Privilege access through ACS AD accounts

[jhager001]

I know how to put limitations on privilege levels on the network devices themselves. But we have a Cisco ACS that is integrated with AD for access. I haven't ventured too deep into AD yet, but i'm wondering if there is a simple way I can give my helpdesk access to run base level commands for example, show commands, and shut/no shut ports to recover from err-disable state. 

[Andre Neethling]

You can try the following:

Assign the show commands and Config commands to a privilege level.

Create an AD group for your Helpdesk staff

Assign the configured privilege level (eg Privilege 5) to the AD group with your TACACS

They should then only have access via TACACS to those commands specified.

HTH