Configuration · Intermediate

Manage User Accounts and Permissions

Learn to create a user account, configure an access profile and assign the user to it in ManWinWin Desktop. Define user-specific access limits for cost centers, clients and systems, and review the saved configuration.

Effective user account management and permission control are fundamental for maintaining data integrity, operational security, and compliance within any CMMS. This guide will walk you through creating new user accounts, configuring access profiles, and assigning specific limitations in ManWinWin Web, ensuring each user has appropriate access tailored to their role.

Where it's available and step by step

Step by step in ManWinWin Web

1
Open Configuration > User Administration, click New and enter the new user's Code and Description.
2
In User Data, enter the user's personal and contact information and complete the applicable Function, Account, Admission Date, MH Cost and Working Hours fields.
3
Where access must be limited, use the Cost Centers, Clients and Systems tabs: click New, select the permitted cost center or sub-cost center, client, or system or subsystem, and click Go To for each selection.
4
In the Password tab, select the intended options, then click OK to save the user.
5
Open Configuration > Administration > User Profiles, click New, enter the profile's Code and Description, and click OK.
6
In the profile's Accesses tab, define the intended access to ManWinWin, peripheral applications and ManWinWin Web, then click OK to save.
7
In the profile's Users tab, click New, select the user created earlier, select Go To and click OK to save the assignment.
8
If the user requires ManWinWin Web, reopen the user in Configuration > User Administration, select Accesses, check the available M-WEB licences shown at the bottom of the window, enable ManWinWin WEB and click OK.
9
Reopen the profile and user records to check the saved profile accesses, user assignment and any cost center, client or system restrictions against the agreed requirements.

Theory and technical background

The Importance of Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a security mechanism where permissions are associated with specific roles, and users are assigned to these roles. In a CMMS, RBAC ensures that technicians only see work orders relevant to them, managers can approve requests, and administrators have full system control. This minimizes human error, prevents unauthorized data access or modification, and streamlines workflows by presenting users only with the functionalities and data they need to perform their duties efficiently and securely.

Granular Permissions for Data Security and Compliance

Beyond general roles, granular permissions allow for fine-tuned control over specific modules, records, and even individual fields. Limiting access by cost centers, clients, or systems directly supports data security and compliance with standards like ISO 27001. It ensures that sensitive financial data, client information, or critical asset details are only visible to authorized personnel. This level of control is vital for protecting proprietary information, preventing fraud, and maintaining audit trails demonstrating adherence to regulatory requirements and best practices.

Balancing Accessibility with Control

Optimizing user access involves a delicate balance: providing sufficient access for users to perform their jobs effectively without granting excessive permissions that could compromise system security or data integrity. Overly restrictive permissions can hinder productivity, while overly broad access increases risk. Regularly reviewing user profiles and permissions, especially after personnel changes or role reassignments, is crucial. This proactive approach ensures that the CMMS remains secure, efficient, and aligned with organizational needs, supporting overall asset management objectives.

Best practices

Always follow the principle of least privilege: grant users only the minimum access necessary for their tasks.
Regularly review user accounts and permissions, especially during audits or after changes in personnel roles.
Use descriptive names for profiles and users to easily identify their function and scope of access.
Never share user credentials; each user should have their unique login for accountability and security.

Frequently asked questions

Why should I limit user access to specific cost centers?

Limiting access to specific cost centers helps maintain financial data confidentiality, ensures users only see relevant budget information, and improves data accuracy by restricting modifications to authorized personnel, preventing errors and unauthorized transactions.

What is the benefit of a user profile over individual user settings?

User profiles simplify management by applying a standardized set of permissions to multiple users simultaneously. This saves time, ensures consistency across roles, and makes permission changes easier, as an update to the profile affects all assigned users.

How often should user permissions be reviewed?

User permissions should be reviewed at least annually, or whenever there are changes in an employee's role, department, or upon their departure. This prevents unauthorized access creep and ensures system security and data integrity are maintained.

Need help with this topic?

Back to Winston Help Center

Ask Winston or explore other lessons.

Winston Help Center