Intranet Access Groups
Examples and Questions
Permission groups are used to restrict access to certain computing resources. Most of these groups are generated automatically based on a person's association with UCL, i.e. whether they are a member of staff, a student or a visitor (including sub-categories) and their associated department. This information is drawn from UPI on a nightly basis and used by processes in Information Systems that actually create and maintain the groups.
How to find the right group:
names are formed from a combination of department and association
codes. Department codes are derived from the UCL departmental
hierarchy. Associations reflect the different types of association
people may have with UCL.
Please Note: You will be prompted to log in to view the links below - these pages are only visible to UCL staff.
The department makes up the group name prefix: e.g. msd-staff.
The association makes up the group name suffix: e.g. msd-staff
To include every member with a particular association, use one of the 'all' groups: e.g. all-staff, all-ug
Additional groups exist to restrict access to staff in UCL who hold particular roles. This includes Heads of Department, Deans, Departmental Administrators, Departmental Safety Officers, etc. To include everyone with a particular role, use the appropriate role group: e.g role-hod, role-dso
These links provide information on how the new Intranet groups are defined. Each group has two parts:
- Prefix - either "all" or a department code
- Suffix - the type of user included in the group
Prefixes are hierarchical - in the same way as the organisation hierarchy - so granting access to medicine-staff covers access to all sub-units under the Dept of Medicine.
The "all" prefix is used to limit access to all members of a particular type of user: e.g. all-staff, all-hon or every user in a specified department: all-greek
Old and New Groups:
Restricting access to staff in Dept of Biology:
- Previously either the old group name or the new group name could be used: libserv-staff or libraryser-staff
- Now use libraryser-staff for established staff, libraryser-hon for honorary staff and libraryser-asssta for associate staff registered in the Services System. libserv- prefixed group names are now obsolete.
What's the difference between ucl-staff and all-staff?
The ucl-staff, ucl-ug and ucl-pg groups remains the same as before. The new all-staff, all-pg, all-ug groups are essentially the same but would include staff recorded in non-UCL external organisations (including, for example, students on an intercollegiate year).
Staff in the following organisations are not included in the ucl-staff group but are included in all-staff group (this is because these departments are considered as independent of the main UCL organisation hierarchy:
- UCL Students' Union
- Trade Union Office
- Royal Institute of Great Britain
- Stanmore Implants Worldwide
Slides from a brief presentation explaining more about the Intranet groups, UPI and the changes detailed above can be found below:
- Intranet Permissions (170KB Microsoft PowerPoint presentation).
- Intranet Permissions (70KB Adobe PDF format)
There is no easy way to check which users are members of which groups. For technical users, a brief guide to finding group membership by querying the UCL LDAP service (PDF 225KB).