Group Management Admin enhancement

paulmorrisey

When you create a closed group it adds a member by default "Grant: Manage all Groups", this member can't be seen in the list of members but it permits those with the Manage all groups grant membership in the group.

The grants on the pre-installed Admin role are not editable so all Admin Role profiles have this grant.

It appears the problem is a group owner can delete the "Grant: Manage all Groups"

This appears to be a logical gap in the processing as it could create a scenario where all the owners exit the company for example and there would be no direct way to manage the groups.

Certainly I can see some cumbersome workarounds an admin could use to get around this limit but it seems to directly defeat the what I would expect the purpose of the grant "Manage all Groups" to do.

jaeW_at_Onyx

not sure what your question is. but this is definitely a necessary grant.

it's a (small) step toward minimizing the "god mode" problem.

if a user has "manage all groups" they could add themselves to groups they should not be able to add themself to. imagine you have a finance group and a sales group and a member of the sales group has "manage all groups" and they add themself to finance and can suddenly see modify and change a lot of stuff that finance has access to.

by removing "manage all" — we prevent admins from different departments from giving themselves access to stuff they shouldn't be able to.

it can blow up, :D but that's what domo support is there for.

if you enable "show system groups" you can remove the "manage all" group from group owners.