![](/images/new-backgrounds/1110903/11090357x1.webp)
A user's role can be changed in two ways:
1.Modify the subject
2.Modify the user's containing group membership in Active Directory.
Definitions of RBAC roles and permissions
The following table summarizes which permissions are available for each role. For details on the operations available for each permission, see Definitions of permissions.
Table 1. Permissions available for each role
Role | Pool Admin | Pool | VM Power | VM Admin | VM | Read Only | |
permissions |
| Operator | Admin |
| Operator |
| |
|
|
|
|
|
|
| |
Assign/ | X |
|
|
|
|
| |
modify roles |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
Log in to | X |
|
|
|
|
| |
(physical) |
|
|
|
|
|
| |
server |
|
|
|
|
|
| |
consoles |
|
|
|
|
|
| |
(through |
|
|
|
|
|
| |
SSH and |
|
|
|
|
|
| |
XenCenter) |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
Server | X |
|
|
|
|
| |
backup/ |
|
|
|
|
|
| |
restore |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
Log out | X | X |
|
|
|
| |
active user |
|
|
|
|
|
| |
connections |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
Create and | X | X |
|
|
|
| |
dismiss |
|
|
|
|
|
| |
alerts |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
Cancel task | X | X |
|
|
|
| |
of any user |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
Pool | X | X |
|
|
|
| |
management |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
VM | X | X | X |
|
|
| |
advanced |
|
|
|
|
|
| |
operations |
|
|
|
|
|
| |
|
|
|
|
|
|
| |
VM create/ | X | X | X | X |
|
| |
destroy |
|
|
|
|
|
| |
operations |
|
|
|
|
|
| |
|
|
|
|
|
|
|
9