Privilege level command in cisco

[santoshbajimaya]

I have been working on configuring lower privilege levels for my organization network devices (cisco). I have been testing privilege commands; creating access to specific commands for level 5 users. But when I delete that specific command that I created for level 5 privilege, the commands get shifted to level 15 privilege. 

As per my knowledge, level 15 is the highest privilege level. It has access to everything inside a cisco device. So, why it keeps on showing me the level 15 privilege commands. How can I get rid of those commands in my configuration?

The "no" commands don't work possibly we can't delete any access for privilege level 15.

I have hereby attached the screen shot of the issue.

Any suggestions.

[Georg Pauwen]

Hello,

I am not clear on what you are doing. You need to assign users to privilege levels, if you delete a privilege 5 command it will always be available on level 15.

Can you post the full config of your router ?

[santoshbajimaya]

Actually, I have a Radius server for AAA authentication from my AD. I have configured it for AD groups for privilege level users as well. I am just testing the privilege level (here level 5) for implementation in future to restrict the switch access to support staffs other than the admin staffs who will be using privilege level 15. 

I am just testing configuring my switch for commands that I want level 5 users be able to use. I am just configuring commands and removing them as needed for the test. So, whenever I delete any configured commands for level 5 with "no" command, that commands shifts to privilege level 15 in the running configuration as shown in the picture uploaded earlier.

I can't provide you with my full configuration because of security policy. Sorry.

[Georg Pauwen · Accepted solution]

Hello,

if you just want to get rid of the line in your running config, use:

privilege exec reset line

where 'line' is the exec command you have configured...

[santoshbajimaya]

Thank you very much.. That really helped getting rid of those commands being shown in configuration.