Chat now with support
Chat with Support

Safeguard Privilege Manager for Windows 4.6 - Administration Guide

TitlePageProxy Copyright Table of Contents About this guide What is Safeguard Privilege Manager for Windows? Installing Safeguard Privilege Manager for Windows Configuring Client data collection Configuring Instant Elevation Configuring Self-Service Elevation Configuring Temporary Session Elevation Configuring privileged application discovery Deploying rules Removing local admin rights Reporting Client-side UI customization Using Microsoft tools Maintaining a least privileged use environment Database Planning Product Improvement Program About us

Using the Temporary Session Elevation Passcode Manager

Before you configure Temporary Session Elevation settings, ensure the following components are set up:

  1. The Client is running on the computers you want to apply the settings to.

  2. The Server is configured and running with the port that you have selected allowed for incoming data (the default port is 8003).

  3. Client data collection settings are enabled for the selected GPO.

  4. The Client is enabled to use offline passcodes to create Temporary Elevated Sessions (enabled in the Client Deployment Settings wizard).

To use the Temporary Session Elevation Wizard to set up privileges

  1. Open the wizard:

    1. Open Passcode Manager from the Temporary Session Elevation section on the navigation pane of the Console.

  2. Create a new passcode:

    1. Click New to start the Instant Elevation TSE passcode generator.

  3. Enable the Instant On Demand Privilege Elevation settings on the State tab.

    • Choose Enabled, to ensure the settings apply to the selected GPO.

    • Choose Not Configured, to enable child GPOs to inherit settings from their parent.

  4. Use the Groups tab to alter the settings. By default, users of the target GPO will automatically inherit the administrator's settings (BUILTIN\Administrators).

  5. Complete the advanced options in the Privileges, Integrity and Validation Logic tabs.

  6. The Passcode is created on the next tab, Passcode.

    1. Enter a Title to describe the passcode.

    2. Enter a Maximum allowed usage. This is the number of times the passcode can be used before expiring.

    3. Enter a Duration. The duration is the amount of time the passcode remains active, after being activated.

    4. Optionally, select the check box to End all elevated processes (and child processes) when Passcode duration expires. If selected, all windows that are opened with a Temporary Session Elevation passcode are closed.

    5. Click Export to file to save the passcode for end-user use.

  7. Click Finish to complete the wizard.

    1. The passcode is delivered to the user for usage.

  8. Run a Temporary Session Elevation Usage Report to view the processes that have been launched. For more information, see Temporary Session Elevation Request Report.

Configuring privileged application discovery

Detailed information about this topic

Available only in Safeguard Privilege Manager for Windows Professional Edition and Professional Evaluation Edition.

Use the Privileged Application Discovery Settings Wizard to collect information about the privileged applications used over your network during a specified time period. By default, once this feature is enabled, it is set to collect information for two weeks, but you can adjust the setting.

Using the Privileged Application Discovery Settings Wizard

NOTE: Before you configure privileged application discovery settings, ensure the following components are set up:

  1. The Client is running on the computers you want to apply the settings to;

  2. The Server is configured and running with the port that you have selected allowed for incoming data (the default port is 8003); and

  3. Client data collection settings are enabled for the selected GPO.

To use the Privileged Application Discovery Settings Wizard to set up, modify, or discard settings

  1. Open the wizard by completing one of the following steps:

    • Open the Privileged Application Discovery Settings Wizard from the Setup Tasks section. It always shows the default settings.

    • On the Advanced Policy Settings tab of the target GPO, double-click Privileged Application Discovery Settings. The changes made within the wizard are saved here.

  2. Enable the Privileged Application Discovery Settings on the State tab.

    • Choose Enabled, to ensure the settings apply to the selected GPO.

    • Choose Not Configured, to enable child GPOs to inherit settings from their parent.

  3. Use the Settings tab to set the period during which the settings apply and the data is collected (a month by default).

  4. Click Next to use Validation Logic to target the settings to specific client computers or user accounts within the GPO, or click Finish to save your settings and quit.

If an error message indicates that the target GPO is not selected:

  1. Click OK to close the message window.

  2. Open the GPO tab and select the desired GPO.

  3. Click Next to use the Filters tab to filter out Application Discovery data according to different application specific criteria.

    On the Filters tab, select the check box to enable application filters.

    Enter filter criteria in one or more of the available boxes:

    • Executable path contains

    • Product name contains

    • Publisher name contains

    • File description contains

    An application only needs to meet a single filter criteria in order for its Application Discovery data to be filtered out. A comma delimiter can be used to enter multiple criteria in each filter box.

    NOTE: The Privilege Manager Client does not transmit any Application Discovery data for one or more applications that meet any of the existing filter criteria.

  4. Click Save on the GPO toolbar to save the new settings.

Processing discovered privileged applications

Once a privileged process starts (or failed to start) on a client computer, the corresponding information is sent to the Server and displayed in the Privileged Application Discovery section of the Console (provided that your environment is properly configured according to the Maximum Sleep Time setting).

You can only view data stored in the database of the server that is selected in the Server configuration (under Setup Tasks > Configure a Server).

When processing a discovered privileged application, you can either create a rule for it so that a user without elevated privileges can launch it, or choose to mark it as processed so that it will not display in the list (unless the filter is specifically set to display it).

Use the Generate Rules wizard to automatically create a number of rules for different types of applications in one pass. Rules are created based on the preferences with which the application was started. You can select an application and view its preferences in the Privileged Applications Discovered grid.

Processing discovered privileged applications

Detailed information about this topic

Once a privileged process starts (or failed to start) on a client computer, the corresponding information is sent to the Server and displayed in the Privileged Application Discovery section of the Console (provided that your environment is properly configured according to the Maximum Sleep Time setting).

You can only view data stored in the database of the server that is selected in the Server configuration (under Setup Tasks > Configure a Server).

When processing a discovered privileged application, you can either create a rule for it so that a user without elevated privileges can launch it, or choose to mark it as processed so that it will not display in the list (unless the filter is specifically set to display it).

Use the Generate Rules wizard to automatically create a number of rules for different types of applications in one pass. Rules are created based on the preferences with which the application was started. You can select an application and view its preferences in the Privileged Applications Discovered grid.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating