Setting up access levels in VisualSVN

Question

I am running VisualSVN Server on a Windows Server 2008 box. We have several developers. I want to configure VisualSVN Server to only allow certian users to have access to modify the repository settings, create/remove repositories.

I contacted VisualSVN Server's support and I received this response:

Users are not allowed to manage VisualSVN Server by default. VisualSVN Server can be managed only by those users who are members of "VisualSVN Server Admins" and "Distributed COM Users" AD groups and by Local Administrators. I advise you to check these articles:

• "Remote Server Administration"

• "Configuring Remote Administration"

We all need to be local admins on this server for other reasons. The only thing I came up with is to create folder permissions on the directory in which the VisualSVN Admin tool is located to only allow execute permissions to the two admins.

Has anyone else had to deal with this? Are there any recommendations? I was really hoping to just configure users as admin or basic users in the VisualSVN admin tool.

Answer 1

Since you are a member of Local Administrators group on the server machine you can manage VisualSVN Server via VisualSVN Server Manager.

To prohibit administrative access you can set deny Full Control permission for a user or a group on the following directories:

• Repositories root ("C:\Repositories\" by default),
• %VISUALSVN_SERVER% ("C:\Program Files (x86)\VisualSVN Server\" by default).

Please note that Local Administrators group on servers have the ability to stop / start / restart services. So you may want to deny Full Control to VisualSVN Server service; you can do this via Group Policy Management Editor:

1. In the Group Policy Management Editor tree go to Computer Configuration | Policies | Security Settings | System Services.

2. In the details pane, double-click VisualSVN Server.

3. In the Properties window, select Define this policy setting, choose desired startup mode and click Edit Security....