Privileged Access Manager Administration Guide
- Privileged Access Manager Administration Guide
- Discovering Privileged Accounts
- Privileged Account Sniffer
- Types of Accounts Discovered
- Administrative Accounts
- Service Accounts
- Launching Privileged Account Sniffer
- Configuring Privileged Account Sniffer
- Discovering Accounts
- Discovery Reports
- Filtering Report Data
- Discovery and Onboard of Privileged Accounts
- Managing Targets
- Adding a Target
- Importing Targets
- Discovering Accounts
- Updating Discovery Rule
- Updating Discovery Account
- Modifying a Target
- Deleting a Target
- Viewing Discovery Results
- Onboarding a Target
- Onboarding an Account
- Enabling Discovered Accounts
- Disabling Discovered Accounts
- Changing Password of Accounts
- Deleting Discovered Accounts
- Viewing Discovery and Onboard Jobs
- Configuring Discovery Rules
- Adding a Rule
- Modifying a Rule
- Deleting a Rule
- Managing Hosts
- Managing Domains
- Creating a Domain
- Modifying a Domain
- Deleting a Domain
- Managing and Monitoring Hosts
- Deployment Dashboard
- Customizing Deployment Dashboard
- Adding a Host
- Viewing Host Details
- Modifying a Host
- Registering Hosts
- Deleting a Host
- Moving a Host
- Finding a Host
- Monitoring Hosts
- Viewing the Host Status
- Viewing the Host Log
- Modifying Log Settings
- Example Rollover Script
- Managing System Alerts
- Modifying Alert Settings
- Enabling Crash Dump Capture
- Managing Packages Using New Console
- Viewing and Managing Host Packages
- Package Source Settings
- Managing Host Packages Using the Legacy Console
- Finding Packages on Hosts
- Updating Packages for a Host
- Rolling Back Packages
- Committing Packages
- Registering and Unregistering Packages for a Host
- Installing Packages on a Host
- Uninstalling Packages from a Host
- Modifying Audit Settings for the Audit Manager Package
- Configuring SMTP Server Settings
- Configuring Settings for the dbaudit Package
- Managing Audit Zones
- Understanding Audit Zones with an Example
- Securing Access to the Framework Manager Console
- Requesting a Certificate for the Framework Manager Console
- Installing a Certificate
- Modifying the Connector
- SSL Renegotiation DOS Attack Protection
- Managing Users and Groups
- Managing Groups
- Predefined User Groups
- Adding a User Group
- Modifying a User Group
- Configuring Permissions
- Administration
- Access Control Permissions
- Agent Management Permissions
- Audit Reports Permissions
- Compliance Audit Reports Permissions
- Credential Vault Permissions
- Package Distribution Permissions
- Package Manager Permissions
- Password Management Permissions
- User and Group Manager Permissions
- User Access Requests Permissions
- Deleting a User Group
- Managing Users
- Adding a User
- Modifying User
- Modify User: Groups
- Removing a User from a User Group
- Deleting a User
- Changing a User’s Password
- Assigning Permissions for LDAP Users
- Configuring External Authentication
- Configuring LDAP Server Settings
- Exporting the Certificate From the Active Directory Server
- Exporting the Certificate From the NetiQ eDirectory Server
- Importing Active Directory or eDirectory Certificates on RHEL or SLES Servers
- Advanced Authentication
- Benefits of Integration with Advanced Authentication
- Advanced Authentication Terminologies and Their Usage
- Checklist to Follow Before Enabling Secondary Authentication
- Configuring Advanced Authentication Server
- Supported Authentication Methods
- Configuring Advanced Authentication Server Settings
- Enabling Advanced Authentication for Privileged Access
- Secondary Authentication Server Setting
- Enabling Advanced Authentication for Privileged Access Manager
- Configuring RADIUS Server Settings
- OAuth2
- OAuth2 Roles
- OAuth2 Server Settings
- Integrating with NetIQ Advanced Authentication and Risk Service Using the OAuth2 Settings
- Configuring the Advanced Authentication OAuth 2.0 Event
- Configuring the OAuth2 Server Settings in Privileged Access Manager
- Configuring Server Settings
- Authentication
- Policy Engine
- Access Requests
- HTTPS Server
- Installing a Certificate
- Modifying the Connector
- Audit Settings
- Video Settings
- Command Risk
- Security Settings
- Working with Credentials
- Credential Vault
- Adding a Resource in Credential Vault
