User groups contain users who are allowed, or not allowed, to submit or run commands controlled by the rules that you specify. You can add user groups to the specified rule conditions to control whether the rule is processed, depending on the user who is submitting a command or the user who is specified to run a command. You can also use user groups as script entities.
Command Control has the default user groups, Everyone and Submit User. Do not modify these groups.
Everyone: Use this group to match against any user who has a local account on the hosts where Privileged Account Manager is installed.
Submit User: Use this group to match against the user that submitted the privileged request. This is useful if you want to ensure that a rule only authorizes access to the account that submitted the request. For example when adding a cpcksh login shell, you should add a clause to the rule that ensures that the run user is in the Submit User group. This ensures that a user cannot use the -u option in usrun to gain access to other accounts.
You can search for a specific user in a user group by using suitable regular expressions, strings, or wild cards in the command. For example, the wildcards that you can use in the command could be vi * or /usr/bin/vi *.
To add a regular expression term to the list, prefix the regular expression with =~. For example,
=~/^vi .*$/
=~/^user*/
Command Control also includes a user group that is used for adding or deleting the users in the blocked list.
IMPORTANT:The User Name for Windows user must be provided in capital letters.
The following sections explain how to manage user groups: