Testing Genetec's Omnicast Video Management Software

JH
John Honovich
•Published Apr 10, 2010 04:00 AM

Genetec is one of the most used and well known VMS systems in the marketplace. While it does not generate the same level of press as its most commonly compared rival, Milestone Systems, Genetec has a strong technical reputation.

In this test, we examine Genetec's Omnicast VMS (v 4.5). The test was hosted on VMWare Server virtual machine running Windows XP Pro (32 bit OS), connected to an IQinVision 4 series, Axis Q1755, Panasonic NP502 and Pelco Sarix cameras. A remote workstation using Windows 7 was also tested using Omnicast's network accessible client applications. 

Our key findings include:

  • Outstanding advanced functionality especially for 3rd party systems integration, large scale system management and live monitoring by teams of operators
  • Steep learning curve and complexity, especially for administration, may cause significant problems for infrequent operators and traditional security technicians

We believe specifiers should carefully consider the tradeoffs when considering Genetec. While Omnicast offers many unique or rare advantages, you may find them unnecessary and the complexities in administrating quite challenging.

Recommendations and Key Decision Points

The following are key advantages that would favor selection of Omnicast. We mention key features in this section and explain them later in the review.

Positives

  • Large Scale Live Monitoring: Abundant features to support large teams watching and sharing video of large numbers of cameras. Specific features include: Matrix switch and keyboard integration, extensive macros/scripting, prioritizing alarms, forwarding alarms, redistributing live video feeds across the network, locking PTZ controls, blocking live video feeds, numeric based keyboard controls, etc.
  • Large Scale System Management: Abundant features to support scalable, redundant systems of thousands of cameras. Specific features include: redundant system management (i.e., directories), redundant recording (i.e., archivers), multicast support end to end, gateways for large scale system access, federation to access other Genetec systems, batch configuration (i.e., copy configuration tool), reporting, etc.
  • 3rd Party System Integration: Abundant integration with IP cameras, access control systems, PSIM, keyboard, matrix switches, analytics, etc.
 
On the other hand, we see 3 key main negatives for certain uses of Omnicast.

Negatives

  • Steep Learning Curve: Having tested a dozen systems and deployed VMS systems for years, we find Genetec to have one of the steepest learning curves in the industry. We think most users will require formal training and that users without such training could make important mistakes. Integrators should factor in the cost of learning/training as well as the mistakes/delays that may occur if techs only use/deploy Omnicast systems infrequently.
  • Cumbersome Administration / Configuration: With hundreds of configuration options divided across two applications and two dozens sections, unless you are trained and regularly use Genetec, it can be difficult to determine what and where to change. There are no 'wizards' or 'simple setup' tools. The system is optimized for power users and large scale applications.
  • High Price for Small Systems: Genetec's 'basic' single server package (called Standard) is fairly expensive so if you want to deploy a small camera count system, you will pay more than most competitors and have to deal with a more complex setup.
 
With these positives and negatives noted, we offer the following recommendations for using Omnicast.

Recommendations - End Users

  • Very Large Deployments with a team of live operators (100s or 1000s of cameras per site): For those users with many cameras and many operators, Genetec provides many advanced features to optimize the usability in such scenarios.
  • Rare or Unique Needs: Because Genetec has so many features and 3rd party integrations, Omnicast may solve specific problems that other VMS systems cannot provide.
  • Over-kill for mid to small market: If you have only have a small number of cameras or a small number of sites without a team of live monitors watching video, we are skeptical of the competitive value of Omnicast. While Genetec launched a hybrid DVR appliance (the SV-3200) in 2009, it is relatively expensive and the high end features of Omnicast are likely to provide minimal practical benefits for such use cases.

Recommendations - Integrators

  • Win Projects based on Unique / Rare capabilities: If you are looking to win a large project based on being able to do something other systems cannot do, Omnicast provides a large number of options. You may be able to persuade an end-user that certain unique or rare Omnicast advantages are a must-have, thereby eliminating competition from integrators pitching other VMS systems.
  • Differentiate with Technical Superiority: If you have strong IT capabilities across your team, you may be able to provide customization or optimization of Omnicast at levels most traditional security integrators cannot match.
  • Struggle for Average Security Technician: If your team has traditional low-voltage security technicians, we think using Omnicast is likely to be a headache and source of frustration. We recommend that most security integrators think carefully before deploying a system that really requires strong technical skills, hands-on product training and regular use.

