People and access

Users #

Open People → Users to review accounts, assign an existing account a role, create an account, change a role, or disable sign-in. Disable sign-in for a temporary access change; deleting a person permanently deletes the domain account and removes its group memberships.

The username is used to sign in to Skans. The display name initially follows the full name. The older Windows sign-in name has a 20-character limit. Changing the full name renames the directory entry; the account, groups, and role remain intact. Role permissions and Windows sign-in scope are separate: a console role does not itself open Windows sign-in on domain controllers. Changing a role updates workstation and member-server sign-in access. Domain-controller sign-in is for domain admins only. Review the Windows sign-in data and endpoint enforcement status in the account details. Windows sign-in enforcement requires agent 0.8.56 or newer; Linux endpoints are not covered. The status counts show enforced, restored, skipped domain controllers, and failed endpoints.

Email is required for notifications and routing approval requests. Separate multiple telephone numbers with commas or new lines. Country code stores the directory’s two-letter country attribute, such as US; Country stores its country-name attribute. Workstations accepts comma-separated computer names; an empty value permits any workstation. An empty account-expiry date means no expiry. Profile path, logon script, and home folder are read-only in this console.

Password requirements follow the appliance’s current password policy. When complexity is required, use three of uppercase letters, lowercase letters, digits, and symbols; the password must not contain the username or parts of the display name. Leave Require a password change at next Windows sign-in off for console-only users: console sign-in cannot change an expired password. Incompatible account options are rejected before saving.

Domain-wide administration is admin-only and audited. Skans-managed Domain Admins membership is removed when a person leaves Admin. Membership added outside Skans remains until it is explicitly removed in Active Directory. Windows administrator group membership can therefore preserve full access after a console role changes.

User pickers search after two characters and show up to 25 matches. Keep typing to narrow the results.

System accounts are hidden by default. If filtering finds no people, clear the filter or enable system accounts. A directory or role read error means access could not be determined; it does not mean nobody has access.

Roles #

A role groups permissions. Adding a person to a role adds them to the Windows domain group shown beside the role. The access review lists people with privileged permissions and shows whether their access is direct, inherited through another group, or supplied by a Windows administrator group. Export review downloads the same review as CSV.

Create or edit a role by choosing its permissions, name, description, group, and Windows sign-in scope. Saving replaces the role’s permissions and creates its Windows domain group if needed. Add people from the roles table after saving. Hover over or focus the role name for its description. Expand permissions to inspect individual grants.

A blank group value means the role has no mapped directory group. An unavailable membership read must be checked against the role’s Windows domain group. An empty membership list does not imply there are no privileged users elsewhere.

Technicians #

Technicians sign in with a field key after a local administrator approves a visit. An approval opens only this console to that exact key, for up to 12 hours and never beyond the key certificate’s expiry. It does not open a directory account. Password-based technician access is retired; Check accounts closes remaining legacy directory windows.

A genuine key tapping the console records a pending visit request. The name and employer come from the signed roster; the key model comes from the certificate. Review the key, employer, requested hours, and expiry, choose the visit duration, then approve or deny. Close now ends an active visit. Hover over its status reason for the full explanation.

An unmanaged appliance approves technician access locally. To connect a service provider, enter the provider address and its invitation code. The provider can close technician access and list the appliance among its customers. It cannot open an account, approve a visit, or change other settings. End management disconnects the provider and requires its exact name in confirmation.

Share health sends open problems with the provider check-in, alongside license state and backup age. When off, the provider sees only license state, backup age, and check-in age. The page shows the roster sequence, last-received time, freshness, and revoked-key count. A stale roster does not cause Skans to cancel visits based on that roster.

While offline, import a signed roster file or paste its signed text. Both inputs have a 256 KB limit. Pasted text stays in the browser until imported. Revoked key serial numbers are not displayed; only their count is shown.

Keys #

Security keys let users sign in without a password. Register a key for a user while it is connected to the administrator’s computer. The browser requests its PIN and a tap. No additional client software is required. The account can be entered as a Windows username or user@domain; the label identifies the physical key, for example “Office key” or “Field kit.”

Registration and sign-in must use the configured security-key origin. Key address opens that address; the host and port must match the appliance configuration. Reached at shows the current browser origin alongside the configured key address.

The grid shows each user’s keys, labels, registration dates, and last-use times. An unused key has a dash for last use. Removing a key prevents its user from signing in with that key; it can be registered again. A failed credential-store read is an error, not an empty inventory.