Thanks for your reply. I was incomplete in my description.
We have approximately 800 switch and router devices managed by CW with ACS integration via TACAS+. Initially we allowed several individuals level 15 priviledge access via TACAS+ and a single group of ACS netork admins, relying on the expertese of same.
The network expanded rapidly as did this group of sys admins (sound familiar?). Individual responsibilities expanded and changed.
Now we want to ratchet down the list of users with unlimited access but provide more limited access and prividges to some of the experienced analysts who have been promoted beyond the day to day responsibilities system configurations. Further, we want to grant help desk level, system wide monitoring access to these and others less experienced such as desktop and server management.
Access via CiscoWorks allows monitoring capabilities at the help desk level, but unless I define a seperate priviledge level to a seperate group for these users and change the original enable password, the users previously assigned the original users group in ACS tacas+ would still be able to back door the devices (via Device Center - Telnet)and use the original enable password to reconfigure the devices.
Again, am I correct in my thinking that I must:
1.) assign them to a seperate group with a reduced privildge level,
2.) define this priviledge level in all affected devices (to match the capability of monitoring, not configuring all devices), and
3.) change the existing enable password on all devices to prevent application of previous enable password to achieve level 15 via Device Center Telnet/ssh back door.
Or, is there a more straightforward method I am missing via ACS TACAS+ and CiscoWorks?