Product Details

Genetec offers limited public information on OmniCast with little more than a brochure [link no longer available] and IP camera support list. The best public details on Omnicast may be found in Genetec's recent blog. Genetec does offer extensive documentation but only its partner portal which requires approval and login. Looking at the paucity of details on Genetec's public website, it is easy to come away with the impression that Omnicast is technically unsophisticated (which we find not to be the case both in a good and bad way).

Unlike most VMS systems that are designed around a single server (that is, recording, management, video distribution bound into a single application), Omnicast is designed in a more modular manner with separate services for system management (their directory), recording (their archiver) and system access (their gateways), video distribution (their virtual matrix), etc. Each service supports redundant configurations to provide fault tolerance. The upside of this approach is increased scalability. The downside is that it's more difficult to understand and configure than a single application.

Training

Genetec requires integrators have at least one team member attend 3 day technical training that covers the fundamentals of using and configuring Omnicast. Additionally, Genetec offers an optional 3 day advanced training course.

Genetec offers training videos on the Genetec Technical Assitance Portal (GTAP). Once logged in the technician can review how-to videos with commentary but only for live monitoring and archiving. No training videos are provided for administration/configuration.

Computing Platform

Omnicast support the following Windows platforms: XP, Vista Business or Ultimate, 2003 Standard/ Enterprise, 2008 Standard/ Enterprise & 32/64-bit for all.

Pricing and Product Options

As of April 2010, Genetec offers 3 product 'packages.' All packages share the same 'code base' and differ primarily by the functionalities enabled. Each package has a base fee (per deployment, not server) and then additional fees per connection (e.g., per camera).

  • Standard is Genetec's entry level or single server offering with a maximum number of 50 cameras supported. Standard provides audio support, web access and mapping but no redundancy features nor 3rd party system integration. A 25 camera system has an MSRP of approximately $4,340 or $173 per camera. Many offerings have an MSRP of $125-$150 for similar, single server, limited camera, limited functionality packages.
  • Pro is Genetec's mid-level offering with a maximum of 20 archivers and 100 cameras per archiver. Pro does not support 3rd party system integration (access control, analytics, etc.), redundancy features nor Federation (TM). Assuming a system has 100 cameras or more, the MSRP per camera is approximately $235. Pro offers some optional features (such as Active Directory integration, camera blocking, etc.) but on a per camera basis, their cost is fairly inconsequential.
  • Enterprise is Genetec's high end offering with an unlimited license for total archivers (300 cameras per archiver max). For an optional modest fee, Enterprise users can enable redundancy, 3rd party system integration and Federation (TM) (these fees work out to be $3 to $10 per camera per feature in systems of even moderate scale). The per camera MSRP (including the additional fees for Genetec's optional advanced features) is approximately $270 per camera. This price point is quite reasonable compared to other 'high-end', enterprise level VMS systems.

A Note about Federation (TM)

Federation (TM) is one of Genetec's more interesting yet confusing features. Genetec describes federation as an architecture that:

"provides the ease of sharing security data across various independent organisations, as it unifies autonomous systems"

While this sounds similar to enterprise management founds in many VMS systems, it is different. Genetec provides enterprise management of cameras, users, etc through its directory architecture. Federation provides an additional layer of interoperability across directories.

Federation (TM) allows integration between multiple Genetec systems that are independently maintained. For instance, the police department runs a Genetec Omnicast system. The city library runs a Genetec Omnicast system, purchased and maintained independently. As an example, federation allows the police to watch their own cameras and the libraries cameras at the same time on the police department's Live Viewer client. The library can define what cameras, what time, what rights, etc. the police can have when accessing their system. This is accomplished by the library setting up an account for the Police Department and then allowing a login via the Police Department's Federation server.

This is a Genetec proprietary feature so it only shares security data if both organizations are using Genetec. We think federation has value for certain applications but is severely limited by the requirements of having all Genetec deployments.

Genetec is enforcing a Trademark on the term "Federation" (See the US Trademark details). We believe Genetec is trying to stop Milestone from using the term (Milestone recently announced plans for 'federation' [link no longer available]). On the other hand, it's absurd and somewhat scary that Genetec has trademarked a real IT term (see federated databases) and not simply a marketing creation.

