Skip to main content
tiCrypt 2.18.1

Groups and Access Control

A VM group is a set of users inside a running virtual machine, and an access directory is a folder whose contents are governed by an access control list. Groups say who people are; access directories say what those people can reach. Together they are how a VM Owner subdivides a machine so that several people can work on it without all seeing the same data.

An access directory is not a separate kind of storage. It is an ACL applied to a directory on a read-write drive, scoping which users and groups on the VM can read or write inside it. The data stays where it is; what changes is who can reach it.

Why groups exist alongside VM roles​

Roles decide authority; groups decide reach. A VM role (Owner, Co-owner, Manager, User) determines what someone can administer. It does not by itself determine which files they can open. A user with the plain User role has access governed entirely by their group membership and the access directories configured on the machine.

This is how one machine serves several collaborators. Without groups, sharing a VM would mean sharing everything mounted on it. Access directories let an Owner give a statistician the de-identified extract and nothing else, on the same machine, without provisioning a second VM and a second copy of the data.

Access control list templates make the arrangement repeatable. A template is a named set of permissions that you assign to users and groups on an access directory, so the same permissions are applied the same way everywhere. A template can be imported from the same or another VM rather than rebuilt by hand.

Before you begin​

  • The VM is running and you are its Owner, or a Co-owner or Manager with group permissions.
  • The users you intend to add already exist in the VM. See VM User Management.

Create a Group in a Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to create a VM group.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Groups section in the left panel.
  6. Click the Create group button in the top right panel.
  7. In the Create a new group on vm-name pop-up, enter the group name.
  8. Click Create group.
Result:

tiCrypt shows "Created group" and the group appears in the Groups table with no members.

note
  • Create group is offered to Managers, Co-owners, and the Owner.
  • The name can be up to 32 characters. It must start with a letter or underscore, and may contain letters, numbers, hyphens, underscores, and periods.
  • The name cannot match an existing group name on the VM's operating system, regardless of case ("Conflicts with another group").
  • The prompt warns that "Currently, VMs do not support editing group names after creation." To change a name, create a new group.

View Groups in a Virtual Machine​

Location: Virtual Machines > VMs > select the virtual machine > VM Settings and Details > Groups

The Groups table has the columns Name, Created, Updated, Members, and Access Directories. Click a group's name to open its detail page, which lists its members with the columns Name, Account Name, Profile, Role, and Actions, and a Filter users... search box.

Every VM has three built-in groups: Everybody, Nobody, and Managers. They cannot be edited or deleted, so Edit membership and the delete actions are not offered for them.

To remove a member on the group's detail page, click Remove in the member's row. In the Delete member-name (from group-name)? prompt, click Remove User(s). Removing someone from a group does not remove them from the VM.

Delete a Group in a Virtual Machine​

Deleting a VM group is irreversible. To undo it, you create a new group and set up its membership and filesystem access from scratch.

Location: Virtual Machines > VMs > select the virtual machine > VM Settings and Details > Groups

  1. Click the name of the group to open its detail page.
  2. Click Delete in the top right panel.
  3. In the Delete group-name (on vm-name)? prompt, read the alert, then type Delete followed by the group name, for example Delete analysts, in the Type to Confirm field. Matching is case-sensitive.
  4. Click Delete followed by the group name.
Result:

The group is removed from the VM and from the Groups table.

Deleting a group leaves stale permission tags

The prompt warns that deleting a VM group removes the group information and takes away its members' access to the associated resources, but leaves invalid permission and ownership tags behind.

Sync Multiple Groups in a Virtual Machine​

bulk-action

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to sync its VM groups.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Groups section in the left panel.
  6. Click the Sync all groups button in the top right panel.
note

Syncing groups created by other admins helps you configure VM access for multiple users at once.

Add Members to a Virtual Machine Group​

bulk-action

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose group you want to add members to.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Groups section in the left panel.
  6. Select the existing group to add new members.
  7. Click the Open full menu button in the top right panel.
  8. Select Edit membership.
  9. In the Edit membership of group-name prompt, enter the user names to add to the group.
  10. Click Update membership.
Result:

The new members appear on the group's detail page. If you did not change anything, tiCrypt shows "No changes made".

info
  • You can only add members who belong to the virtual machine.
  • Edit membership is offered when you select a single group that is not built in.
tip

If you accidentally add a user to the virtual machine group in the prompt, click Undo add next to the user before you click Update membership.

