What is the difference between AccessLevel 'Admin' and 'Cache' in NCache?

The 'Admin' level grants full control over the NCache cluster, including node management and configuration changes. The 'Cache' level restricts the user to data operations and management of a specifically assigned cache, following the security principle of least privilege.

What is the required format for the UserOrGroupDN parameter?

You must provide the full LDAP Distinguished Name (DN). Example for a user: 'CN=John Smith,OU=engineers,DC=company,DC=com'. Example for a group: 'CN=Dev,OU=engineers,DC=company,DC=com'.

Why are current AdminCredentials required to add a new user?

This is a standard privilege escalation protection. You must authenticate as an authorized NCache administrator to modify the security configuration, ensuring that only trusted personnel can grant access rights to other users.

Add-NCacheUserOrGroup

This PowerShell cmdlet is used to add a user or group or gMSA cache user (not for admin users) to the NCache security configuration. This configuration can be applied at the NCache server (node) level or to a specific cache. The cmdlet supports role-based access control by allowing users or groups to be assigned either Admin access for full cluster management or Cache-level permissions for cache-specific operations. The cmdlet requires parameters such as the server, access level, user or group name, full Distinguished Name (DN), domain controller, and administrative credentials. It validates the provided identity information against the domain controller, applies the necessary security metadata, and adds the user or group to the configuration. Optionally, security can be enabled automatically after successful execution, making this cmdlet essential for secure production deployments.

Important

Please note that you need to enable node security beforehand to execute this command successfully.

Add-NCacheUserOrGroup [-Server] -AccessLevel \
                      [-CacheName] -UserOrGroupName \
                      -UserOrGroupDN [-DomainController] \
                      [-DomainControllerPort] [-SecondaryDomainController] \
                      [-SecondaryDomainControllerPort] -NodeAdminCredentials \

Examples

This command adds the user David Watson as an NCache admin on the server with the IP address 20.200.20.11.

$nodeAdmin = Get-Credential \
Add-NCacheUserOrGroup -Server 20.200.20.11 \
-AccessLevel Admin  -NodeAdminCredentials $nodeAdmin \
-UserOrGroupName david_watson \
-UserOrGroupDN "CN=David Watson,OU=engineers,DC=example,DC=com" \
-DomainController domain_controller

This command adds the user David Watson as a cache user for the 'demoCache' cache hosted on the server with the IP address 20.200.20.11.

 $nodeAdmin = Get-Credential \
 Add-NCacheUserOrGroup -Server 20.200.20.11 \
-AccessLevel Cache -CacheName demoCache \
-NodeAdminCredentials $nodeAdmin -UserOrGroupName david_watson \
-UserOrGroupDN "CN=David Watson,OU=engineers,DC=example,DC=com" \
-DomainController domain_controller

The Add-NCacheUserOrGroup cmdlet also supports gMSA accounts (if the provided user name is a gMSA) where NCache queries LDAP to detect the account type and records it accordingly. The following command adds the gMSA cache user 'user1gmsa$' on the specified NCache server.

$nodeAdmin = Get-Credential \
Add-NCacheUserOrGroup -Server 20.200.20.11 \
-AccessLevel Cache -CacheName demoCache \
-NodeAdminCredentials $nodeAdmin -UserOrGroupName user1gmsa$ \
-UserOrGroupDN "CN=user1gmsa,CN=Managed Service Accounts,DC=example,DC=com" \
-DomainController domain_controller

This command adds a group named 'Dev' as an NCache admin group on the server with IP address 20.200.20.11.

$nodeAdmin = Get-Credential \
Add-NCacheUserOrGroup -Server 20.200.20.11 \
-AccessLevel Admin  -NodeAdminCredentials $nodeAdmin \
-UserOrGroupName Dev \
-UserOrGroupDN "CN=Dev,OU=engineers,DC=example,DC=com" \
-DomainController domain_controller

Properties

Note

The parameters with asterisk (*) on their names are the required parameters and the rest are optional.

Parameter	Data Type	Description
`-Server*`	`<string>`	Specifies the IP address of the NCache server to which the user or group is being added.
`-UserOrGroupName*`	`<string>`	Specifies the name of the user or group being added.
`-UserOrGroupDN*`	`<string>`	Specifies the Distinguished Name (DN) of the user or group being added. This DN uniquely identifies the user or group in the LDAP directory.
`-DomainControllerPort`	`<int>`	Specifies the port on which the domain controller is listening. The default port is `389`.
`-DomainController`	`<string>`	Specifies the IP address or hostname of the domain controller used to validate the user or group identity.
`-SecondaryDomainController`	`<string>`	Specifies the IP address or hostname of the secondary domain controller used to validate the user or group identity.
`-SecondaryDomainControllerPort`	`<int>`	Specifies the port on which the secondary domain controller is listening. The default port is `389`.
`-AccessLevel*`	`<string>`	Specifies the access level of the user or group being added. Valid values are `Admin` for an NCache administrator and `Cache` for a cache-specific user.
`-CacheName`	`<string>`	Specifies the name of the cache for which the user or group is being added. This parameter is required when `-AccessLevel` is set to `Cache`.
`-NodeAdminCredentials*`	`<pscredential>`	Specifies the credentials of a user with sufficient privileges to add a user or group to NCache.

Add-NCacheUserOrGroup

Important

Examples

Properties

Note

Contact Us