Usability (Advantages) of the VMS system

In the screencast below, we examine the usability advantages of Genetec. Key Points noted in the screencast include:

  • Advantage:  Genetec Technical Assistance Portal (GTAP) provides computer based training (00:31 min)
  • Advantage:  Failover management is available for the entire system (01:44 min)
  • Advantage:Watermarking occurs upon recording which is not commonly seen in the VMSs we have tested (02:17 min)
  • Advantage:  Multistreaming provides viewing/bandwidth optimization and can tailor to your preferences (03:08 min)
  • Advantage:  Multicasting reduces latency to the client workstation and provides scalability for simultaneous viewers (03:46 min)
  • Advantage:  Multiple schedules provide recording flexibility (04:12 min)
  • Advantage:  Supervised logins provide enhanced security for accessing large systems (05:45 min)
  • Advantage:  Federation (TM) management allows independent Genetec servers to share access (06:13 min)
  • Advantage:  Operators can be prioritized to view/respond to alarms based on their user account settings (08:07 min)
  • Advantage:  Configuration templates can be configured for several types of entities other than cameras and can significantly minimize human error (09:28 min)
  • Advantage:  Depending on the user, the default of asynchronous playback may be beneficial (10:29 min)
  • Advantage:  Search options provide the ability to search third party DVRs, attached storage, etc. which can provide the investigator flexibility to narrow down investigations through a single interface (11:09 min)
  • Advantage:  Live monitoring benefits from extensive keyboard, matrix integration and macros and controls (12:15 min)
  • Advantage:  the ability to decode video to analog monitors / systems provides deployment flexibility (12:48 min)
  • Advantage:  Review and respond to events and alarms in real time (13:02 min)
  • Advantage:  Large monitoring groups can benefit from numerous alarm options (13:37 min)
  • Advantage:  Virtual Matrix provides video distribution/sharing across the network to different computers (14:17 min)
  • Advantage:  Locking/blocking cameras apply priorities for more sensitive situations (15:08 min)
  • Advantage:  Workstations can set individual client-side preferences to optimize viewing / bandwidth (15:44 min)
  • Advantage:  the web interface provides similar functionalities to the thick client and provides scalability (18:42 min)

Usability (Disadvantages) of the VMS system

In the screencast below, we examine the usability disadvantages of Genetec. Key Points noted in the screencast include:

  • Disadvantage:  Installation download ~ 1.3 GB when just compressed. Unpacking the file can cause delay (00:40 min)
  • Disadvantage:  Four different client applications easily becomes overwhelming and disorienting at the least (01:15 min)
  • Disadvantage:  two different administrative clients can cause confusion (01:39)
  • Disadvantage:  a different 'extension' must be added and configured no the Archiver for each camera manufacturer (01:58 min.)
  • Disadvantage:  the distributed architecture may seem unfamiliar and complicated even to the savvy operator (03:25 min.)
  • Disadvantage:  subtle changes in advanced vs. basic mode may be disorienting for the user (04:01 min.)
  • Disadvantage:  Too much time is dedicated to navigating the interface as there are many menus, sub-menus and poor spacial grouping (04:25 min)
  • Disadvantage:  Extensive stream options may be technically challenging  even for operators with technical experience (05:27 min)
  • Disadvantage:  Multiple scheduling options can be puzzling as there are several locations to configure within the interface (06:01 min)
  • Disadvantage:  The default multicast stream setting may not benefit less sophisticated network infrastructures (06:08 min)

Administration of the VMS system

The following screencast examines how to configure/setup Genetec's VMS system. 

Key points include:

  • The compressed installation file is 1.3 GB and can cause a period of 'dead' time just to uncompress (00:44 min)
  • Multiple applications to apply administrative configurations (01:18 min)
  • Each camera manufacturer in your deployment will require an "Extension" to be added to the Archiver (03:22 min)
  • The Directory provides enterprise management (04:12 min)
  • Basic mode vs. Advanced mode will hide menus from view (06:03 min)
  • Multistream options provide the ability to optimize viewing/bandwidth (07:13 min)
  • Multicasting is enabled by default and depending on the network infrastructure, performance may vary (09:37 min)
  • Schedules can be related to each other or various entities (12:45 min)
  • Alarm priority provides a filter for later viewing/searching (13:36 min)
  • The use of macros provides sophisticated/custom responses to a variety of entities (15:30 min)
  • Several types of entities can be templated (25:15 min)
  • Redundancy can also be applied to individual cameras (27:04 min)
  • The discovery tool does not provide a 'find all' like feature (28:38 min)
  • Advanced functionalities (i.e. macros) can be applied to maps (29:51 min)
  • Bandwidth / viewing optimization can be configured per workstation (32:17)