- Adding Extended Attributes
- Modifying Extended Attributes
- Enabling Resources for Discovery
- Deletion of Extended Attributes
- Adding a Resource to Resource Pool
- Removing a Resource from Resource Pool
- Sample Use Cases
- Defining Privileged Type for a Credential
- View Policy
- Create Path
- Configuring Privilege Type
- Encryption Methods in Credential Vault
- Just In Time Access Framework
- The Principle of Least Privilege
- Resource Types Supporting Different Types of Dynamic Secret
- Credential Checkout
- Configuring Credential Checkout for Application and Database Type Credentials
- Configuring Credential Checkout for Applications
- eDirectory
- Active Directory
- System Applications Product
- VMWare ESXi
- Local Account on Linux
- Local Accounts on Unix
- Local Accounts on Windows
- Enabling Credential Checkout for Applications
- Configuring Credential Checkout for Cloud Services
- Enabling Credential Checkout for OpenStack
- Enabling Credential Checkout for Amazon Web Services
- Enabling Credential Checkout for Microsoft Azure
- Configuring Credential Checkout Settings
- Checking Out Credentials
- Dynamic Credentials
- View Policy
- Create Path
- Configuring Privilege Type
- Password Reset Scripts
- Active Directory Password Reset Script
- AWS Password Reset Script
- ESXi User Password Reset Script
- LDAP Password Reset Script
- Linux User Password Reset Script
- Microsoft Azure Password Reset Script
- Openstack Password Reset Script
- SAP User Password Reset Script
- Windows User Password Reset Script
- What is Delegated Administrator Access
- Shared Keys
- Types of Shared Key
- Enabling the Key Checkout for Shared Key
- Managing Credentials for Shared Key
- Password Management
- Understanding Password Management for Windows, Active Directory, Linux, and Network Devices
- Prerequisites for Configuring Password Management
- Configuring Password Management
- Configuring Password Management in an Upgraded Setup
- Disabling Password Management
- Application to Application Password Management
- Password Management for Database and Applications
- Configuring AAPM
- Enabling Users to Generate API Tokens
- Viewing Activities Performed Using API Tokens
- Working With Access Policies
- Access Control
- Resource Pools
- Configuring a Resource Pool
- Resource Pool Groups
- Configuring a Resource Pool Group
- Understanding Resource Pool Groups with an Example
- User Roles
- Configuring a User Role
- Assignments and Permissions
- Privilege Elevation
- Time Restrictions
- Access and Monitoring Options
- Enhanced Access Control
- Command Lists
- Customizing Permissions
- Configuring Assignments
- Configuring Permissions
- Windows Agents
- UNIX Agents
- SSH Servers
- Telnet Servers
- Windows Servers
- Database Servers
- Applications
- Keys
- Advanced Configurations
- Application Command List
- Enhanced Access Control
- Scripts
- Exceptions
- Managing Exceptions
- Sample Scenarios to Configure Access Control
- Scenario 1
- Scenario 2
- Command Control
- Installing and Deploying Command Control
- Command Control Modules
- Installing Command Control
- Command Control User Interface
- Configuring Command Control
- Rules
- Command Control Groups
- User Groups
- Host Groups
- Adding an Account Group
- Modifying an Account Group
- Deleting an Account Group
- Copying a Group
- Moving a Group
- Finding a Group
- Commands
- Finding a Command
- Adding a Command
- Modifying a Command
- Setting the Command Risk
- Removing a Command Risk
- Copying a Command
- Moving a Command
- Deleting a Command
- Importing Sample Commands
- Finding a Reference
- Defining Custom Attributes
- Functions
- Adding a Category
- Deleting a Category
- Blocked Users
- Adding Users in Blocked Users Group
- Deleting Users in Blocked User Group
- Scripts
- Access Times
- Command Control Reports
- Command Control Options
- Importing and Exporting Command Control Configuration Data
- Importing Command Control Settings
- Importing Command Control Samples
- Command Control Transactions
- Test Suites
- Creating Default Objects
- Disconnecting a Privileged Session
- Prerequisites for Disconnecting a Session
- Disconnecting the Session Manually
- Disconnecting the Session Automatically
- Disconnecting a Session Based on Risk Level
- Disconnecting a Session Based on Expiry of an Emergency Access Request
