Securing and Monitoring Web Based RDP Sessions without Installing Privileged Access Manager Agent

Let us assume, an organization Intech Data, Inc. wants to secure and monitor employees’ action during the privileged access to Windows Server that is located in the network lab. This Windows Server contains confidential data.

Employees can access this server without using the remote desktop client. A few employees can access it remotely only during the business hours (9 AM to 6 PM) on business days (Monday to Friday).

This example refers to the following user profiles:

  • Markus: An administrator of Intech Data, Inc.

  • Albert Jones: An employee of Intech Data, Inc.

Markus wants to enforce Windows Agentless Web RDP to secure the Windows server. With this implementation, designated employees can access the Windows server through PAM User console for privileged access, and each action is recorded and monitored for auditing purposes. If employees perform any action that poses potential risk, such as deleting, copying data, and so on, the actions are recorded. Markus can suspend the just-in-time session if he is monitoring the active session.

The following diagram depicts the requirement of this use case:

This section explains the prerequisites, flow of actions, and step-by-step configuration details to achieve this requirement.

Flow Diagram

The following diagram illustrates the sequential flow of configuration required for implementing the Windows Agentless Web RDP:

To achieve this requirement, Markus performs the following tasks:

  1. Configure the LDAP Repository

  2. Add a Resource

  3. Defining a User Role

  4. Create a Resource Pool

  5. Create an Assignment and Grant Permission

Prerequisites

  • Privileged Access Manager is installed with the required Agentless module.

    NOTE:The agentless component of Privileged Access Manager (agentless) is supported on SLES 12 (64-bit), SLES 15 (64-bit), Oracle Linux 8 (64-bit), and RHEL 8(64-bit).

  • Enable the Access Control Engine option in Server Settings > Policy Engine.

  • Import the CA certificate on the system where Privileged Access Manager is installed to enable communication over Secure Sockets Layer (SSL).

    For more information, see Exporting the Certificate From the Active Directory Server.

Configure the LDAP Repository

  1. Click Settings on the Administration Console.

  2. Click LDAP Servers on the left pane and click Add New.

  3. Perform the following actions:

    1. Specify Domain Name of the LDAP Server.

    2. Type is set to Active Directory Services, by default.

    3. Specify Host Name/IP Address of the LDAP Server.

      NOTE:Port is set to 636, by default.

    4. Select SSL and Verify Certificate to secure the connection via SSL by using the CA certificate.

    5. Click GetBaseDN to fetch the appropriate details.

    6. Set Scope to Subtree.

    7. Specify User DN, User Name, and Password that are required for retrieving the user details and domain details for authentication.

  4. Click Save.

Add a Resource

A resource is a network device, application, repository, or data storage device to which users can get privileged access.

  1. Click Credential Vault on the Administration Console.

  2. Click +Add > Windows > Windows Host.

  3. In Name, specify a name for Windows Server.

    For this example, the resource name is set to winsrv16.intech.com.

  4. Click Next.

  5. Perform the following actions to configure the Connection details:

    1. In Host Name/IP Address, specify the host name or IP address of Windows Server.

      NOTE:Port is set to 3389, by default.

    2. Select Active Directory Domain displays the list of domains if the specified host name is associated to a domain.

      In this example, Windows Server is a standalone device and does not need to be associated to any Active Directory Domain.

  6. Click Next.

  7. Click Finish.

  8. Click the resource that you have added and click Credentials tab.

  9. Click Add.

  10. Specify the User Name, Password, and Privilege Type required to access Windows Server.

Defining a User Role

  1. Click Access Control > User Roles > Create.

  2. Specify the role name in Name and additional information about the role in Description.

  3. Click Next.

  4. Click +Add > LDAP Users and Groups.

  5. Select the domain and select the preferred user or group.

    In this example, the user AlbertJ is selected.

  6. Click Add > Create.

Create a Resource Pool

  1. Click Access Control > Resource Pools > Create.

  2. Specify Name and Description for this resource pool.

    For this example, the resource pool name is set to Windows Server with AD Users.

  3. Select Type as Windows Servers under Agentless.

  4. Click Next.

  5. Click Add and select the resource that you added in Add a Resource.

  6. Click Add.

  7. Select Default Credentials that is required to allow users to access the resource.

  8. Click Create.

Create an Assignment and Grant Permission

  1. Click Access Control > Assignments > Create.

  2. Select the Resource Pool that you created in Create a Resource Pool.

  3. Select the User Role that you defined in Defining a User Role.

    The Description gets generated with the name that you have provided for Resource Pool and User Role.

  4. Click Add and select Web RDP permission in the Privilege Elevation window.

    NOTE:By default, Credential is set to Default to allow users to access Windows Server with the default credentials that is configure for the resource.

  5. Click Next.

  6. Select Custom Days and set the days and time frame as follows:

    1. Select Mon to Fri as the days.

    2. Specify 9 to 6 as time frame for the selected days.

  7. Click Next.

  8. Disable Secondary Authentication.

  9. Enable Enable Drive to allow file transfer from the Web RDP session.

    NOTE:When the Enable Drive is enabled the Clipboard toggle enables automatically.

  10. In User Message, specify a message that is displayed to users on connecting to the resource.

  11. Click Next > Finish > Create.

After Markus implements Windows Agentless Web RDP, the following are possible scenarios:

Scenario

Result

Albert logs in to the User Console and accesses the Windows Server. Later, he installs software and configures it.

Each action is recorded, the live session video is captured, and stored in Reports. No malicious activity is detected.

Albert wants to access Windows Server on Thursday at 8 PM.

The Windows Server resource is not available on the User Console for Albert. As Windows Server is accessible from 9 AM to 6 PM.

Albert installs a malware on Windows Server unintentionally.

The install procedure is recorded. When Markus checks the report and notices malware installation, he notifies Albert to uninstall the identified malware.

Markus is monitoring the live session and Albert attempts to delete the server configuration.

Markus terminates the session. Later, he drafts a mail with the reason and sends it to Albert.