Live Monitoring of the VMS system

The following screencast examines monitoring live video with Genetec's VMS software. Key points include:

  • IP cameras can be displayed on analog outputs (01:19 min)
  • With proper priority, PTZ controls will be surrendered (05:04 min)
  • Operators can use the keyboard to control video locally or remotely (07:59 min)
  • Megapixel cameras often cause the CPU message to appear in front of the interface (10:34 min)
  • Live Viewer options provide viewing / bandwidth optimization at each workstation (12:04 min)

Investigation of the VMS system

The following screencast examines how to conduct investigations with Genetec's VMS software. Key points include:

  • The seven different search options provide options (01:00 min)
  • Search options allow different systems to be searched (third party DVRs, network attached storage, USB drives, etc.) (02:27 min)
  • Asynchronous playback is the default but is uncommon from many other VMS systems (04:43 min)
  • Third parties without Archive Player should use the browser based playback ability (09:21 min)
  • Instant playback provides limited archived video playback controls (12:23 min)

VMS Questions - Basic Use (Live and Recorded)

How do I watch live video?

This is conducted in a standalone application called "Live Viewer." Live Viewer will provide a structure tree on the left where units such as cameras can be drag-n-dropped into the live panes. 

What ways can I monitor many video feeds simultaneously?

The same Live Viewer application will allow cameras from multiple sites/locations via the structure tree on the left side.

There are several advanced features that provide live viewing as well.

The virtual matrix plug-in provides the operators to control other workstation's Live Viewer application (to a specific degree, of course). The administrator will first enable the Virtual Matrix Plug-in within Server Admin, then will be displayed in the Live Viewer. The operator (within Live Viewer) can drag-n-drop this plug-in from the structure tree into a camera pane, will then be presented with a drop-down box to choose what workstation to control. As the document specifies, "the video is displayed in the Remote Live Viewer and in the corresponding tile of the monitor it controls."

Another option of viewing live video is via alarm events/rules. An alarm can be configured to display live video of a specified list of user's workstations. The be clear, the receiving workstations would require and "armed" video pane to allow the alarm to display the video; otherwise, it will simply be listed in the alarm events pane.

How can I be notified and review alarms?

The Live Viewer application will present an alarm pane for associated events at the bottom of the interface, similar to many other system. The alarm panel will provide the operator to respond with a number of different options (acknowledge, snooze, forward, etc.). To provide feedback, there is an alarm bell icon at the top of the interface that will blink or play a sound if configured to do so.

Alarm Search mode in the Archive Player interface will allow an investigator to search for all triggered alarm events, then play those events back in the camera viewing panes. The investigator has the options to filter alarms by:  instance number, alarm entities (cameras, users, etc.), alarm creation time, alarm priority, source, description and alarm status.

What ways can I search multiple video feeds?

Within the "Archive Player" standalone application, the investigator can use one of seven different search types - 'Sequence Search.' This option is the only search type that provides multi-camera searching. 

To be clear, there are seven different search types in Omnicast the investigator must choose from. 

How do you share images from video?

In both the Live Viewer and Archive Player, each camera within the viewing area has an option to "save a snapshot of the current frame."

An alarm event can be configured to display frames instead of a live video stream. The administrator will configure this option via the Config Tool under Alarm Management.

How do you share video clips from recorded video?

This can be done in a couple ways dependent on what application and flexibility requirements. To clarify, both Live Viewer and Archive Player provide video exporting but will behave differently.

Live Viewer will provide the operator with an instant replay function. When this is enabled, controls will appear in the left sidebar for playback in addition to an export option. An export window will then pop-up and the operator can actually extend the amount of video to export (the date and time can be changed). 

In the Archive Player, the same playback and export functions are provided once the video is loaded into the viewing area. Additionally, the export button is always provided at the bottom of the Archive Player interface, represented by a compact disc (CD) icon.

