;)
Summary: Operator role and higher (operator, advanced operator, and administrator) should be able to put systems into maintenance mode.
My testing: For due diligence I tested this in my lab environment as well for the Administrator role, Operator Role and Read-Only Operator Role and the results are shown below.
Administrator: (Maintenance mode is available)
Operator: (Maintenance mode is available)
Read-Only Operator: (Maintenance mode is NOT available)
For additional details, Microsoft has provided a set of what privileges are associated with each role in OpsMgr which is included in this post for reference purposes (The following content of what roles have what privileges is re-arranged from: http://technet.microsoft.com/en-us/library/hh872885.aspx)
1.1 Administrator
The Administrator profile includes full privileges to Operations Manager. No scoping of the Administrator profile is supported. The Administrator profile contains all of the privileges found in the Author, Advanced Operator, Operator, and Read-Only Operator profiles in addition to those listed below.
- Create a resolution state
- Delete a resolution state
- Update a resolution state
- Deploy an agent
- Repairing or update an installed agent
- Uninstall an agent
- Enumerate agent settings
- Update agent settings
- Enumerate agents
- Start or stop managing computers or devices via a proxy health service
- Enumerate computers or devices managed via a proxy health service
- Insert a new instance of a computer or device
- Delete an instance of a computer or device
- Run discovery task
- Create events
- Enumerate global settings
- Update global settings
- Export Management Packs
- Enumerate Management Servers
- Delete notification endpoint
- Update notification endpoint
- Create performance data
- Create Run As Accounts
- Delete Run As Accounts
- Enumerate Run As Accounts
- Update Run As Account
- Create mappings between Run As Account and Run As Profiles
- Delete mappings between Run As Account and Run As Profiles
- Enumerate mappings between Run As Account and Run As Profiles
- Update mappings between Run As Account and Run As Profiles
- Create connected management groups
- Delete connected management groups
- Enumerate user roles
- Delete user roles
- Update user roles
- Write favorite reports
- Delete favorite reports
- Read favorite reports
- Update favorite reports
- Read reports
- Run reports
1.2 Author
The Author profile includes a set of privileges designed for authoring of monitoring configuration. A role based on the Authors profile grants members the ability to create, edit, and delete monitoring configuration (tasks, rules, monitors, and views) within the configured scope. For convenience, Authors can also be configured to have Advanced Operator privileges scoped by group. The Author profile contains all of the privileges found in the Advanced Operator, Operator, and Read-Only Operator profiles in addition to those listed below.
- Create Management Packs
- Delete Management Packs
- Enumerate Run As Profiles
1.3 Advanced Operator
The Advanced Operator profile includes a set of privileges designed for users who need access to limited tweaking of monitoring configuration in addition to the Operators privileges. A role based on the Advanced Operators profile grants members the ability to override the configuration of rules and monitors for specific targets or groups of targets within the configured scope. The Advanced Operator profile contains all of the privileges found in the Operator and Read-Only Operator profiles in addition to those listed below.
- Update Management Pack
- Enumerate templates
1.4 Operator
The Operator profile includes a set of privileges designed for users who need access to alerts, views, and tasks. A role based on the Operators profile grants members the ability to interact with alerts, run tasks, and access views according to their configured scope. The Operator profile contains all of the privileges found in the Read-Only Operator profile in addition to those listed below.
- Update alerts
- Run diagnostics
- Create favorite tasks
- Delete favorite tasks
- Enumerate favorite tasks
- Updates favorite tasks
- Run recovery routines
- Update maintenance mode settings
- Enumerate notification actions
- Delete notification actions
- Update notification actions
- Enumerate notification endpoints
- Enumerate notification recipients
- Delete notification recipients
- Update notification recipients
- Enumerate notification subscriptions
- Delete notification subscriptions
- Update notification subscriptions
- Enumerate tasks
- Enumerate task status
- Run tasks
1.5 Read-Only Operator
The Read-Only Operator profile includes a set of privileges designed for users who need read-only access to alerts and views. A role based on the Read-Only Operators profile grants members the ability to view alerts and access views according to their configured scope.
- Read alerts
- Retrieve the instance of the data warehouse for the Management Group
- Read state of a resolution
- Read instance of a connector
- Read a console tasks
- Enumerate diagnostic objects
- Enumerate the results of diagnostics
- Enumerate discovery objects as defined in a Management Pack
- Read a discovery rules
- Read events
- Write to favorite console tasks
- Delete favorite console tasks
- Enumerate favorite console tasks
- Update favorite console tasks
- Write a favorite view
- Delete a favorite view
- Enumerate a favorite view
- Update a favorite view
- Enumerate monitoring objects
- Enumerate monitoring classes
- Enumerate monitoring relationship classes
- Enumerate Management Packs
- Enumerate monitor types
- Enumerate module types
- Enumerate monitors
- Enumerate overrides
- Enumerate performance data
- Enumerate discovery objects as defined in a Management Pack
- Enumerate the status of past recoveries
- Enumerate relationship between monitored objects
- Enumerate rules
- Enumerate saved searches
- Update saved searches
- Write to saved searches
- Delete saved searches
- Enumerate state
- Allows access to connected Management Groups
- Enumerate views
- Enumerate view types
1.6 Report Operator
The Report Operator profile includes a set of privileges designed for users who need access to Reports. A role based on the Report Operator profile grants members the ability to view reports according to their configured scope.
- Retrieve the instance of the data warehouse for the Management Group
- Write to favorite reports
- Delete favorite reports
- Read favorite reports
- Update favorite reports
- Read reports
- Run reports
1.7 Report Security Administrator
- The Report Security Administrator profile includes a set of privileges designed to enable the integration of SQL Server Reporting Services security with Operations Manager.
- Export Management Packs
- Enumerate classes as defined in the Management Packs
- Enumerate Management Packs
- Run a report
- Enumerate rules
Thank you to Paul Johnson for his assistance putting this together!
