Enshrouded userGroups Password Works but Permissions Fail

Protect configuration and rotate exposed passwords

Role diagnosis often copies JSON into chat or screenshots. Stop the server through the validated product path, copy enshrouded_server.json and the complete saveDirectory, and rotate every group password that left the private machine.

Do not delete the legacy field or rebuild all groups before making the backup. Keen migrates an old top-level password into a default group, and that migration state can explain why a password admits users without the permissions an owner expected.

1. 1Create a private dated JSON copy with secrets intact.
2. 2Create a redacted diagnostic copy for support.
3. 3Generate new, distinct secrets for ordinary and administrator groups.

Use userGroups, not the old single-password mental model

Current Enshrouded authentication maps each password to a named group. A player receives that group's permission flags and reserved-slot behavior. Knowing the server's old password does not inherently grant administrator capabilities.

Give each group one clear purpose. A normal player group should not inherit kick/ban or inventory access merely because it also needs base-building permission.

• name and password identify the role path.
• reservedSlots controls capacity reservation for that group.
• Permission flags should be explicit and least-privileged.

Audit each permission as a separate capability

Keen documents canKickBan, canAccessInventories, canEditBase and canExtendBase. These are not synonyms for 'admin'. A role can be allowed to maintain a base without being allowed to inspect inventories or remove players.

Compare the active JSON with Keen's current Admin, Friend, Guest and Visitor examples, but preserve a custom role name if it communicates the local policy more clearly. Avoid copying old web examples that still rely on one password.

1. 1Write the intended capability matrix before editing JSON.
2. 2Set each boolean deliberately rather than copying an all-true administrator block.
3. 3Choose reservedSlots no larger than the intended role population and total slotCount.

Test with clean identities and the exact group password

An owner or previously privileged character can hide a bad role test. Restart after the JSON change, wait for HostOnline and join with a non-owner account using one group password at a time.

Record whether the account can join, kick/ban, access inventories, edit a base and extend a base. Do not attempt remote moderation from the management app unless a supported mechanism exists; Keen documents role permissions, not native RCON or an HTTP admin API.

• Ordinary group: join and only the intended build capabilities.
• Administrator group: privileged actions, with a different secret.
• Wrong/old password: rejected after rotation.
• All screenshots: passwords, IPs and account identifiers redacted.