It's important to note that there is no option that provides multiple camera exporting in a single executable. Each export will create a different executable for playback. The best practice for this would be to leave the time-in/out timeline flags and repeat for each desired camera.

How do I know if I am in live or recorded video mode?

The fact that live and recorded video are viewed in two separate applications, it will be very clear to which is being used - Live Viewer vs. Archive Player. Although layout is similar, the operator can simply read the title of the application at the top to quickly verify. However, Omnicast does provide instant playback in the Live Viewer interface so it is possible to view recorded video. 

When this is accessed, new controls for playback appear on the left sidebar - to be clear, this does not switch applications but simply displays the playback controls within Live Viewer.

How can I conduct searches from video feeds stored in different appliances/servers?

Majority of the seven search options provide the investigator to choose a "Source." The source can be Federated servers (other Genetec archivers, attached storage (USB) or even other DVR/VMS manufacturers. 

An interface developed by Genetec will allow the Omnicast to communicate, make requests and display video from that third party within the Omnicast interface. The third party DVR must be supported, of course but provides flexibility in deployments that obtain more than one manufacturer.

To note, depending on the type of search, Omnicast "plug-ins" might be necessary to install/configure. For example, if the investigator wants to search for metadata from the point of sale (POS) transaction integration, a meta-data plug-in is required on the server level.

Are there any limitations or potential issues with the video playback controls?

With seven different search options and each having unique behaviors (multi-camera search vs. single), investigators will become confused as to which search type provides their desired results.

By default, the Archive Player  software is set to asynchronous playback - meaning a user can load several different time periods within the same video viewing area. For example, camera 1 may be 3:00 PM, camera 2 could be 1:25 PM and camera 3 could be 11:00 AM. This immediately becomes confusing, especially if the user does not realize that the default is asynchronous playback. Additionally, the time/date is not overlayed by default so the administrator needs to ensure that this information is being displayed to minimize confusion/frustration.

VMS Questions - Administrative

What are the key steps to install the server/client?

Omnicast provides a distributed architecture in addition to a simple singler-server installation. Depending on your failover/redundancy requirements, Archivers, Directory and Backup Directory servers can be distributed across different physical systems. This allows the administrator to distribute processing load in addition to providing secondary (redundant) servers. 

A single executable of just over one gigabyte (GB) will allow the administrator to install both the client and server software. The key item is for the administrator to Specify during the installation, whether to install the server, client or both on that station.

When installing an Archive server, compatibility packs should be installed FIRST - this is Genetec support's recommendation.

It's important to note that functionality with both client and server are distributed amongst various applications as mentioned below.

One more important note is dependent on the additional tools that the administrator will be utilizing. For example, the web client will  require installation of the Map Editor in addition to Genetec's SDK (software developer kit) on each server/workstation accessing this feature.

Are there any complex steps or potential problems in the server install?

In order to fully enable the server, a license must be applied via a downloadable file from Genetec's website. To clarify, this step MUST be conducted and file be applied to the server to enabled all purchased features. During our tests, we consistently received errors when attempting to download the file. This caused significant delays in our testing and required the intervention of technical support. 

With an installation file of over one gigabyte (huge file) to install the server and client software, this download can take majority of the setup time. To add to this, the installer must first extract files to initiate the setup process - this took a significant amount of time and can cause further delays of the software setup.

How do I add/setup a camera?

To add a camera, the administrator must first access the server locally to launch the 'Server Admin' application. 

A similar structure tree as other applications (Config Tool) will be presented on the left, showing the Directory, Gateway, Archiver and Virtual Matrix items. The system contains an "Archiver" server that allows camera "extensions" to be associated. To be clear, each different camera manufacturer will require an associated "extension." This means that if your deployment contains a variety of manufacturers (Panasonic, Axis, IQInvision), the administrator will configure three separate "extensions." Only until this has been applied will an operator with the Config Tool be permitted to add cameras from the corresponding camera manufacturer. To further clarify, one extension is required per supported manufacturer.

Once the "extension" has been associated the administrator will switch to the Config Tool application and add the camera to the associated site/location. From here, standard camera configurations can be applied (frame rate, scheduling, etc.).

How do you restrict access to the system?

Just above the structure tree pane, a drop-down menu will provide an option for "User Management." This provides functions to add users and groups. Users and groups can then be permitted to specific sites. Additionally, permissions can be configured via a list of functions and applications that the administrator can allow, deny or leave at undefined. These permissions range from entire applications (Live Viewer) to specific functions (add bookmarks).

