Disable check now for passive services

Our passive services go critical when you click on the check now link.
I was trying to disable this for the passive services in the roles but that doesn’t seem to have the desired effect.
image

even when both schedule-check options are turned off the check_now still seems to be working.

You need to login again first, for any changes to your roles to have an effect. Did you do that? Another reason might be another role that grants you this privilege.

Yup did login again.
And the user i test with only got that role.

Are active checks for the service in question really disabled?

enable_active_checks = false
i tried with the active-only flag disabled as well.
Even then i could still do check now

Have you maybe the administrative permission (*) enabled?

config with both flags disabled.
groups = “monitoring”
monitoring/filter/objects = “hostgroup_name=hg_monitoring|servicegroup_name=sg_monitoring”
permissions = “module/businessprocess,businessprocess/showall,module/grafana,grafana/graph,grafana/showall,grafana/enablelink,module/monitoring,monitoring/command/,monitoring/command/acknowledge-problem,monitoring/command/remove-acknowledgement,monitoring/command/comment/,monitoring/command/comment/add,monitoring/command/comment/delete,monitoring/command/downtime/*,monitoring/command/downtime/schedule,monitoring/command/downtime/delete”
businessprocess/prefix = “monitoring”

config with active-only enabled
groups = “routers,GSMON-Ops-Network”
monitoring/filter/objects = “hostgroup_name=hg_routers|servicegroup_name=sg_routers”
permissions = “module/businessprocess,businessprocess/showall,module/grafana,grafana/graph,grafana/showall,grafana/enablelink,module/monitoring,monitoring/command/,monitoring/command/schedule-check/active-only,monitoring/command/acknowledge-problem,monitoring/command/remove-acknowledgement,monitoring/command/comment/,monitoring/command/comment/add,monitoring/command/comment/delete,monitoring/command/downtime/*,monitoring/command/downtime/schedule,monitoring/command/downtime/delete”
businessprocess/prefix = “routers”

You have the monitoring/command/* permission enabled. This grants all other command permissions regardless of their individual state. Disable it and monitoring/command/schedule-check/active-only will behave as you want.