An administrator needs to exclude users from rendering reports as PDF output. How can this be enabled?

IBM Cognos Analytics uses a granular, capability-based security model to control user access to features and functions. To restrict specific users from generating PDF reports, an administrator must modify the permissions for the "Generate PDF Output" capability. By navigating to the security administration panel, locating this specific capability under the "Reporting" group, the administrator can explicitly deny access to the desired users, groups, or roles, thereby preventing them from rendering reports in PDF format while leaving their other permissions intact.

B. Theme Manager is used for customizing the user interface's appearance (branding, colors, logos). It does not provide a security mechanism to restrict user functionality.

C. This describes an incomplete and incorrect procedure. While creating a role is part of the process, the critical step of applying the 'Deny' permission to the specific "Generate PDF Output" capability for that role is missing.

D. Modifying the system.xml file is for system-wide configuration changes. This action would disable PDF output globally for all users, not selectively exclude specific users as required by the question.

1. IBM Cognos Analytics 11.1.x Documentation, Managing, Security, Capabilities:

Section: Setting access permissions for capabilities: "You can control access to secured functions, features, and user interface elements by granting or denying execute permissions for capabilities... For example, to prevent users from creating reports, you can deny them execute permission for the Report Studio capability." This principle applies directly to the "Generate PDF Output" capability.

Section: Reporting capabilities: This section lists the specific capabilities related to reporting, which includes "Generate PDF output". The documentation confirms this is a distinct, securable function.

2. IBM Cognos Analytics 11.0.0 Documentation, Administration and Security Guide:

Chapter 7: Security, Section: Capabilities: "Capabilities are used to secure functions and features in IBM Cognos software... To use a function or feature, users must have execute permissions for the corresponding capability." This establishes that capabilities are the correct mechanism for controlling function access. The guide details the process of selecting a capability (like "Generate PDF Output") and modifying its permissions for specific users, groups, or roles.