FYI-System Owner Changed to Standard User

[lthibx]

I am creating this post as an informational piece to other users who might have an issue where the management user who was a System Owner, suddenly reverted to a standard User, with no rights to administer the system. Having this issue, in my search I found this post: https://www.3cx.com/community/threads/system-owner-right-changed-to-user.119461/. But it is locked, I cannot add to it so I am creating this post and referencing that one.

I am just really getting started with 3CX as an MSP. I set up my own instance about 3 months again and yesterday began set up of an instance for my first client.
Got most all working as expected. I had created a new group, assigned users, assigned to a Queue, assigned DIDs, etc. All was well. I was / am the System Owner / Manager of the instance. but not I do not need to participate in calls as it is my clients organization. So after this initial setup, I decided to do a little cleanup. I removed myself from the new group I had created and since I wasn't using the DEFAULT group, I removed everyone including myself from that group as well. Then I deleted the DEFAULT group. Almost immediately I noticed I no longer had the Admin tab in the Web Client, then had to revert to using the Management Console, I discovered that my Extension / User now was assigned standard User rights, not System Owner. Long story short it seems you must be part of a group in order to be System Owner. Scrambling to find how to regain access, I found the community post listed above, and answers & suggestions posted by @JohnS_3CX and @SweetAction provided the answers I needed to resolve my issue and regain System Ownership. I tried the suggestions of attempting to access the system thru port 5001 or 443, but I did not have access to the Root Credentials tab. It was suggested to take a backup and download it to my local drive, unzip and view the .xml file that is in the root of that folder. In that file I found the credentials for the root user (not OS, but 3CX), and using that I was able to log in to the PBX, change my own user back to a System Owner, re-logged in to the Web client with my extension and I now regained the Admin tab and had rights again to administer the system. Seems that you cannot actually remove the DEFAULT group (seems that the system recreated it). After logging in with the root user, I put myself in that group. No calls should route thru that group.

So I wanted to say thanks to @JohnS_3CX and @SweetAction for providing the information I needed to regain access.

Hopefully my post here will assist others as well.

Thanks
LThibx

 

[leejor]

Is there no warning (Are you SURE you wish to delete this group, this action is not recommended, and may result in blocking Admin access to...) when attempting to delete the Default group? I should think that should be a bare minimum to prevent this from happening, warning of the consequences if you choose to do so

...or just block someone from doing this to begin with.

 

[SteveITS]

Interesting situation and glad you found a solution. FWIW the system owner does not have to be in the DEFAULT group; all the ones I created I put in a system owner group and removed from DEFAULT.

Programming is like some sort of weird Darwinism…someone always comes along and does something the programmer never even considered. . Over time the program gets better though!

 

[lthibx]

Hey guys,
Yea, there was no warning about removing the DEFAULT group. Just removed myself and then deleted the group. Don't find any documentation about that kind of stuff. But apparently in the background it either didn't really get deleted or it was rebuilt immediately. In all of what I had read someone said that you had to be part of at least one group, but I do agree...why??? I just want to manage the system. Yea, and I used to be a developer...code is created by humans, so it is imperfect...there is always a flaw...and AI builds upon that...all I want to know is...where is John Conner?

 

[JohnS_3CX]

Yea, there was no warning about removing the DEFAULT group.

- What version of 3CX were you using?
- Are you 100% certain you actually deleted DEFAULT?


The "X" on DEFAULT is greyed out - this prevents even the Root Admin from deleting it - even if you had renamed it to something else.

 

[lthibx]

- What version of 3CX were you using?
- Are you 100% certain you actually deleted DEFAULT?

View attachment 35657
The "X" on DEFAULT is greyed out - this prevents even the Root Admin from deleting it - even if you had renamed it to something else.

Hi @JohnS_3CX. I am on version 18.0 Update 7 (Build 312). I am pretty sure that I deleted the DEFAULT group. There may a possibility that I am mistaken, but it seems that was the process I went thru. Trying to go thru things slowly and documenting most configuration changes. I know absoulutely I removed myself from that group, and I remember thinking that...well I don't really need this group as I had created another. I can see in your screenshot and in my own instance the x on the Default group is greyed. On my end, though, I do have myself only in that group. Again, I may be mistaken, and sorry if I am posting about a situation that may not have happened (at least partially).

And to @SteveITS and @leejor. Appreciate your feedback as well. Maybe later I will create another instance and before I go to far with the configuration, I will walk thru that process again. Currently I am trying to get this instance complete and set up at the customer, hopefully by the end of the week. Though there seem to be another issue that may be a roadblock. Posted here: https://www.3cx.com/community/threads/setting-line-keys-on-fanvil-x4u-x3u.120865/

So bottom line, I don't have to have myself in the Default group (or any group) to manage the system?

 

[SteveITS]

Sounds like the system owner extension has to be in a group but I know it doesn’t need to be in DEFAULT.

 

[JohnS_3CX]

Ok had to ask just to be sure because that is not something that should be doable and we would have to address it if it was the case

Some clarifications:

• Root Admin: not an extension, but rather an account that can only log into the management console and has the full rights everywhere.

• System Owner: an extension that has the maximum possible possible rights on all user groups
  https://www.3cx.com/docs/manual/setup-team/#h.1if4s4rqfsjg
  By the way you can have more than one system owner if you wish, and so long as you are a system owner in at least one group, you should be ok. Just keep in mind that you need to put yourself inside of a group if you want to see their calls and perform actions on the live calls.

So while you could lose your extension rights if you changed them, the root admin account can always revert that for you.