Remove Members from a Virtual Machine Group​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose group you want to remove members from.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Groups section in the left panel.
  6. Select the existing group to remove its members.
  7. Click the Open full menu button in the top right panel.
  8. Select Edit membership.
  9. In the prompt, click Delete next to the user names you want to remove.
  10. Click Update membership.
caution

Removing a user from a virtual machine group does not revoke their access to the virtual machine.

Open Access Control List Templates in a Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose access control list templates you want to view.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. View the access control list templates.
note
  • The Access Control List templates section appears only on Windows virtual machines whose controller provides the settings service.
  • The table has the columns Name, Built-in, Access Directories, Description, and Permissions. Built-in templates (Read-write, Read-only, and Full control) cannot be edited or deleted.
  • Add ACL template, Edit, Replace ACL template, and Delete ACL template are offered to Managers, Co-owners, and the Owner.

Create an Access Control List Template in a Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine for which you want to create access control list templates.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Click the Add ACL template button in the top right panel.
  7. In the Create ACL template pop-up, enter the ACL name and optional description.
  8. Select the appropriate permissions.
  9. Click Create.
Result:

tiCrypt shows "ACL template created" and the template can be chosen in the ACL template field of an access directory.

The following table describes the fields of the Create ACL template prompt.

FieldDescription
NameUp to 80 characters. It cannot contain slashes, backslashes, pipes, double quotes, colons, asterisks, question marks, angle brackets, or curly braces, and must differ from the VM's other ACL template names.
Description (optional)Up to 250 characters.
PermissionsThe Windows permissions the template grants: Inherit permissions, Full access, Read & execute, Write, Read, Delete, Modify, Traverse folder/Execute file, List folder/Read data, Read attributes, Read extended attributes, Create files/Write data, Create folders/Append data, Write attributes, Write extended attributes, Read permissions, Change permissions, and Take ownership.

A template is identified by its set of permissions, so two templates cannot grant the same set. If the set you tick matches an existing template, a built-in one included, the prompt shows "Profile with same permissions already exists."

Import an Access Control List Template from an Existing Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine for which you want to import access control list templates.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Click the Add ACL template button in the top right panel.
  7. In the pop-up, tick Import templates from same or other VM.
  8. Next, select an existing ACL template from the Existing ACL Templates list.
  9. Update the ACL name, description and permissions.
  10. Click Create.
note
  • Importing an ACL template helps you create similar templates quickly.
  • Existing ACL Templates lists the templates of your running Windows virtual machines only. Selecting one fills in the form; the new template is created on the current VM.

Edit an Access Control List Template in a Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose access control list templates you want to edit.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Select the access control list template to edit.
  7. Click the Open full menu button in the top right panel.
  8. Select Edit.
  9. In the Edit ACL template template-name pop-up, edit the access control list template name and optional description.
  10. Click Update.
Result:

tiCrypt shows "ACL template updated".

View Details of Access Control List Templates in a Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose access control list templates you want to view.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Find the access control list template to view.
  7. Click the access control list template name to open its details.
  8. In the new window, view the name, description and built-in status of the access control list template.

Refresh Details of Access Control List Templates in a Virtual Machine​

bulk-action

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose access control list templates you want to refresh.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Find the access control list template to refresh.
  7. Click the access control list template name to open its details.
  8. In the new window, click the Refresh button in the top right panel.

Replace Access Control List Templates in Virtual Machines​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose access control list templates you want to replace.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Select the access control list template you want to replace.
  7. Click the Open full menu button in the top right panel.
  8. Select Replace ACL template.
  9. In the Select an ACL template to replace template-name with prompt, select the ACL template to replace it with.
  10. Click Replace.
Result:

The task Replace old-template with new-template updates every access directory that used the old template for a group.

note
  • Replacing ACL templates changes permissions consistently across all access directories using that ACL template. This helps you make changes at scale.
  • Replace finds access directories through their group entries. In each access directory where a group entry uses the template, every entry using it, user entries included, is switched to the new template. An access directory where only user entries use the template is not changed. If no access directory has a group entry using the template, tiCrypt shows "No access directories found using template" followed by the template name.
  • In the table you can replace a built-in template as well. The detail page of a built-in template does not offer Replace ACL template.

