To everyone’s surprise all users were flagged up as Administrators based on the assigned capabilities in the last couple Cognos Analytics license audits I was part of, so I’d thought I’d write this up.

It’s as easy (or as obscure) as 1,2,3:

1. An obscure Specification Execution capability is treated as an Administrator-level capability although it’s not under Administration group of capabilities:

Specification Execution

This secured function allows a user or Software Development Kit application to use an inline specification. The Specification Execution secured function is counted as an Analytics Administrators licence role.

2. A built-in Cognos Role called Data Manager Authors is granted access to this capability by default.
3. Data Manager Authors includes All Authenticated Users role by default

Hey presto, All Authenticated Users are counted as Administrators.

I doubt it’s intentional, more likely that this capability was required to run the Data Manager ETL jobs and this setup was never removed, even though Data Manager is long gone (I did like it, btw, a very simple tool). But nonetheless: please check your capability assigments and disable all the roles you don’t use (like this Data Manager Users) to make your audits boring.

While we’re at it, the built-in License usage report report is very usefull, bearing in mind that:

• it records the user license based on the capabilities based on the time they last logged in, so capabilities adjustment wouldn’t be reflected in this report untill users re-login
• if a user is no longer active – the only way to reset the license count is to remove their user profile from Cognos Analytics, which will remove all personal objects / schedules
• whispers content_store.CMOBJPROPS33