It worked ok but still the user can run diagnostic tests under troubleshooting from the GUI. Also the device location options are still visible. I created a local account with RO access under aaaa.We dont use tacacs as we encountered lot of issues with WAAS appliances.
Do you know how to configure "locked out devices" option? The link you provided above cant be accessed because of priviledges issues.