Privileged Account Manager Administration Guide
- Privileged Account Manager Administration Guide
- NetIQ Privileged Account Manager - An Overview
- Key Features of Privileged Account Manager
- Primary Components
- Framework Manager
- Framework Agent
- The Privileged Account Manager User Interface
- New Console: Navigation Pane
- Changing Password
- Old Console: Navigation Pane
- Getting Started
- Managing Privileges in Various Endpoints
- Language Support
- Discovering Privileged Accounts
- Types of Accounts Discovered
- Administrative Accounts
- Service Accounts
- Launching Privileged Account Sniffer
- Configuring Privileged Account Sniffer
- Discovering Accounts
- Discovery Reports
- Filtering Report Data
- Importing and Exporting Configuration
- Managing Framework Hosts
- Managing Domains
- Creating a Domain
- Modifying a Domain
- Deleting a Domain
- Managing and Monitoring Hosts
- Deployment Dashboard
- Customizing Deployment Dashboard
- Adding a Host
- Viewing Host Details
- Modifying a Host
- Registering Hosts
- Deleting a Host
- Moving a Host
- Finding a Host
- Monitoring Hosts
- Viewing the Host Status
- Viewing the Host Log
- Modifying Log Settings
- Example Rollover Script
- Managing System Alerts
- Modifying Alert Settings
- Enabling Crash Dump Capture
- Managing Host Packages
- Finding Packages on Hosts
- Updating Packages for a Host
- Rolling Back Packages
- Committing Packages
- Registering and Unregistering Packages for a Host
- Installing Packages on a Host
- Uninstalling Packages from a Host
- Modifying Audit Settings for the Audit Manager Package
- Configuring SMTP Server Settings
- Configuring Settings for the dbaudit Package
- Managing Audit Zones
- Securing Access to the Framework Manager Console
- Requesting a Certificate for the Framework Manager Console
- Installing a Certificate
- Modifying the Connector
- SSL Renegotiation DOS Attack Protection
- Managing Users and Groups
- Managing Groups
- Predefined User Groups
- Adding a User Group
- Modifying a User Group
- Configuring Permissions
- Administration
- Access Control Permissions
- Agent Management Permissions
- Audit Reports Permissions
- Compliance Audit Reports Permissions
- Credential Vault Permissions
- Package Distribution Permissions
- Package Manager Permissions
- Password Management Permissions
- User and Group Manager Permissions
- User Access Requests Permissions
- Deleting a User Group
- Managing Users
- Adding a User
- Modifying User
- Modify User: Groups
- Removing a User from a User Group
- Deleting a User
- Changing a User’s Password
- Assigning Permissions for LDAP Users
- Configuring External Authentication
- Configuring LDAP Server Settings
- Exporting the Certificate From the Active Directory Server
- Exporting the Certificate From the NetiQ eDirectory Server
- Importing Active Directory or eDirectory Certificates on RHEL or SLES Servers
- Advanced Authentication
- Benefits of Integration with Advanced Authentication
- Advanced Authentication Terminologies and Their Usage
- Checklist to Follow Before Enabling Secondary Authentication
- Configuring Advanced Authentication Server
- Supported Authentication Methods
- Configuring Advanced Authentication Server Settings
- Enabling Advanced Authentication for Privileged Access
- Secondary Authentication Server Setting
- Enabling Advanced Authentication for Privileged Account Manager
- Configuring RADIUS Server Settings
- Configuring Privileged Access
- Policy Engine
- Access Control
- Components of Access Control
- Resource Pools
- User Roles
- Assignments
- Permissions
- Exceptions
- Example Scenarios
- Configuring Resource Pools
- Adding a Resource Pool
- Modifying a Resource Pool
- Deleting a Resource Pool
- Default Credential
- Configuring User Roles
- Adding a User Role
- Modifying a User Role
- Deleting a User Role
- Configuring Assignments
- Adding an Assignment
- Modifying an Assignment
- Deleting an Assignment
- Configuring Permissions
- Windows Agents
- UNIX Agents
- SSH Servers
- Telnet Servers
- Windows Servers
- Database Servers
- Applications
- Application SSO
- Keys
- Adding a Permission
- Modifying a Permission
- Deleting a Permission
- Advanced Configurations
- Application Command List
- Enhanced Access Control
- Enhanced Access Control Policy on Windows
- Enhanced Access Control Policy on Linux/Unix
- Scripts
- Configuring Exceptions
- Managing Exceptions
- Command Control
