Reasons for creating administrator accounts

You can use the default system administration account, or root, for managing a storage system. You can also create additional administrator user accounts.

The following are the reasons for creating administrator accounts:

You can specify administrators and groups of administrators to have differing degrees of administrative access to your storage systems.
You can limit an administrator’s access to specific storage systems by giving him or her an administrative account on only those systems.
Having different administrative users allows you to display information about who is performing what commands on the storage system.
The auditlog file keeps a record of all administrator operations performed on the storage system and the administrator who performed it, as well as any operations that failed due to insufficient capabilities.
You assign each administrator to one or more groups whose assigned roles (sets of capabilities) determine what operations that administrator is authorized to carry out on the storage system.
If a storage system running CIFS is a member of a domain or a Windows workgroup, domainuser accounts authenticated on the Windows domain can access the storage system using Telnet, RSH, SSH, FilerView, Data ONTAP APIs, and Windows Remote Procedure Calls (RPCs).
For more information about authenticating users using Windows domains, see the section on user accounts in the CIFS chapter of the Data ONTAP File Access and Protocols Management Guide.

What users, groups, roles, and capabilities are
You need to understand what users, groups, roles, and capabilities are, so that you can grant different levels of administrative access to users of a storage system.
How users are assigned capabilities
You cannot assign administrative roles or capabilities directly to administrative users or domainusers. Instead, you assign users to groups whose assigned roles match the capabilities that you want those users to be able to exercise.
Requirements for naming users, groups and roles
When you name your users, groups and roles, you must meet the naming requirements.
Windows special groups
Windows has some special groups it uses for security and administration purposes. Do not create administrative groups on your storage system with the same name as a Windows special group.
About changing capabilities of other groups and roles
If you are an administrator assigned to a group with capabilities that are equal to or greater than another group, you can make changes to that other group.

Parent topic: How to manage administrator access