Delete Access Control List Templates in a Virtual Machine​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine whose access control list templates you want to delete.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Control List templates section in the left panel.
  6. Select the access control list template to delete.
  7. Click the Open full menu button in the top right panel.
  8. Select Delete ACL template.
  9. In the prompt, type "Delete" followed by the name of the access control list.
  10. Click Delete followed by the name of the access control list.
note

You cannot delete a template that an access directory uses for a group. tiCrypt refuses with "Cannot delete ACL template template-name because it is used by" followed by the access directories. Replace the template in those access directories first.

View an Access Directory for a Virtual Machine Group​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to view the access directory.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Click the name of the access directory to view.
  7. In the new window, view the access directory's basic information and access information.
Result:

The detail page shows Basic info (Home, Location, Path from root, Created on, and Last modified on) and Access info (the Owner, then each user and each group with the ACL template they have, for example "user-name has permissions Read-write").

The Access Directories table has the columns Name, Type (User home or Regular), Drive, Path, Owner, Users And Permissions, Groups And Permissions, Created, and Updated. User homes are created and managed by the VM controller; you cannot edit or delete them.

Confirmations, Errors & Solutions
Access Directories Section Missing in Virtual Machine

The Access Directories section does not appear in the VM Settings and Details window.

Ask Access Directories Permissions from VM Owner

Ask the VM owner to allow you to open the VM access directories. The VM Settings and Details option itself only appears for Managers, Co-owners, and the Owner of the VM.



To Virtual Machine Owner
To grant VM users permissions to VM access directories:  
  1. In the VMs section, click the virtual machine where you want to update a user's access directory permissions.
  2. Click the VM Settings and Details option in the bottom center.
  3. In the new window, select the Users section in the left panel.
  4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
  5. Select Edit user access.
  6. In the pop-up, set the profile to Custom.
  7. Scroll down under Permissions, and tick Access Directories.
  8. Click Save.
Failed to Look Up Drive in Access Directory

Failed to look up drive name: insufficient permissions: drives:list: missing permission: {PermDrives}

Ask Drive Permissions from Your Admin

Ask the VM owner to allow you to view drives.



To Virtual Machine Owner
To grant VM users permission to view VM drives:  
  1. In the VMs section, click the virtual machine where you want to update a user's drive permissions.
  2. Click the VM Settings and Details option in the bottom center.
  3. In the new window, select the Users section in the left panel.
  4. Next, select the appropriate user, then click the Open full menu button in the top-right panel.
  5. Select Edit user access.
  6. In the pop-up, set the profile to Custom and the role to Manager.
  7. Scroll down under Permissions, and tick Drives List, format, mount, and unmount drives.
  8. Click Save.

Refresh Access Directory Data for a Virtual Machine Group​

bulk-action

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to view the access directory.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Click the name of the access directory whose data you want to refresh.
  7. In the new window, click the Refresh button in the top right panel.

Create an Access Directory for a Virtual Machine Group​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to create an access directory in.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Click Create access directory in the top right panel.
  7. In the prompt, select the access directory location.
  8. Next, enter the directory name and owner.
  9. Optionally, for Windows and Linux OS, enter the user and group permissions associated with the access control list.
  10. Click Create.
Result:

tiCrypt shows "Created access directory" and the directory appears in the Access Directories table as a Regular access directory.

info

To create a new group for the access directory from scratch, click the Create a group button in the prompt.

The following table describes the fields of the Create Access Directory on vm-name prompt. The prompt opens with the reminder "Nesting access directories is supported but might result in conflicting permissions. Proceed with caution."

FieldDescription
DirectoryThe folder the access directory governs. Selecting it fills in Name. This field appears only when you create an access directory from this section.
NameUp to 80 characters. It cannot contain slashes, backslashes, pipes, quotes, colons, asterisks, question marks, angle brackets, or curly braces, and must differ from the VM's other access directory names.
OwnerThe VM user who owns the directory. Required ("You must select an owner"). The owner always has every permission on it.
UsersOne row per user, each with a User and an ACL template. Click Add a new user permission to add a row.
GroupsOne row per VM group, each with a Group and an ACL template. Click Add a new group permission to add a row.

