Using explicitly denied rights to globally remove privileges for non-administrators

Deny overrides grant in Business Objects

The way that "explicitly denied" rights work (on the advanced rights tab) enables us to globally remove rights for groups or individuals.

Important: "explicitly denied" rights will always override an "explicit grant"

For any given right, if a user is a member of any group where that specific right is denied, the net right is denied.

Deny always trumps grant.

Using explicit denies at the highest level

We can set folder rights in CMC at the highest level, the "Settings" level. Doing this will effectively deny the right at all levels (since the "settings" level is the parent folder of all folders). Setting rights at this level avoids needing to individually remove rights at the folder level for various groups.

 businessobjects global settings


Go to the "Rights" tab in the settings.

business objects rights tab


On the rights tab, add a group that you wish to explicitly deny rights.

In our case we created a "non-administrators" group. We wanted to deny all non-administrators certain rights, like scheduling reports. We added all non-admins to the non-administrators group. Added an entry on the rights tab for the non-admin group and set the advanced rights.

On the "Advanced Rights" each individual right (row) can be set to either "Explicitly Granted," "Explicitly Denied," or "Not Specified."

advanced rights explictly denied granted


By setting rights that are explicitly denied, it effectively denies the right for any members of the specified group (non-administrators in our case).


Here is a list of the rights that can be set in this way in BusinessObjects:


General Rights

Desktop Intelligence Rights


Desktop Intelligence Add in




Web Intelligence Document



Filed under by

Spread the word Digg Furl Reddit

Permalink • Print • Comment

WordPress database error: [Table './boguru/wp_comments' is marked as crashed and last (automatic?) repair failed]
SELECT * FROM wp_comments WHERE comment_post_ID = '11' AND comment_approved = '1' ORDER BY comment_date