This is an earlier version. The current manual is v7.5.0.
3 Account Management
User accounts in MOST™ are created by administrative action. For NextStep-integrated organizations these accounts are managed by NextStep and the instructions in this section do not apply.
3.1 Using an Account
Each account must be activated by the owner. Once the account is activated (and a password has been set) the user will be able to log in.
3.1.1 Activation
Once an account is created an activation email will be sent to the new user’s email address. The new user must activate his or her new account by:
- Click on the link inside the activation email.
This must be done within 10 days of its creation. The user will be prompted to set their password during the activation process.
3.1.2 Expired Activation
If a user fails to activate their account within 10 days then the link provided in the invitation email will no longer work. A new activation invitation can be generated by a user admin for the organization by:
If necessary, click on the Menu link (
)Click on the Users button from the Menu page.
Click on the Email icon (
) beside the user to whom the invitation email is to be sent.
3.1.3 Forgotten Passwords
In the case of a forgotten password there are two ways to have the password reset. Both methods result in an email being sent to the user’s email address. The email contains a link that allows the user to choose a new password. The email can be generated by the user:
- At the login screen, click the Forgot Password link.
The email can also be generated by an organization administrator:
If necessary, click on the Menu link(
)Click on the Users button from the Menu page.
Click on the Email icon (
) beside the user to whom the invitation email is to be sent.
3.1.4 Confirmation code
If a user exceeds the maximum number of unsuccessful login attempts, the user will be presented with a unique, computer generated CAPTCHA code. The user must enter that code successfully along with the username and password.
3.1.5 Logging Out
Users will be automatically logged out after 15 minutes of inactivity. When a user is finished using MOST™ for a period of time, it is recommended that they click the Logout link (
) in the upper right corner of the screen. This will prevent anyone else who has access to the computer from gaining access to their account.
3.2 Creating and Managing Accounts
Only users with account management privileges can create all user accounts. Users with account management privileges include:
Organization admins (for organizations using the traditional permissions model)
User admins (for organizations using the CompliaTrac permissions model)
See section Listing Screens below for information on working with features common to many listing screens. The user listing screen is launched by:
If necessary, click on the Menu link (
)Click on the Users button from the Menu page.
General restrictions on creating and modifying accounts:
The owner of each account will need to be added as a person prior to having their account created.
Each account must have a valid, unique email address.
The username must be unique and cannot be easily changed once set.
3.2.1 Permission Options for Traditional Permissions Model
Organizations that use the traditional permissions model can set permissions for accounts as follows:
Assigning full organization admin rights will automatically provide all other rights. For non-organization admins the remaining rights can be granted or revoked individually. The screenshot above predates two rights added in v7.0, which appear with the others:
Give user rights to view activity log and run tamper report
Give user rights to set policy document values and choose policy chapters
3.2.2 Permission Options for CompliaTrac Permissions Model
In the CompliaTrac permissions model accounts are designated mutually exclusively as user admin accounts or auditing accounts. Once the account type has been set it cannot be changed. User admins are also, by default, list admins. Either kind of account can also be given question, list, log and policy admin rights; only an auditing account can be given report admin. The permissions screen for an audit user looks like this:
3.3 Searching the Activity Log
MOST™ maintains a detailed accounting log of who does what (and when). Viewing this detailed activity log is available to:
Organization admins (for organizations using the traditional permissions model)
User admins (for organizations using the CompliaTrac permissions model)
Any user given the right to view the activity log and run the tamper report (log admin), in either model
See section Listing Screens below for information on working with features common to many listing screens. The Activity Log Screen is launched by:
If necessary, click on the Menu link (
)Click on the Activity Log button from the Menu page.
The Activity Log Screen provides detailed information about many actions taken in the system down to the level of the time over every answer made in every audit (and who entered the answer). The log cannot be altered as it represents actions that have happened in the past. The logs take up quite a bit of space so they may be periodically archived securely off site. If archived logs are needed they can be retrieved by sending a request to help@mostaccess.com.
There are a variety of filters that can be applied to identify areas of interest:
Start and Stop Date These default to the previous six months. They can be narrowed or widened as needed to isolate a time frame of interest. All dates and times are provided in the time zone of your organization.
User Filter This can be applied to see only actions taken by a particular user.
Log Type Filter This filter is applied to categories of actions (like adding ribbons, or answering a question).
Audit Filter This filter intelligently identifies all actions taken on the selected audit including header changes, ribbon changes, and question-level data.
Search Filter This filter is used to apply a case-sensitive search string to any data logged by the system.
As with other listing screen the data can be sorted by any column.
3.3.1 Log Tampering Features
Each entry in the activity log carries an error detecting code calculated from the entry itself and from the entry before it, so an entry that is changed, removed, or inserted from outside the application breaks the codes from that point on. Once a day a copy of the latest code is saved outside the database, where it cannot be changed or deleted. Any entry that has been modified has a conspicuous error indicator on this screen, as shown here:
The “Tamper Report” button checks every entry in the log, compares the log with the saved copies, and reports any entries that were modified, removed, or inserted. The number of entries in the activity log can be large so it may take some time for the report to complete. It is unexpected for the report to indicate any findings. For that reason, a non-clean report should be reported to help@mostaccess.com.