# User Management Lifecycle

## Overview

Effective user management is essential for maintaining system security and ensuring appropriate access control. This document outlines the complete lifecycle of user accounts, detailing their creation, management, and role-based access within the system.

User accounts, which can be either local accounts or Active Directory accounts, are created within the Central Server to grant access to endpoints, custom groups, and remote offices. Roles define a set of permissions that determine what actions a user can perform within the system and outline the scope of which computers or devices the user will be allowed to manage. Each user is assigned a role, which dictates their level of access.

## Table of Contents

- [Prerequisites for User Creation](#prerequisites-for-user-creation)
- [Local User Creation](#local-user-creation)
- [Active Directory (AD) User Creation](#active-directory-ad-user-creation)
- [Scope of the User](#scope-of-the-user)
- [User Management Actions](#user-management-actions)
- [Personalization](#personalization)
- [Active Session](#active-session)
- [Notifications](#notifications)

## Prerequisites for User Creation

A configured mail server is essential for user account creation and user account-related notifications, such as password resets, account activation, and security alerts. Proper SMTP settings must be in place to ensure seamless email communication. Refer to the Mail Server Configuration [document](https://www.manageengine.com/products/desktop-central/help/configuring_desktop_central/configuring_mail_server.html) for detailed setup instructions.

## Local User Creation

1. Navigate to the **Admin tab** and select *User* under User Administrator.
2. Choose **Local Authentication** as the authentication type.
3. Enter a **User Name** and manually enter the user’s email address.
4. Select the **Role** from the drop-down list, which includes both predefined and user-defined roles.
5. Enter the user's **Contact number** if necessary.
6. Choose a **language** from the drop-down list for multi-language support; refer to the supported languages document.
7. Define the user's **scope** by specifying which computers they need to manage; refer to the [Scope of the User](#scope-of-the-user) section for detailed instructions.
8. Click on **Add User**.

[![Screenshot of local user creation form in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-1.png)](https://www.manageengine.com/products/desktop-central/images/umlc-1.png)

## Active Directory (AD) User Creation

1. Navigate to the **Admin tab** and select *User* under User Administrator.
2. Choose **Active Directory Authentication** as the authentication type.
3. Select a **Domain** in the **Domain Name** field; refer to the document on how to add a domain.
4. Choose a **username** fetched from Active Directory (AD).
5. The user’s **email address** will be automatically fetched from Active Directory if available. If not, manually enter the email address.
6. Select the **Role** from the drop-down list, which includes both predefined and user-defined roles.
7. Enter the user's **Contact number** if necessary.
8. Choose a **language** from the drop-down list.
9. Define the user's **scope** by specifying which computers they need to manage.
10. Click on **Add User**.

[![Screenshot of AD user creation form in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-2.png)](https://www.manageengine.com/products/desktop-central/images/umlc-2.png)

**Note:** If you want to enable login using SAML authentication, you must create either a **Local User** or an **AD User**. For detailed steps, refer to the [SAML Authentication documentation](https://www.manageengine.com/products/desktop-central/help/configuring_desktop_central/saml-authentication-with-sso.html).

## Scope of the User

The user is responsible for managing computers within their assigned scope on a Central Server. The scope can be customized, and there are two types of scope:

- Computers to be Managed
- Devices to be Managed

### Computers to be Managed

The user can be assigned one of the following types of computer scope:

- **All Computers:** The user has access to all computers managed by the Central Server.

  [![Screenshot of all computers scope selection in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-3.png)](https://www.manageengine.com/products/desktop-central/images/umlc-3.png)

- **Static Unique Groups:** The user has access to specific groups of computers created as custom groups. Refer to the custom groups document.

  [![Screenshot of static unique groups selection in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-4.png)](https://www.manageengine.com/products/desktop-central/images/umlc-4.png)

- **Remote Office:** The user has full access to computers belonging to a designated remote office. Refer to the Remote Office document.

  [![Screenshot of remote office selection in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-5.png)](https://www.manageengine.com/products/desktop-central/images/umlc-5.png)

### Devices to be Managed

The user can be assigned:

- **All Devices:** The user has access to manage all devices.

  [![Screenshot of all devices scope selection in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-6.png)](https://www.manageengine.com/products/desktop-central/images/umlc-6.png)

- **Device Groups:** The user has access to specific groups of devices. Refer to the device groups document.

**Note:** Only Administrator Role users have full access to the User Management console.

## User Management Actions

Administrator users can modify, delete, reset passwords, disable accounts, and regenerate QR codes for users using the Action button.

### 1. Modify User

Administrator users can modify, add, and remove user details, as well as define scope.

#### How to Modify User?

1. Navigate to the **Admin tab**.
2. Select **User** under User Administrator.
3. On the user page, click the three-dotted **action button** in the action column.
4. Select Modify. The user details page will open where you can modify, add, and remove details.

[![Screenshot showing modify user details in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-7.png)](https://www.manageengine.com/products/desktop-central/images/umlc-7.png)

#### Modifying AD User

- If it is an AD user, you can modify the domain name.
- **Note:** The username cannot be modified.
- Modify the role, email, contact number, and language.
- Define the user's scope by specifying which computers and devices they need to manage.

#### Modifying Local User

- Modify the role, email, contact number, and language.
- **Note:** The username cannot be modified.
- Define the user's scope by specifying which computers and devices they need to manage.

#### Convert User Authentication Type

- You can change an AD user to a local user by modifying the authentication type.
- The user will then receive a password creation link via email, allowing them to log in as a local user.
- You can also change a local user to an AD user by modifying the authentication type.
- **Note:** The same username must be present in Active Directory.

### 2. Logon Details

Administrator users can view the logon details of users to monitor their logon activities.

