Local Accounts on Windows

Prerequisites for adding local accounts on Windows machine:

For RHEL 8 (64-bit) and RHEL 7 (64 bit), install the redhat-lsb-core package.

For RHEL 8 (64-bit) and SLES 15 (64-bit), install the lsb-release package.

  • On Windows Manager:

    • Ensure that the Windows Remote Management (WinRM) service is running on Windows. To start winrm service, run the following command:

      Enable-PSRemoting –force

    • Add the target machine, where the password must be changed, to the WinRM trusted host. To add all servers as a trusted host, run the following command:

      winrm set winrm/config/client '@{TrustedHosts="*"}'

    • Set the PowerShell execution policy to Remotesigned using the following command:

      Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

  • On Linux Manager:

    Install the taskmanager package.

  • On Target Machine:

    Ensure the following is done:

    • Powershell 2.0 or later must be installed in all the windows target machines as Privileged Access Manager uses PowerShell scripts to change password.

    • Windows Remote Management (WinRM) service must be running on the Windows machine. To start WinRM service, use the command:

      Enable-PSRemoting –force

    • The IP address of the task manager must be added to the trusted host of the target machine. To add a trusted host, use the command:

      winrm set winrm/config/client '@{TrustedHosts="x.x.x.x"}'

Follow the procedure, after importing the vault:

General:

In the General tab, enter the name, example: DOM-APP_WINDOWS. Click Next.

Connection Details:

  • Application Type: Enter the application type as WINDOWS.

  • Host Name/IP Address: Enter the host name and IP of the Windows machine.

  • Port: Enter the port number as 3389.

  • SSL: Enable or disable by moving the button to the left or to the right.

  • Password Change on Check in:

    Based on the following selection the password of the application will be changed automatically every time a credential is checked in.

    • Never

      You can use this option if you do not want to change the password after every credential check-in.

    • Delegate to Identity Manager

      If you want to delegate the password check-in process to Identity Manager, select Delegate to Identity manager. Once a resource is created in Identity Manager, it gets synced to Privileged Access Manager. Resource permission is created in Privileged Access Manager but during check in and checkout password is rotated and handled by Identity Manager Driver Implementation guide on the PAM documentation page.

      NOTE:Although the latest IDM driver version is 4.8.x, ensure that you use 4.5.x version of the IDM driver package, as 4.5.x version is currently supported with Privileged Access Manager.

      NOTE:Before you delegate password check-in to Identity Manager ensure that both the Privileged Access Manager IDM driver and database driver are operational.

    • By Script

      Enter the Windows script in the text box provided.

    • Select the appropriate Password Policy that must be used when Privileged Access Manager generates a new password. By default Default Password Policy is selected. You can either modify the default password policy or create a new password policy.

      • User Name

      • Password

    • Reconcile Account: Select based on the account.

  • Script Arguments: Enter the ClientID, Authority, and AuthenticationTokenURL.

  • In the Extended Attributes tab, click +Define and select the relevant attributes from the list.

    Click Finish.

Privileged Access Manager supports Credential Checkout feature for local user accounts on Window Operating System.