text: <s>[INST] FTAC Users, local directory. We want to grant access to tech for them to only read the logic (Studio 5K) and not to edit. We crate a windows acc just for them and another for the administrator. On FactoryTalk Administration Consoles, local directory, we create the Maintenance user group with read rights only, and as users: the Maintenance windows acc and the administrator windows acc. Maintenance windows acc was assigned to the Maintenance user group while the administrator windows acc to the Administrator & Windows administrator user groups. On Local (this computer)/security, the All user users was deleted and the administrator windows acc was added. The same for the policies and networks and devices. After rebooting the system (Windows Pro10), the read only on Maintenance acc works but also on the administrator acc. Both accounts can't edit the logics. How can we make the administrator acc to be able to edit the logic and keep the Maintenance acc on read only? [/INST] Check to make sure that the user is not a member of any groups that may have Deny checked for permissions. Deny permissions have priority over Allow permissions, so if a user is a member of multiple groups, one of the groups may have some security permissions that are checked as Deny that are being inherited at the user level. To check inherited permissions, make sure that the specific user that is having issues is in or added to the Users folder in FactoryTalk Security, and use the Effective Permissions tab in the Security Settings window. This should show you what actual permissions are being inherited by the specific user.\n </s>