- Viewing the Disconnect fields in the Reports Console
- SSH Relay Allow Commands
- Emergency Access Requests
- Configuring Emergency Access Settings
- Managing Emergency Access Requests
- Creating Emergency Access Requests
- Configuring Privileged Access
- Agent and Agentless Capability
- Sample Use Cases for Agentless Capability
- Securing and Monitoring Web Based RDP Sessions without Installing Privileged Access Manager Agent
- Examining the Elevated SSH Session without the Thick Client
- Privileged Access to Windows
- Work Flow to Configure Privileged Access for Windows
- Agent-Based Session Management In Windows
- Remote Desktop Protocol Relay
- Remote Desktop Protocol Web Relay
- Credential Provider
- Direct Remote Desktop Protocol
- Agentless Session Management in Windows
- Remote Desktop Protocol Web Relay
- Usage Scenarios for Agentless Windows RDP Relay
- Application Management
- Application SSO
- Run as Privileged User
- LDAP Group Lookup
- Creating the LDAP Account in the Credential Vault
- Defining the User Group
- Creating a Rule for the LDAP Group
- Modifying a Rule for the LDAP Group
- Enabling Virtual List View
- Privileged Access to UNIX and Linux
- Workflow to Configure UNIX and Linux Privileged Sessions
- Agent-Based Session Management in Unix and Linux
- pcksh
- cpcksh
- Secure Shell Relay
- Agentless Session Management in Unix and Linux
- Secure Shell Web Relay
- Accessing the Secure Shell Web Relay
- Transferring a File to Secure Shell Web Relay Session
- Usage Scenario for Agentless Secure Shell Web Relay
- Command Management
- usrun
- Enhanced Access Control
- Configuring a Command Control Policy
- Configuring a Path Policy
- Privileged Access to Databases
- Database Access Through Credential Checkout
- Configuring Credential Checkout for Oracle Database
- Checking Out Database Credentials
- Configuring Credential Checkout for Other Databases
- Create Database Monitoring Permissions Using Access Control
- Create Database Monitoring Permissions Using Command Control
- Checking Out Database Credentials
- Database Access Through Privileged Access Manager Proxy
- Prerequisite
- Adding Database Connectors Using Access Control
- Adding Database Connectors Using Command Control
- Managing Database Connectors
- Database Monitoring Using Access Control
- Adding Rules for Database using Command Control
- Viewing Database Activity
- Privileged Access to Applications and Cloud Services
- Configuring Just-in-Time Access
- Configuring Just-in-Time Access For AWS Resource
- Configuring Just-in-Time Access For PKI Resource
- Configuring Just-in-Time Access for SSH Certificate User
- Configuring Access for Application SSO
- RemoteApp Mode
- Configuring RemoteApp Mode Using Access Control
- Configuring RemoteApp Mode Using Command Control
- Configuring Application SSO Agents for Load Balancing
- Viewing Reports
- Direct Access Mode Using Access Control
- Direct Access Mode Using Command Control
- Configuring Direct Access Mode
- Viewing Reports
- Managing Reports
- Creating Reports
- Creating Reports for Sessions
- Creating Reports for Administrator Activities
- Creating Reports for Credential Checkouts
- Creating Reports for Shared Key Checkouts
- Customizing Reports
- Using Reports Settings
- Using Audit Settings
- Using Encryption Settings
- Using Video Report Filter Settings
- Viewing Report Data
- Filtering the Viewable Records
- Modifying General Report Information
- Selecting Log Files
- Replaying Keystrokes
- Removing a Report
- Generating an Activity Report
- Viewing a Report in a Comma-separated Values (CSV) Format
- Configuring Video Capture
- Configuring the Video Path (Optional)
- Configuring Video Archival (Optional)
- Configuring the Video Conversion Settings
- Enabling Video Capture
- Converting the FLV Videos to WebM
- Viewing the Videos
- Video Off-Load
- Setting Up Video Off-Load Agent
- Video Off-Load Settings
- Enabling Video Off-Load
- Change Log Reports
- Viewing Report Data
- Password Management
- Enabling Password Management
- Viewing Report Data
- Shared Key Management
- Enabling Shared Key Management
- Viewing Report Data
- Using Compliance Auditor
- Controlling Access to the Compliance Auditor
- Compliance Audit Rules
- Adding or Modifying an Audit Rule
- Compliance Audit Reports
- Adding, Copying and Modifying an Audit Report