#### How to view Logon Details?

1. Navigate to the **Admin tab**.
2. Select **User** under User Administrator.
3. On the user page, click the three-dotted **action button** in the action column.
4. Select Logon Details.
5. A popup will display the logon details of the last 10 activities.

[![Screenshot of user logon details popup in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-9.png)](https://www.manageengine.com/products/desktop-central/images/umlc-9.png)

[![Alternate view of user logon details in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-8.png)](https://www.manageengine.com/products/desktop-central/images/umlc-8.png)

### 3. Delete User

Removing a user from the Central Server will revoke their access. Deletion permanently removes personal information such as email and contact number from notifications. If API keys have been generated, those integrations will be disabled unless new keys are generated prior to deletion.

#### How to Delete User?

1. Navigate to the **Admin tab**.
2. Select **User** under User Administrator.
3. Click the three-dotted **action button** in the action column.
4. Select Delete User.
5. In the Confirmation User Deletion Popup, optionally check the box to provide alternative contact details for replacement.
6. Remove any secondary contact details used for notifications.
7. Click **Delete User** to confirm deletion.

[![Screenshot of delete user confirmation popup in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-10.png)](https://www.manageengine.com/products/desktop-central/images/umlc-10.png)

### 4. Reset Password

The following steps describe the password reset process for a technician or Administrator using the Central Server web console. Refer to the [User Password Reset Guide](https://www.manageengine.com/products/desktop-central/reset-desktop-central-password-how-to.html).

#### How to Reset Password?

1. Navigate to the **Admin tab**.
2. Select **User** under User Administrator.
3. Click the three-dotted **action button** in the action column.
4. Select Reset Password.
5. A mail will be sent to the user with instructions and a link to reset the password.
6. The password reset link will expire in 30 minutes.
7. If the email is not delivered due to mail server issues, a “Send link manually” option will appear in the Remarks column for that user.
8. The Administrator can copy and manually send the password reset link.

[![Screenshot of password reset confirmation in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-11.png)](https://www.manageengine.com/products/desktop-central/images/umlc-11.png)

### 5. Disable User

Disabling a user account prevents login until reactivation and disrupts any enabled integrations. This action helps manage inactive accounts. For inactivity-based disabling, refer to the User Account Policy.

#### How to Disable User Account?

1. Navigate to the **Admin tab**.
2. Select **User** under User Administrator.
3. Click the three-dotted **action button** in the action column.
4. Select Disable Account.
5. In the confirmation popup, select "Yes, disable."

[![Screenshot of disable account confirmation popup in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-12.png)](https://www.manageengine.com/products/desktop-central/images/umlc-12.png)

### 6. Regenerate QR Code

If secure authentication is enabled via an Authenticator app, the Administrator can regenerate a QR code to set up OTP on a new device if the current one is lost or the app is accidentally removed.

#### How to Regenerate QR Code?

1. Navigate to the **Admin tab**.
2. Select **User** under User Administrator.
3. Click the three-dotted **action button** in the action column.
4. Select Regenerate QR code.
5. In the confirmation popup, select "Regenerate QR code."

[![Screenshot of regenerate QR code confirmation in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-13.png)](https://www.manageengine.com/products/desktop-central/images/umlc-13.png)

## Personalization

The Personalize menu allows users to customize their account settings for a tailored experience. It enables session management, time zone and format settings, language preferences, and password updates for better security and usability.

#### How to Access Personalization?

1. Log in to the Central Server web console.
2. Click the user profile icon located at the top-right corner, then select **Personalize**.

[![Screenshot of personalization options in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-14.png)](https://www.manageengine.com/products/desktop-central/images/umlc-14.png)

#### Change Session Expiration

1. Under the **General Settings** tab, locate the **Session Expiration** dropdown and select a duration.
2. Go to the **Choose Time Zone** dropdown and select the appropriate time zone.
3. Locate the **Choose Time Format** dropdown and select the desired date and time format.
4. Find the **Display Language** dropdown and choose your preferred language.
5. Click the **Save** button to apply the changes.

#### Changing Your Password

1. Open the **Personalize** window and click the **Change Password** tab.
2. Enter your current password in the **Old Password** field.
3. Type your new password in the **New Password** field, ensuring it meets the policy requirements.
4. Re-enter the new password in the **Confirm Password** field for verification.
5. Click **Save** to update your password or **Close** to cancel. Refer to the detailed password reset document for more information.

[![Screenshot of change password interface in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-15.png)](https://www.manageengine.com/products/desktop-central/images/umlc-15.png)

## Active Session

Users can log in to multiple sessions simultaneously on different browsers.

#### How to view Active User Sessions?

1. Navigate to the **Admin tab**.
2. Click the user profile icon located at the top-right corner.
3. Select **Active Session**.

[![Screenshot of active user sessions interface in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-16.png)](https://www.manageengine.com/products/desktop-central/images/umlc-16.png)

The Administrator can configure session expiry settings in the **User Account Policy**; refer to the related link.

## Notifications

The Notification feature allows the Administrator to receive alerts when users perform various operations. To receive these alerts, the Administrator's email address(es) must be configured.

#### How to Configure Notifications?

1. Log in to the Central Server.
2. Navigate to the **Admin tab**.
3. Select **User** under User Administrator.
4. On the user page, select **Notifications**.
5. Configure notifications for the events as shown in the image below:

[![Screenshot of notification configuration events in Central Server](https://www.manageengine.com/products/desktop-central/images/umlc-17.png)](https://www.manageengine.com/products/desktop-central/images/umlc-17.png)

6. **Administrator's E-mail Address:** Enter one or more email addresses.
7. **Mobile App Notification for Administrator:** Use the dropdown labeled **Select Administrator(s) to be notified** to choose the Administrator who will receive mobile notifications.
8. **Save the Configuration:** Click **Save** to apply the changes.