diff --git a/navalplanner-webapp/src/main/java/org/navalplanner/web/common/CustomMenuController.java b/navalplanner-webapp/src/main/java/org/navalplanner/web/common/CustomMenuController.java
index e94b16731..676e24579 100644
--- a/navalplanner-webapp/src/main/java/org/navalplanner/web/common/CustomMenuController.java
+++ b/navalplanner-webapp/src/main/java/org/navalplanner/web/common/CustomMenuController.java
@@ -23,6 +23,7 @@ package org.navalplanner.web.common;
 import static org.navalplanner.web.I18nHelper._;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.regex.Matcher;
@@ -188,6 +189,11 @@ public class CustomMenuController extends Div implements IMenuItemsRegister {
         return OnZKDesktopRegistry.getLocatorFor(IMenuItemsRegister.class);
     }
 
+    private CustomMenuController topItem(String name, String url,
+            String helpUri, Collection<? extends CustomMenuItem> items) {
+        return topItem(name, url, helpUri, items.toArray(new CustomMenuItem[0]));
+    }
+
     private CustomMenuController topItem(String name, String url,
             String helpUri,
             CustomMenuItem... items) {
@@ -227,15 +233,18 @@ public class CustomMenuController extends Div implements IMenuItemsRegister {
             subItem(_("Limiting Resources Planning"),"/planner/index.zul;limiting_resources","01-introducion.html"),
             subItem(_("Project Templates"), "/templates/templates.zul", ""));
 
-        topItem(_("Resources"), "/resources/worker/worker.zul", "",
-            subItem(_("Workers"), "/resources/worker/worker.zul","05-recursos.html#xesti-n-de-traballadores"),
-            subItem(_("Machines"), "/resources/machine/machines.zul","05-recursos.html#xesti-n-de-m-quinas"),
-            subItem(_("Virtual Workers Groups"),"/resources/worker/virtualWorkers.zul","05-recursos.html#xesti-n-de-traballadores"),
-            subItem(_("Work Reports"), "/workreports/workReport.zul", "09-partes.html#id3"),
-            subItem(_("Companies"), "/externalcompanies/externalcompanies.zul",""),
-            subItem(_("Subcontracting"), "/subcontract/subcontractedTasks.zul", "",
+        List<CustomMenuItem> resourcesItems = new ArrayList<CustomMenuItem>();
+        resourcesItems.add(subItem(_("Workers"), "/resources/worker/worker.zul","05-recursos.html#xesti-n-de-traballadores"));
+        resourcesItems.add(subItem(_("Machines"), "/resources/machine/machines.zul","05-recursos.html#xesti-n-de-m-quinas"));
+        resourcesItems.add(subItem(_("Virtual Workers Groups"),"/resources/worker/virtualWorkers.zul","05-recursos.html#xesti-n-de-traballadores"));
+        resourcesItems.add(subItem(_("Work Reports"), "/workreports/workReport.zul", "09-partes.html#id3"));
+        if (SecurityUtils.isUserInRole(UserRole.ROLE_ADMINISTRATION)) {
+            resourcesItems.add(subItem(_("Companies"), "/externalcompanies/externalcompanies.zul",""));
+        }
+        resourcesItems.add(subItem(_("Subcontracting"), "/subcontract/subcontractedTasks.zul", "",
                 subItem(_("Subcontracted Tasks"), "/subcontract/subcontractedTasks.zul", ""),
-		subItem(_("Report Advances"), "/subcontract/reportAdvances.zul", "")));
+                subItem(_("Report Advances"), "/subcontract/reportAdvances.zul", "")));
+        topItem(_("Resources"), "/resources/worker/worker.zul", "", resourcesItems);
 
         topItem(_("Scenarios"), "/scenarios/scenarios.zul", "",
                 subItem(_("Scenarios Management"), "/scenarios/scenarios.zul",""),
diff --git a/navalplanner-webapp/src/main/resources/navalplanner-webapp-spring-security-config.xml b/navalplanner-webapp/src/main/resources/navalplanner-webapp-spring-security-config.xml
index 8aec81107..667afcb4d 100644
--- a/navalplanner-webapp/src/main/resources/navalplanner-webapp-spring-security-config.xml
+++ b/navalplanner-webapp/src/main/resources/navalplanner-webapp-spring-security-config.xml
@@ -37,6 +37,7 @@
         <intercept-url pattern="/qualityforms/**" access="ROLE_ADMINISTRATION" />
         <intercept-url pattern="/users/**" access="ROLE_ADMINISTRATION" />
         <intercept-url pattern="/externalcompanies/**" access="ROLE_ADMINISTRATION" />
+        <intercept-url pattern="/workreports/workReportTypes.zul" access="ROLE_ADMINISTRATION" />
         <intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
         <form-login login-page="/common/layout/login.zul" authentication-failure-url="/common/layout/login.zul?login_error=true"/>