Chat now with support
Chat mit Support

Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Activity Center Search box Privileged access requests Toolbox Accounts Account Groups Assets
General/Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Asset Groups Discovery Entitlements Linked Accounts Partitions Profiles Settings
Access Request settings Appliance settings Asset Management settings Tags Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings Security Policy Settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Troubleshooting

One Identity recommends the following resolutions to some of the common problems you may encounter as you deploy and use Safeguard for Privileged Passwords. For more information about how to troubleshoot Safeguard for Privileged Passwords, refer to the Appliance settings.

Related Topics

Frequently asked questions

Appliance is sick

There are so many possible root causes for a sick appliance. If you receive an error that the appliance is sick take the following steps.

  1. Check network connectivity between nodes.
  2. Wait (up to 30m) to see if the error resolves automatically.
  3. If the error persists, create a support bundle and contact support. For more information, see Support bundle.
Categories of appliance sick events by error message prefix

There are 6 categories for appliance sick events which can be distinguished by the error message prefix.

Audit Log is sick : <reason>

There is an error in the underlying audit log database. The reason will provide more details about the exact issue. Typically this is due to loss of consensus as a result of network connectivity. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes. After ruling out network connectivity, generate a support bundle and contact Support. Do not reboot the appliance until consulting with Support. In some cases, rebooting the appliance can make the condition worse.

Access Request Workflow is sick : <reason>

There is an error in the underlying password workflow database. The reason will provide more details about the exact issue. Typically this is due to loss of consensus as a result of network connectivity. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes. After ruling out network connectivity, generate a support bundle and contact Support.

Policy Data is sick : <reason>

There is an error in the underlying policy database. The reason will provide more details about the exact issue. Typically this occurs when a replica has lost network connectivity to the primary. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes. After ruling out network connectivity, generate a support bundle and contact Support.

Cluster Connectivity is sick : <reason>

There is an error in the VPN connection between Safeguard nodes. The reason will provide more details about the exact issue. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes on the public IP address since the VPN is tunneled over the public IP. After ruling out network connectivity, generate a support bundle and contact Support.

Appliance Resource Usage is sick : <reason>

A Safeguard process or underlying database is exhibiting unexpectedly high OS resource usage (CPU, Memory, Disk). The reason will provide more details about the exact issue. Restarting the appliance may resolve this issue. If the problem persists or recurs frequently, generate a support bundle and contact Support.

Sessions Module is sick : <reason>

There is an error in the embedded sessions module. This issue can occur only on SPP 2.x as the internal sessions module was removed in later versions. Typically, restarting the sessions module will resolve this issue. If the problem persists after restarting the sessions module, generate a support bundle and contact Support.

Connectivity failures

The most common causes of failure in Safeguard for Privileged Passwords are either connectivity issues between the appliance and the managed system, or problems with service accounts.

Always verify network connectivity and asset power before troubleshooting.

The following topics explain some possible reasons that Check Password, Change Password, and Set Password may fail, and gives you some corrective steps you can take.

Change password or SSH key fails

A local account password or SSH key change can fail when you are using a Windows asset that is configured with a service account with Administrative privileges, other than the built-in Administrator.

NOTE: Before Safeguard for Privileged Passwords can change local account passwords on Windows systems, using a member of an administrators group other than built-in Administrator, you must change the local security policy to disable User Account Control (UAC) Admin Approval Mode (Run all administrators in Admin Approval Mode) option.

To configure Windows assets to change account passwords

  1. Run secpol.msc from the Run dialog,

    -OR-

    From the Windows Start menu, open Local Security Policy.

  2. Navigate to Local Policies | Security Options.
  3. Disable the User Account Control: Run all administrators in Admin Approval Mode option.
  4. Restart your computer.

For more information, see Preparing Windows systems.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen