How to Manage Users and Roles

Last updated 27 July 2026

How to Manage Users and Roles

Create, edit, and delete user accounts on a Brainsalt server. Assign one of three roles to control what each person can see and do in the System Management web interface.

[USER-ACTION-REQUIRED: Attach a screenshot of the Access page (Users table and Add user form) here]

Before you start

  • You are signed in to the server's System Management web interface with an Administrator account. Only Administrators can manage users.
  • If this is a new server, the default administrator account is ADMIN with password ADMIN2!!. Change this password immediately after first sign-in.

Steps

1. Open the Access page

In the System Management sidebar, under Configure, select Access. The page shows the current user list, the add-user form, and several related settings (services, BMC sync, VNC password, front-panel access code).

2. Create a new user

Scroll to the Add user section. Enter a username (4–16 characters; letters, digits, .-_ only), a password that meets the password policy, and pick a role from the dropdown. Click Add. The new user appears in the table immediately.

Usernames are case-sensitive.Operator and operator are two different accounts. This matches how the server's BMC hardware stores usernames.

3. Change a user’s role

In the Users table, find the user and change their Role dropdown. The change takes effect immediately. The user’s active sessions are terminated, so they will need to sign in again.

4. Reset a user’s password

Click Reset password next to the user. A dialog asks for the new password. The new password must meet the password policy. The user’s active sessions are terminated.

5. Delete a user

Click Delete next to the user and confirm. The user is removed and their active sessions are terminated. You cannot delete the last remaining Administrator — at least one must always exist.

Roles explained

Every user has exactly one role. Roles are ranked: each higher role inherits all permissions of the ones below it.

Role

Can do

Typical use

User

Read and monitor only: Overview, GPU Status, Resource Usage, Storage, Hardware (read-only), Logs, Notes, Web Consoles.

Monitoring dashboards, read-only status checks.

Operator

Everything a User can do, plus operate: File Transfer, Applications start/stop, Power actions (shutdown, restart), Remote UIs.

Day-to-day show operation and content loading.

Administrator

Everything, including all Configure pages (Access, Network, GPU, Settings, Backup & Restore, Hardware Baseline, Notes) and VNC screen control.

System integrators, IT administrators, initial setup.

Options explained

Setting

Description

Values / Range

Username

The account name used to sign in. Case-sensitive. Cannot be changed after creation.

4–16 characters: letters, digits, .-_

Password

The account password. Must include at least one digit and at least one special (non-alphanumeric) character.

8–16 characters

Role

Determines what the user can see and do. Can be changed at any time from the Users table.

USEROPERATORADMINISTRATOR

Reset password

Sets a new password for an existing user. Terminates all of the user’s active sessions.

Button (per user)

Delete

Permanently removes the user account. Blocked if this is the last Administrator.

Button (per user)

Keep BMC users synchronized

When enabled, user accounts are automatically mirrored to the server’s BMC over IPMI. The same credentials then work for BMC access.

Checkbox

Update BMC now

Immediately pushes all current user accounts to the BMC, without waiting for the next automatic sync.

Button

Password policy

All passwords — at creation and on reset — must meet these requirements:

  • 8 to 16 characters long

  • At least one digit (0–9)

  • At least one special character (any character that is not a letter or digit)

The 16-character maximum exists because passwords are synchronized to the BMC, which stores them as 16 bytes via IPMI.

Common Mistakes

  • "Cannot delete the last administrator" — The system requires at least one Administrator at all times. To remove the current admin, create a second Administrator account first, then delete the original.

  • "Cannot demote the last administrator" — Same rule applies to role changes. You cannot change the last Administrator to Operator or User. Promote another user to Administrator first.

  • Login fails after a role change or password reset — Both actions terminate the affected user’s active sessions. This is expected. The user needs to sign in again with their (new) credentials.

  • Username case mismatch — Usernames are case-sensitive. If a user types admin instead of ADMIN, the login will fail. Verify the exact case used when the account was created.

  • "Maximum number of users reached" — The server supports a maximum of 15 user accounts. Delete unused accounts to free a slot.

Tips

  • Change the default ADMIN password as your first step on a new server. The system shows a security warning on every session until you do.

  • If all Administrator accounts are accidentally deleted or corrupted, the system self-heals by recreating the default ADMIN account with the factory password on next service start. You will not be permanently locked out.

  • Enable Keep BMC users synchronized so operators can sign into the BMC with the same credentials they use for the web interface. The sync runs automatically at startup and whenever a user is added, changed, or deleted.

  • Use the Operator role for show-operations staff who need to start/stop applications, transfer files, and control power — but should not change network, GPU, or user settings.

  • The Access page also lets you set minimum privilege levels for individual services (File Transfer, VNC, Remote UI). Use these to further restrict who can access specific features, independent of their role.

How to Sign In to a Server for the First Time — Reach a server, trust its certificate, sign in with the default administrator, and change the default password.