Best Practice

If you want to use a site administrator to manage organizations, you should create a second site administrator for these tasks to improve Windchill performance. For more information, see Establishing Site Administrators on page 133 .

Establishing End Users

Depending upon how your Windchill solution was set up during installation, end users (users that do not have administrative privileges) are managed in one of two ways:

•Using an Enterprise Directory Service on page 26

•Using the Participant Administrator Utility on page 26

Windchill uses both the Windchill database and a directory service when creating users. For each user, there is an entry in a directory service and a Windchill object stored in the database.

In the out-of-the-box configuration, there are two LDAP directory services: the Administrative LDAP service and the Enterprise LDAP service. End users can reside in either service; although typically, the Administrative LDAP service should be used for administrative users and enterprise LDAP service should be used for all end users who are not administrators. For more information about the LDAP services, see Working with LDAP Directory Services on page 255

It is not required that end users be associated with an organization; however, categorizing users by organization provides an additional way in which you can identify a set of users. Windchill manages Windchill objects within each organization context and users affiliated with an organization can be given access to objects created from within an organization context.

Note

If your site does not use the organization attribute in the directory service entry, users can be assigned to an organization using the usersOrganizationName property. For more information on using this property, see Configuring Additional Enterprise Directories in the PTC Windchill Installation and Configuration Guide.

If you want to manage users based on license type, the View and Print Only license group is available. This group has an access control rule in place that restricts group members to be able to search for and view object information, download any attachments, and view markups. For more information, see About the View and Print Only License Group in the Access Control section of the PTC Windchill Specialized Administration Guide.

Using an Enterprise Directory Service

Instead of using the Windchill Directory Server that is bundled with your Windchill solution for the end users in the Enterprise LDAP service, you can use an enterprise directory service such as the Microsoft Active Directory Service (ADS). Each enterprise directory service entry contains attributes for the user. For example, user entries can have attributes for the user’s full name, email address, and organization.

The installation process can set up the enterprise directory service as the Enterprise LDAP node. If this was not done, an additional directory service can be established that uses the enterprise directory service. For information about setting up enterprise directory services, see the PTC Windchill Installation and Configuration Guide.

Usually, users in an enterprise directory service are managed through a third party tool and the Windchill user database object is created automatically the first time the user logs into the Windchill solution.

Using the Participant Administration Utility

The Participant Administration utility can be used to manage end users. The utility

can be accessed from Site Utilities and Organizations Utilities. Both the LDAP entry and the Windchill user database object are created when a user is created from the Participant Administration utility.

End users can be added to the Windchill solution by either a site or an organization administrator using the Participant Administration utility. To create a new user, you must have write permission to the directory service in which you want the user directory entry to reside.

When you create a new user from Site , you can associate that user with any existing organization within the Windchill solution. When you create a new user

from Organizations , the user is automatically associated with the organization from which the Participant Administration utility was launched.

When adding a new user in the Participant Administration utility, you can associate that user with a group and a profile. Groups can be created from either the Participant Administration utility or from the Groups link within the active organization context.