useradmin group add` command to create a new group or the `useradmin group modify` command modify a group. *useradmin group {add\|modify} group_name* [-c comments] [-r {custom_role\|root\|admin\|power\|audit}[,...]]** group_name is the group that you want to create or to which you want to assign one or more roles. Group names are case insensitive and can be up to 256 characters. For more information about naming requirements, see Naming requirements for users, groups and roles. Note Do not create groups with the same name as any of the Windows special groups or any existing users. For a list of the Windows special groups, see Windows special groups. custom_role is a customized role with capabilities assigned through the `useradmin role add` command. `root \| admin \| power \| audit` are roles predefined by Data ONTAP with default capabilities. For a description of the predefined roles see Predefined roles. Example The following command gives the group "admin users" capabilities associated with the admin role, and removes any roles previously assigned to the admin_users group. useradmin group modify "admin users" -r admin
2	Enter the following command to verify the success of your operation. useradmin group list group_name The roles and capabilities assigned to the group in question are listed in the output of this command.

Step

Action

Use the useradmin group add command to create a new group or the useradmin group modify command modify a group.

useradmin group {add|modify} group_name [-c comments] [-r 
{custom_role|root|admin|power|audit}[,...]]

group_name is the group that you want to create or to which you want to assign one or more roles. Group names are case insensitive and can be up to 256 characters. For more information about naming requirements, see Naming requirements for users, groups and roles.

Note
Do not create groups with the same name as any of the Windows special groups or any existing users. For a list of the Windows special groups, see Windows special groups.

custom_role is a customized role with capabilities assigned through the useradmin role add command.

root | admin | power | audit are roles predefined by Data ONTAP with default capabilities. For a description of the predefined roles see Predefined roles.

Example

The following command gives the group "admin users" capabilities associated with the admin role, and removes any roles previously assigned to the admin_users group.

useradmin group modify "admin users" -r admin

Enter the following command to verify the success of your operation.

useradmin group list group_name

The roles and capabilities assigned to the group in question are listed in the output of this command.

Renaming a group

You can rename a group using the useradmin group modify command. To rename a group, complete the following step.

Step	Action
1	Enter the following command: useradmin group modify group_name -g new_group_name group_name is the name of the group you want to change. new_group_name is the name you want the group to have after the change. Note Do not attempt to rename a group with the same name as any of the Windows special groups. For a list of the Windows special groups, see Windows special groups.

Step

Action

Enter the following command:

useradmin group modify group_name -g new_group_name

group_name is the name of the group you want to change.

new_group_name is the name you want the group to have after the change.

Note
Do not attempt to rename a group with the same name as any of the Windows special groups. For a list of the Windows special groups, see Windows special groups.