Maven Enterprise Edition utilizes data from SMS or SCCM in order to display user and computer information in the main grid as well as advertisement information in the Data tab. It is very important that users of Maven have at least read access to your company's SMS or SCCM database, as well as any other database that houses information that you intend to show within Maven.
We highly recommend following Microsoft's AGDLP approach to securing resources; in this case your database(s).
For example, suppose we work at small home improvement company called KNPHOME. Our company has deployed SCCM 2007 to manage all desktops and servers. SCCM is being managed by two people; the primary technician does about eighty percent of the work, and the secondary technician assists the primary and funnels reports back to management. We also have a small team that has been supporting all applications, users, and computers. The following steps are taken to ensure that our customer support analysts can read the data within SCCM.
1) Add users of Maven to a Global group in their respective domain. If you have a single domain, then you only have to create a single global group. Suppose we already had global group called ROL-Customer Support that contains all of our support analysts. The prefix ROL- is used to describe this group as a Role group.
2) Create a Domain Local group used to secure KNPHOME's SCCM database. We will call this group SEC-SCCMDB-R. We use a prefix of SEC- to let others know that this group is used for security, while we use a suffix of R to let others know this group will provide Read access.
3) Now we add our Global group called ROL-Customer Support into our newly created Domain Local group: SEC-SCCMDB-R. This will mean that ROL-Customer Support will now have the same permissions and rights as SEC-SCCMDB-R. In a multi-domain environment we may have additional Global groups to add to this Domain Local group or even additional Domain Local groups depending on the location of our users and resources.
4) Now that we have our groups in place it's time to secure our SCCM database. We would open Microsoft's SQL Management Studio and connect to our SCCM server, in this case KNPSERVER01\KNPSQL. Once connected, we would:
i. Open Explorer and expand the folder of the server instance in which to create the new login.
ii. Right-click the Security folder, point to New, and the click Login.
iii. On the General page, we would click the Search button.
5) Make sure we change our search scope to include groups. We click the Object Types button and then, select Groups.
6) Select our Domain Local group called: SEC-SCCMDB-R.
7) We change our default database to reflect our SCCM database, in this case it is called SMS_KNP.
8) Change our User Mapping to give SEC-SCCMDB-R the role membership db_datareader and public.
Maven users can now utilize all of the data stored in our SCCM database.