On a Linux VM the ACL template list offers Read-only, Read-write, and Traverse only. On a Windows VM it offers Read-write, Read-only, Full control, and the VM's own ACL templates.

The form refuses a user or a group listed twice ("User is used more than once", "Group is used more than once"), a row without a user or group ("User is not set", "Group is not set"), and a row without a template ("ACL template not selected"). If you click Create while any of these remain, tiCrypt shows "The form contains errors".

Make an access directory from the File Explorer​

You can also turn a folder into an access directory while you browse the VM's files.

  1. Open the VM's File Explorer. See File Operations.
  2. In the folder tree, right-click the folder.
  3. Select Make access directory.
  4. Complete the Name, Owner, Users, and Groups fields as described above, then click Create.
Result:

The folder becomes an access directory and appears in the Access Directories table.

Make access directory is not offered for a folder that is already an access directory or lies inside one. On a drive created with No permission management enabled, tiCrypt refuses with "Drive drive-name marked as raw, cannot create access directory".

Confirmations, Errors & Solutions
Created Access Directory Successfully

Created access directory.

Failed to Enter Access Directory Name

You must enter a name.

Enter Access Directory Name

Enter the access directory name in the Name field.

Failed to Select an Access Directory Owner

You must select an owner.

Select an Access Directory Owner

Under the Owner field, select an access directory owner.

Failed to Select an ACL Template

You must select a ACL template.

Select an ACL Template

For each entry under Users and Groups, select an option in the ACL template field.

Failed to Create Access Directory

Failed to create access directory: [restricted-action]: action is restricted: accessDirectories:create.

Choose a Different Location for the Access Directory

restricted-action means the location you selected is not allowed. It is a problem with the location on the drive you selected rather than with your permissions.



On the VM's home drive, an access directory cannot be created at the root of the drive or inside a .ticrypt directory. Select a subdirectory of the home drive, or a directory on another drive.

Sync All Permissions for Access Directories in a Virtual Machine​

bulk-action

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to sync its access directory permissions.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Click Sync all permissions in the top right panel.
Result:

The task Sync permissions for followed by the VM name asks the VM to re-apply the permissions of every access directory on all of its drives. This is the same operation as Sync user permissions in the VM's menu. Use it when the files in an access directory do not reflect the users, groups, and templates the access directory lists.

note

Create access directory, Edit access directory, Remove access directory, and Sync all permissions are offered to Managers, Co-owners, and the Owner. The Access Directories section itself requires the Access Directories permission.

Confirmations, Errors & Solutions
Synced All Permissions Successfully

Sync permissions for vm-name (total-syncing-time).

Edit an Access Directory for a Virtual Machine Group​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to edit its access directory.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Select the access directory to edit, then click the Open full menu button in the top right panel.
  7. Select Edit access directory.
  8. In the Edit access directory access-directory-name prompt, update the directory name and owner. The directory itself cannot be changed.
  9. Optionally, for Windows and Linux OS, enter the user and group permissions associated with the access control list.
  10. Click Update.
note

You cannot edit your Home access directory.

Confirmations, Errors & Solutions
Updated Access Directory Successfully

Update access directory access-directory-name (total-updating-time).

Delete an Access Directory for a Virtual Machine Group​

Method One​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to delete its access directory.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Select the access directory you want to delete.
  7. Click the Open full menu button in the top right panel.
  8. Select Remove access directory.

Method Two​

  1. Go to the Virtual Machines icon in the top left taskbar.
  2. Click the VMs section on the top left panel.
  3. In the left panel, click the virtual machine to delete its access directory.
  4. Click the VM Settings and Details option in the bottom center.
  5. In the new window, click the Access Directories section in the left panel.
  6. Find the access directory you want to delete.
  7. Click the access directory name to open its details.
  8. In the new window, click Delete in the top right panel.
  9. In the Delete access-directory-name? pop-up, click Delete access directory.
Result:

The access directory is removed from the Access Directories table. The folder and its files stay on the drive.

caution

When you delete an access directory, all its members lose access to it until you create another access directory. You cannot delete your Home access directory: tiCrypt shows "You cannot manually edit or delete user homes (they are managed automatically by the VM controller)".

Confirmations, Errors & Solutions
Deleted Access Directories Successfully

Delete total-number-of-access-directories access directories (total-deletion-time).