The SYMACL should be configured using SYMMWIN. This is an online procedure and it wont take more than 2 minutes then like Saurabh said you continue working on the rest of configurations using SE.  For your questions regarding ACL on AIX server:  If you want to limit the use only to TF/SNAP then your configuration should be as follows (Assuming you've enabled it from SYMMWIN already):  For your ACE, you will need to assign at least BASE and SNAP permissions for your controlled devices “accpool” for your AIX server group “accgroup”.   grant access=BASE to accgroup “name” for accpool “name”; grant access=SNAP to accgroup “name” for accpool “name”;  Alternatively, You can use the ALL devs instead of accpool but this is less restrictive.   grant access=BASE to accgroup “name” for ALL devs; grant access= SNAP to accgroup “name” for ALL devs;  The managemnt Console should have ADMIN privillage as it will use (as per my understanding) to manage the whole symmetrix. I do not recommend mixing SYMAUTH and SYMACL on the same environment but i have seen configurations where both are implemented. It is up to your customer security policy but both can be configured on the same environment.  Let me Know if you have further questions  Mohammed Salem
Hi,  I'm actually working for a customer wishing to secure it's VMAX environnement so that only those working with storage environnement  can actively administrate the storage array.  The request come from the fact that anyone logging onto management console having Solutions Enabler, will be able to execute commands on the array.  In order to secure the arrays from non-storage administrator, i have activated "symauth" in the following way: -I create a Windows Domain account (D:) for each storage administrator in the authentification DB of each VMAX -I have also created a local account on each console (in case the Windows Domain is not accessible) --> I have enabled "symauth" in enhenced mode in order to limit access to only the users registered on each VMAX  Can anyone who used this fonctionnality able to tell me it is the right way to use it ?   Also, the customer has a AIX server that will be used to SNAP volumes from the VMAX and wish to limit it's access to only SE TF/SNAP operations.  I know i should use the "symacl" command to do so, but am unsure of where to start. I have 3 SE installed in the environnement, 2 are installed on management console and 1 is on AIX server. -On the management consoles (Unisphere), should i leave the base configuration in place (UNKNOWN_GRP) ?  Or should i add new ACL and remove the base configuration ? -What ACL configuration should i place on the AIX server ?  Thank you,  Christian
symauth and symacl questions