Symantec Management Platform (Notification Server)

My NS 7 system has a parent domain with multiple children domains.  How do I grant an user/group custom access to an orgainziational group?  I would like a user to have read access to all of one child domain.  Thanks for any input.

Are you talking AD domains?  e.g. company.com, ex1.company.com, ex2.company.com, ex3.company.com, ex4.company.com?  Are you already syncing with AD?

Yes, the active directory domains show as organizational groups in Altiris.

I have created a test security role and added an active directory user as a member.  Then I right clicked on the appropriate organizational group and selected "manage security".  I then "Assigned Read" access to the test security role.  However, when the user tries to access the console, they get an access denied message.

Try working with an existing role and backing off on privileges until you get the behavior you want.  Typically, starting with a role from scratch isn't the best way to go.

For what it's worth, the Symantec Guests role has 'Create Portal Pages' privileges under 'Console Privileges.'  What if you assign this privilege to your custom role?

What privileges are required to be able to view(read only) the entire console?

Did you try Console Privileges > Create Portal Pages?  It seems to be listed even for Guests and Level 1 Workers, so I imagine that's it.  I didn't think you would need to assign Security to the OG, I assumed that was there by default.

I did and I think that may be it.  The console loads.  I am now testing to verify read access only.  I will post results.