Finally, Omnicast provides users and groups to be configured in 'partitions.' This is how they describe the concept:

"A partition is a logical grouping of entities to simplify how users are granted access rights over these entities. When a user is given access to a partition, the user automatically gains the same access rights to all entities contained in that partition. This avoids the tedious task of creating one-to-one relationships between entities and users. If a user has no access to a partition, that partition is invisible to that user."

How can you setup the VMS to handle failures to servers/appliances?

Genetec implements a 'failover mechanism' for redundant servers - this can be applied to the Directory and Gateway, Archiver, Virtual Matrix and Metadata Engine.

How to provide server failover?

Directory failover can be configured via the Config Tool's main context menus at the top of the interface - Tools > Configure Directory Failover. This will launch the wizard to provide some level of assistance. 

For Archivers, after being added to the system, each has a 'Backup' tab that allows the administrator to specify what entities of that Archiver should be configured via checkbox.

Omincast provides a backup option but not no scheduling features.

How can you access reports or alerts on the health status of the servers/appliances applications?

In the Config Tool, Physical View, Statistics tab is a button called Camera Statistics which allows the administrator to view the current recording status of cameras of the associated Archiver.

Outside of the feature mentioned above, this feature does not exist within the Omnicast system. The administrator will need an additional client called "Security Desk" that provides access to health reports.

Within the interface, the entities that are disconnected or offline will be highlighted in red. A camera, for example, when offline will be red in the structure tree on the left side of the interface.

There is an additional Tool included with the Omnicast installation called, "Report Viewer;" however, we did not test that application.

How can you upgrade the VMS software?

Upgrading multiple sites can be done automatically and is possibly with a windows enterprise management tool (but is complex and costly).

VMS Questions - Usability

What, if any, VMS functionalities regularly take more than 10 seconds to load?

When adding new cameras, there is no notification that the unit has been registered with the system; therefore, it takes more than 10 seconds to realize this and move on to another task.

What options does the VMS provide to reduce storage consumption?

The Archiver server has individual options to set hard caps on storage use. The administrator can configure via checkboxes the following items:  delete oldest files when disks are full, default retention and can limit individual video files from 5 - 200 seconds. 

What help functionality does the VMS provide while using the client?

The main context menus provide a Help option for a .chm file. This will load the manual to the corresponding application (Config Tool open the administration manual).

How similar is the use of the VMS client to a DVR?

Omnicast has no similarity with a DVR. At the minimum, there are four applications between the server and client that will be required for a variety of functionality. Offering seven different search types further delineates this from a  DVR.

How simple is it for an untrained operator?

The system would be very difficult for an untrained operator. With many small icons but limited labels and functionality distributed across several applications, it can easily become confusing very quickly what the proper workflow is for any given task. 

There are also very detailed advanced features that the operator would not know of as they are hidden in menus and interface settings.

How powerful is it for the expert operator?

Omnicast provides a range of advanced features that an expert operator can find useful when understood. Asynchronous playback can provide flexibility in reviewing recent events while still monitoring live streams. 

The addition of the Federation features will expand on flexibility and scalability and the savvy operator can take advantage of this. The ability to allow independent Omnicast servers to share user accounts can provide many options for large scale deployments.

The extensive and sometimes disorienting number of combinations of schedules, alarms, macros can even become overwhelming. However, this granular approach may provide flexibility and options to fit many applications.

VMS Questions - Scalability

How do you restrict access when using multiple servers/appliances?

Within the a single Directory deployment, User Management, the administrator can use checkboxes to enable the user for any number of sites/locations.

With federated systems, the foreign' server will enable the user. When in the Federated Management mode, the username, password and IP address is required to 'share' access of that user account. As long as that account exists on the foreign Directory, access will be permitted.

How can I watch live video feeds from different appliances/servers?

Under a single Directory, the administrator simply provides permissions to access any combination of sites. Assuming the account has proper viewing rights, live video can be loaded into the viewing area within the Live Viewer client application.

In Federation (TM), the specific viewing rights will need to be configured for the guest user account. The host system will connect to the guest using the guest's provided account. Host system users can see and control resources as defined in the permissions and privileges of the guest.