- Sample Command Control Report Template
- Deleting a Report
- Compliance Auditor Records
- Viewing a Compliance Audit Record
- Viewing and Editing a Command Control Keystroke Report
- Viewing a Change Management Audit Record
- Viewing a Report Audit Record
- Editing an Audit Record
- Archiving Records
- Managing Archived Records
- Deployment Dashboard: Live Risk View
- Modifying ACL
- Deleting a User ACL
- Deploying the Compliance Auditor
- Integration with External Services
- Integrating with ArcSight Intelligence
- Example Scenarios
- Scenario: Compromised Account Detection
- Scenario: Insider Threats Detection
- Scenario: Accidental Insider Threats Detection
- Scenario: Compromised Network, Host, or Device Detection
- Configuring ArcSight Intelligence Details
- Integrating with Identity Manager
- Benefits of Integration with Identity Manager
- Integrating with Syslog Server
- Configuring Syslog Server Settings
- Integration with Ticketing Systems
- Configuration for Normal Access
- Configuration for Elevated Access
- Integrating with NetIQ Access Manager
- Command Line Options
- The unifi Options
- Command Control Options
- Importing and Exporting Command Control Settings
- Backing Up and Restoring a Command Control Configuration
- Running Test Suites
- Package Distribution Options
- Package Manager Options
- Install and Uninstall Packages
- Install and Uninstall Packages From Framework Manager
- Install and Uninstall Packages From Agent Machine
- Upgrade and Rollback Packages
- Registry Agent Options
- Registering an Agent
- Finding a Primary Manager Package
- Agent Status
- Adding Hosts and Domains
- Registry Manager Options
- Compliance Auditor Options
- Exporting and Importing Compliance Auditor Settings
- Managing Compliance Auditor Records
- sreplay Command Line Options
- Troubleshooting
- General Issues
- The Agent Is In An Offline State
- The Audit Events Are Not Displayed In The Reports Console Even When the Events Are Generated
- On AIX Platform, When the Audit Data Gets Generated In Large Amount, the Privileged Access Manager Service Restarts And An Error Is Displayed In the unifid.log File
- The RDP Relay Session Does Not Start From The User Console
- The RDP Relay To a Windows Server 2012 Server Fails
- The Privileged Session Is Not Established Through The Backup Manager
- The Changes To The Syslog Settings Do Not Get Applied
- The Manual Disconnect For a Windows Session Does Not Work
- The Run As privileged User Option Is Not displayed On A Windows 2012 Server
- Agent Registration Fails In Windows Platform
- Direct RDP Sessions Are Enabled For All Users By Default
- Issues When Updating Or Downloading The License Summary
- Failed To Connect To A Module
- The System Cannot Process The Details Because One or More Agents With DB Audit Module is in Offline State
- The System Cannot Process The Details Because Of A Disconnect With The Credential Vault Modules
- SSL Connection to Microsoft SQL Sever Fails with a Timeout Error
- RDP Relay to Windows 10 or Windows 2016 Fails With a Network Authentication Error
- SSO to Application Does Not Happen When There are multiple Concurrent Sessions to the Application SSO Host
- SSH Web Relay Session Gets Disconnected When the Credentials of the SSH resource Is Configured with OpenSSH Private Key
- SSO User Cannot Open Multiple Session on Chromium Based Browsers
- Allowing SSO Users to Access the Remote Desktop Session Without Adding Users to the Domain Admin Group
- Web RDP and RDP Relay Session are not Accessible for Users of the Protected Users Group
- Troubleshooting Issues Related with Managing Hosts
- Promoting Managers When the Primary Manager Fails
- Viewing Store and Forward Messages
- Managing Low Disk Space
- Restarting the Agent
- Managing the Registry Cache
- Viewing the Registry Cache
- Clearing the Registry Cache
- Time Synchronization
- Direct RDP is Disallowed When Privileged Access Manager Agents are Unable to Reach the Manager
- Issues While Integrating with Advanced Authentication
- Advanced Authentication Server is Inactive and Users Cannot Log In to Privileged Access Manager End-Points
- Appendix: Legacy Roles
- Appendix: Policy Templates
- Understanding Sample Policy template
- Importing Sample Policy Templates
- Adding a Policy Template
- Appendix: IPv6 Support
- Legal Notice