- Installing and Deploying Command Control
- Command Control Modules
- Auditing Modules
- Compliance Auditor Modules
- Installing Command Control
- Command Control User Interface
- Configuring Command Control
- Rules
- Adding a Rule
- Modifying a Rule
- Viewing Conditions for a Rule
- Setting Conditions for a Rule
- Removing Conditions for a Rule
- Configuring Script Arguments and Entities for a Rule
- Assigning a Script to a Rule
- Removing Script Arguments and Entities
- Removing a Script from a Rule
- Finding a Rule
- Moving a Rule
- Copying a Rule
- Linking a Rule
- Deleting a Rule
- Viewing Pseudocode
- Command Control Groups
- User Groups
- User Groups
- Adding a User Group
- Modifying a User Group
- Deleting a User Group
- Host Groups
- Adding a Host Group
- Modifying a Host Group
- Deleting a Host Group
- Adding an Account Group
- Modifying an Account Group
- Deleting an Account Group
- Copying a Group
- Moving a Group
- Finding a Group
- Commands
- Finding a Command
- Adding a Command
- Modifying a Command
- Using the Command Rewrite Functionality for Command Arguments
- Configuring Auditing with the Rewrite Functionality
- Setting the Command Risk
- Removing a Command Risk
- Copying a Command
- Moving a Command
- Deleting a Command
- Importing Sample Commands
- Finding a Reference
- Defining Custom Attributes
- Functions
- Syntax
- Options
- Keywords
- Adding a Category
- Deleting a Category
- Blocked Users
- Adding Users in Blocked Users Group
- Deleting Users in Blocked User Group
- Scripts
- Finding a Script
- Adding a Script
- Modifying a Script
- Copying a Script
- Moving a Script
- Deleting a Script
- Sample Scripts
- Access Times
- Finding an Access Time
- Adding an Access Time
- Modifying an Access Time
- Copying an Access Time
- Moving an Access Time
- Deleting an Access Time
- Command Control Reports
- Finding a Report
- Adding a Command Control Report
- Modifying a Command Control Report
- Copying a Command Control Report
- Moving a Command Control Report
- Deleting a Command Control Report
- Command Control Options
- Importing and Exporting Command Control Configuration Data
- Exporting Command Control Settings
- Importing Command Control Settings
- Importing Command Control Samples
- Command Control Transactions
- Enabling Transactions and Configuring Settings
- Making Command Control Configuration Changes with Transactions Enabled
- Committing a Transaction
- Backing Up and Restoring
- Defining Audit Settings
- Test Suites
- Adding a Test Suite
- Adding or Modifying a Test Case
- Running a Test Suite
- Viewing a Test Suite
- Modifying a Test Suite
- Deleting a Test Case
- Deleting a Test Suite
- Importing a Test Suite
- Exporting a Test Suite
- Creating Default Objects
- Disconnecting a Privileged Session
- Prerequisites for Disconnecting a Session
- Disconnecting the Session Manually
- Disconnecting the Session Automatically
- Disconnecting a Session Based on Risk Level
- Disconnecting a Session Based on Expiry of an Emergency Access Request
- Viewing the Disconnect fields in the Reports Console
- SSH Relay Allow Commands
- Emergency Access Requests
- Configuring Emergency Access Settings
- Agent and Agentless Capability
- Agent and Agentless Capabilities in Privileged Account Manager - Tabular Overview
- Privileged Access to Windows
- Work Flow to Configure Privileged Access for Windows
- Agent-Based Session Management In Windows
- Remote Desktop Protocol Relay
- Configuring the RDP Relay
- Accessing the RDP Relay
- Remote Desktop Protocol Web Relay
- Usage Scenario for Agent-based Windows Web RDP Relay
- Credential Provider
- Configuring Credential Provider
- Direct Remote Desktop Protocol
- Configuring Direct RDP
- Agentless Session Management in Windows
- Remote Desktop Protocol Web Relay
- Advantages of Configuring the Remote Desktop Protocol Web Relay
- Accessing the Remote Desktop Protocol Web Relay
- Usage Scenarios for Agentless Windows RDP Relay
- Application Management
- Application SSO
- Run as Privileged User
- Configuration to Run as Privileged user
- Accessing Windows System to Run as privileged user
- LDAP Group Lookup
- Creating the LDAP Account in the Credential Vault
- Defining the User Group
- Creating a Rule for the LDAP Group
- Modifying a Rule for the LDAP Group
- Enabling Virtual List View
- Privileged Access to UNIX and Linux
- Workflow to Configure UNIX and Linux Privileged Sessions
- Agent-Based Session Management in Unix and Linux
