> For the complete documentation index, see [llms.txt](https://docs.patchmypc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.patchmypc.com/patch-my-pc-publisher/remote-ui/technical-references/access-permissions-reference.md). # Access and Permissions Reference for Patch My PC Publisher *Applies to: Patch My PC Publisher V3.x* {% hint style="danger" %} **PRE-RELEASE DOCUMENTATION** This documentation is for a pre-release feature still under development and, therefore, incomplete. As a result, both functionality and documentation are subject to change. Once this feature is released, it will be announced, and this banner will be removed. {% endhint %} Access to Patch My PC (PMPC) Publisher is controlled by both: * Your Windows account * The local groups on the server running the Publisher **PatchMyPCService**. There is no separate Publisher login and no per-user password to manage. You grant someone access by adding their account (or a domain group they belong to) to the relevant group(s) on the server. ## How it works * When you connect, Windows proves who you are. The **PatchMyPCService** then looks at which of its groups your account belongs to and grants the matching capabilities. * Publisher automatically creates a series of local groups (all beginning with **PatchMyPC-**.) on the server the first time the **PatchMyPCService** starts. {% hint style="danger" %} **Important** The **PatchMyPC-\*** groups are created without any members except for the access that local administrators already have. Until you add members, only server administrators can manage the Publisher. {% endhint %} * To grant access, an administrator adds a user or a domain group to one of those groups on the server. Nested domain groups are honored, so adding an AD group works, and its members inherit the access. * Local administrators on the server automatically have full access to everything. ### Groups and Access Add a user or domain group to the group that matches the access you want to delegate.
Server groupGrantsTypical use
Built-in AdministratorsEverythingServer administrators - full control.
PatchMyPC-AdministratorEverything (same as a local administrator, for the Publisher).Delegate full Publisher control without granting server administrator rights.
PatchMyPC-ReaderRead-only view of every area.Auditors or staff who should see configuration but change nothing.
PatchMyPC-Wsus-Read
PatchMyPC-Wsus-Write		View/manage WSUS updates and settings.WSUS owners.
PatchMyPC-ConfigMgr-Read
PatchMyPC-ConfigMgr-Write		View/manage ConfigMgr (SCCM) applications and settings.ConfigMgr owners.
PatchMyPC-Intune-Read
PatchMyPC-Intune-Write		View/manage Intune applications and settings.Intune owners.
PatchMyPC-Certificate-WriteView and manage code-signing and certificate configuration.Whoever manages signing.
PatchMyPC-CloudConnection-WriteView and manage the Patch My PC Cloud connection.Whoever manages the Cloud link.
PatchMyPC-CoreSettings-WriteView and manage core, global service settings.Senior Publisher administrators.
PatchMyPC-ServiceAction-WriteView and trigger service actions such as sync and publish.Operators who run syncs and publishes.
PatchMyPC-StagedContent-Read
PatchMyPC-StagedContent-ReadWrite		List/upload and delete files in the service content repository.Advanced content management.
{% hint style="info" %} **Note** A **Write** group always includes the matching **Read** access. If someone needs both read and write in an area, put them in the **-Write** group only. You do not need to add them to the **-Read** group. {% endhint %} ## Granting access To delegate access to a user: 1. On the server, open **Computer Management | Local Users and Groups | Groups** (or use your usual group management tooling). 2. Find the **PatchMyPC-\*** group for the access you want to grant. 3. Add the user, or domain group whose membership is managed centrally. {% hint style="success" %} **Tip** To ease maintenance, we recommend using domain groups. In this way, you only need to maintain membership of the relevant groups to control access without needing to access the server. {% endhint %} 4. The change takes effect the next time the user connects. Users can [confirm their access](#confirming-access). ## Confirming access Clicking the *Show Granted Permissions Shield* (![Show Granted Permissions Shield](/files/ZqNujkCNt66qNAGpGvad)) at the bottom of the Publisher opens the read-only **Permissions** screen showing a list of every Publisher permission and whether the signed-in user has been granted it, evaluated against the server the user is connected to. This feature works the same for local and remote Settings consoles.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.patchmypc.com/patch-my-pc-publisher/remote-ui/technical-references/access-permissions-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.