Hi all,

I want to introduce RBAC at a customer. At the moment this customer has one SCCM2007 primary site server and one SCCM2012 R2 primary site server. Everything is already migrated to the new server so the old SCCM2007 server should be removed soon.

Meanwhile I would like to configure RBAC so I created three specific roles. Now I want te revoke the Full Administrator rights of some users but i'm bumping into an issue. It is not possible to revoke the Full Administrator right and I can tell you that I'm seeing to symptoms:

1. If a user is assigned the "All" security scope, the options to delete the user is greyed out

2. For a user, it is not possible to remove/replace the "All" security scope for the "Default" security scope

Please advise on this issue.

Thanks in a

I checked this in my environment. For item #1,  my administrative user account has the "ALL" security scope, and I have the delete option. It is not greyed out. Item two is possible too. I would investigate the accounts you are using to make the changes in SCCM. It really sounds like the accounts you are using don't have the rights to make administrative user account changes.

-Tony

• Proposed as answer by Jason SandysMVP 17 hours 59 minutes ago