- pcksh
- Privileged Session Using pcksh
- Complete Session Control Using pcksh
- Using Shell Scripts
- cpcksh
- Configuring cpcksh for Complete Session Capture
- Accessing cpcksh for Complete Session Capture
- Usage Scenario
- Secure Shell Relay
- Configuring an SSH Relay Session
- Accessing an SSH Relay Session
- Usage Scenarios for Agent-Bases Secure Shell Relay
- Agentless Session Management in Unix and Linux
- Secure Shell Web Relay
- Configuring the Secure Shell Web Relay
- Usage Scenario for Agentless Secure Shell Web Relay
- Command Management
- usrun
- usrun Command Syntax
- Configuring usrun Command for Privileged Access
- Accessing usrun for Privileged Access
- Usage Scenario
- Enhanced Access Control
- Configuring a Command Control Policy
- Configuring a Path Policy
- Privileged Access to Databases
- Database Access Through Credential Checkout
- Configuring Credential Checkout for Oracle Database
- Configuring Credential Checkout for Other Databases
- Create Database Monitoring Permissions Using Access Control
- Create Database Monitoring Permissions Using Command Control
- Checking Out Database Credentials
- Database Access Through Privileged Account Manager Proxy
- Prerequisite
- Adding Database Connectors Using Access Control
- Adding Database Connectors Using Command Control
- Adding Database Connector for Oracle
- Adding Database Connector for Microsoft SQL Server
- Adding Database Connector Using Port Number
- Adding Microsoft SQL Server Connector Using Named Instance
- Adding Database Connector for Other Databases
- Managing Database Connectors
- Viewing Database Connectors
- Removing Database Connectors
- Modifying Database Connectors for an Agent
- Database Monitoring Using Access Control
- Adding Rules for Database using Command Control
- Viewing Database Activity
- Privileged Access to Applications and Cloud Services
- Application SSO
- RemoteApp Mode
- Configuring RemoteApp Mode Using Access Control
- Add a Permission
- Configuring RemoteApp Mode Using Command Control
- Adding a Rule
- Configuring Application SSO Agents for Load Balancing
- Viewing Reports
- Direct Access Mode Using Command Control
- Configuring Direct Access Mode
- Prerequisite
- Adding a Credential Vault
- Adding Rules
- Viewing Reports
- Setting Up Application SSO Using Putty
- Working with Credentials
- Credential Checkout
- Configuring Credential Checkout for Applications
- Enabling Credential Checkout for Applications
- Configuring Credential Checkout for Cloud Services
- Enabling Credential Checkout for OpenStack
- Enabling Credential Checkout for Amazon Web Services
- Enabling Credential Checkout for Microsoft Azure
- Configuring Credential Checkout Settings
- Checking Out Credentials
- Password Reset Scripts
- Active Directory Password Reset Script
- AWS Password Reset Script
- ESXi User Password Reset Script
- LDAP Password Reset Script
- Linux User Password Reset Script
- Microsoft Azure Password Reset Script
- Openstack Password Reset Script
- SAP User Password Reset Script
- Windows User Password Reset Script
- Shared Keys
- Types of Shared Key
- Enabling the Key Checkout for Shared Key
- Managing Credentials for Shared Key
- Password Management
- Understanding Password Management
- Password Management for Windows, Active Directory, Linux, and Network Devices
- Prerequisites
- Configuring Password Management
- Configuring Password Management in an Upgraded Setup
- Disabling Password Management
- Password Management for Database and Applications
- Application to Application Password Management
- Configuring AAPM
- Enabling Users to Generate API Tokens
- Viewing Activities Performed Using API Tokens
- Reports
- Creating Reports
- Sessions
- Administrator Activities
- Credential Checkouts
- Shared Key Checkouts
- Creating Custom Reports
- Using Reports Settings
- Using Audit Settings
- Using Encryption Settings
- Using Video Report Filter Settings
- Viewing Report Data
- Filtering the Viewable Records
- Modifying General Report Information
- Selecting Log Files
- Replaying Keystrokes
- Removing a Report
- Generating an Activity Report
- Viewing a Report in a Comma-separated Values (CSV) Format
- Configuring Video Capture
- Configuring the Video Path (Optional)
- Configuring Video Archival (Optional)
- Configuring the Video Conversion Settings
- Enabling Video Capture
- Converting the FLV Videos to WebM
- Viewing the Videos
- Video Off-Load
- Setting Up Video Off-Load Agent
- Video Off-Load Settings
- Enabling Video Off-Load
- Change Log Reports
- Viewing Report Data
- Password Management
- Enabling Password Management
- Viewing Report Data
- Shared Key Management
- Enabling Shared Key Management
- Viewing Report Data
- Using Compliance Auditor
- Controlling Access to the Compliance Auditor
- Compliance Audit Rules
- Adding or Modifying an Audit Rule
- Compliance Audit Reports
- Adding, Copying and Modifying an Audit Report
- Sample Command Control Report Template
- Deleting a Report
- Compliance Auditor Records
- Viewing a Compliance Audit Record
- Viewing and Editing a Command Control Keystroke Report
- Viewing a Change Management Audit Record
- Viewing a Report Audit Record
- Editing an Audit Record
- Archiving Records
- Managing Archived Records
- Deployment Dashboard: Live Risk View
- Modifying ACL
- Deleting a User ACL
- Deploying the Compliance Auditor
- Integration with External Services
- Integrating with ArcSight Intelligence
- Example Scenarios
- Scenario: Compromised Account Detection
- Scenario: Insider Threats Detection
- Scenario: Accidental Insider Threats Detection
- Scenario: Compromised Network, Host, or Device Detection
- Configuring ArcSight Intelligence Details
- Integrating with Identity Manager
- Benefits of Integration with Identity Manager
- Integrating with Sentinel Server
- Configuring Syslog Server Settings
- Integration with Ticketing Systems
- Configuration for Normal Access
- Configuration for Elevated Access
- Integrating with NetIQ Access Manager
- Command Line Options
- The unifi Options
- Command Control Options
- Importing and Exporting Command Control Settings
- Backing Up and Restoring a Command Control Configuration
- Running Test Suites
- Package Distribution Options
- Package Manager Options
- Install and Uninstall Packages
- Install and Uninstall Packages From Framework Manager
- Install and Uninstall Packages From Agent Machine
- Upgrade and Rollback Packages
- Registry Agent Options
- Registering an Agent
- Finding a Primary Manager Package
- Agent Status
- Adding Hosts and Domains
- Registry Manager Options
- Compliance Auditor Options
- Exporting and Importing Compliance Auditor Settings
- Managing Compliance Auditor Records
- sreplay Command Line Options
- Troubleshooting
- General Issues
- The Agent is in an Offline State
- The Audit Events are Not Displayed in the Reports Console Even When the Events are Generated
- On an AIX Platform, When the Audit Data Gets Generated in Large Amount, The Privileged Account Manager Service Restarts and an Error is Displayed in the unifid.log file.
- The RDP Relay Session Does Not Start From the User Console
- The RDP Relay to a Windows Server 2012 Server Fails
- The Privileged Session is Not Established Through the Backup Manager
- The Changes to the Syslog Settings Do Not Get Applied
- The Manual Disconnect for a Windows session Does Not Work
- The Run as privileged user Option is not displayed on a Windows 2012 Server
- Agent Registration Fails on a Windows Platform
- Direct RDP Sessions are Enabled for all Users By Default
- Issues When Updating or Downloading the License Summary
- Failed to connect to module
- The system cannot process the details because one or more agents that have the DB Audit module is in Offline state
- The system cannot process the details because it cannot contact any of the Credential Vault modules
- SSL Connection to Microsoft SQL Sever Fails with a Timeout Error
- RDP Relay to Windows 10 or Windows 2016 Fails with a Network Authentication Error
- SSO to Application Does Not Happen When There are multiple Concurrent Sessions to the Application SSO Host
- Troubleshooting Issues Related with Managing Hosts
- Promoting Managers When the Primary Manager Fails
- Viewing Store and Forward Messages
- Managing Low Disk Space
- Restarting the Agent
- Managing the Registry Cache
- Viewing the Registry Cache
- Clearing the Registry Cache
- Time Synchronization
- Direct RDP is Disallowed When Privileged Account Manager Agents are Unable to Reach the Manager
- Issues While Integrating with Advanced Authentication
- Advanced Authentication Server is Down and Users Cannot Log In to Privileged Account Manager End-Points
- Appendix: Legacy Roles
- Appendix: Policy Templates
- Understanding Sample Policy template
- Importing Sample Policy Templates
- Adding a Policy Template
- Legal Notice