Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Password Manager 5.14 - Administration Guide

Table of Contents

About Password Manager

Password Manager overview

Getting started

Different sites for different roles Password Manager components Licensing

Installing the license Updating the license Telephone verification feature license

Installing Password Manager: Checklist Installing Password Manager

Configuring the Password Manager service account and the application pool identity Enabling HTTPS Installing Password Manager Initializing instance Installing Password Manager Self-Service Site and Helpdesk Site on a standalone server FailSafe support in Password Manager Installing multiple instances of Password Manager

Specifying Custom Certificates for Authentication and Traffic Encryption Between Password Manager Service and Websites

Step 1: Obtain and install custom certificates from a trusted Windows-based certification authority Step 2: Providing certificate issued for server computer to Password Manager Service Step 3: Providing certificate issued for client computers to Self-Service and Helpdesk Sites

Configuring Management Policy

Configuring user scope

Configuring permissions for domain management account Adding domain connection

Enabling LDAP over SSL

Specifying advanced settings for domain connection

Domain Controller Active Directory Sites Propagating changes

Propagating account-related changes Propagating Q&A profile-related changes Propagating password-related changes

Changing domain management account Removing a domain connection User logon requirements

Password Manager architecture

Password Manager components and third-party applications

Password Manager Service and Administration Site Self-Service Site Helpdesk Site Password Policy Manager Secure Password Extension Offline Password Reset Migration Wizard TeleSign SQL Server Database and SQL Server Reporting Services One Identity Quick Connect Sync Engine Defender Password Manager Secure Token Server RADIUS Two-Factor Authentication Redistributable Secret Management Service Location sensitive authentication Password Manager permission checker Working with Power BI templates Password Manager Credential Checker

Typical deployment scenarios

Simple deployment Deployment of the Password Manager Self-Service and Helpdesk Sites on standalone servers Realm deployment Multiple realm deployment

Password Manager in a perimeter network

Installing Password Manager in perimeter network with read-only domain controllers Installing Password Manager in perimeter network with reverse proxy Installing Password Manager in perimeter network without AD DS

Management Policy overview

Management Policy components Management Policy and other Password Manager settings

Password policy overview

Using One Identity password policies Using fine-grained password policies Applying multiple password policies Using Password Policy Manager

Secure Password Extension overview

Locating Self-Service Site

Obtaining Self-Service Site URL from service connection point Changing the Self-Service Site URL on the Administration Site

Launching user notification

reCAPTCHA overview

How reCAPTCHA works How to use reCAPTCHA V2 on Password Manager sites System requirements for using reCAPTCHA References

User enrollment process overview Questions and Answers policy overview

Q&A Policy and authentication Q&A policy and user enforcement

Password change and reset process overview

Resetting and changing password in connected systems Enforcing password history when resetting password Replicating password changes

Data replication

Storing data Replicating data Changing replication settings

Phone-based authentication service overview

How phone-based authentication works How to use phone-based authentication System requirements

Management policies

Checklist: Configuring Password Manager Understanding Management Policies Adding or cloning a new Management Policy Configuring access to the Administration Site Configuring access to the Password Manager Self-Service Site Configuring access to the Helpdesk Site

Specifying advanced settings for domain connection

Active Directory Sites

Propagating changes

Changing the domain management account Removing a domain connection

Configuring Questions and Answers policy

Creating secret questions Adding secret questions Editing and deleting secret questions Configuring Q&A profile settings

Workflow overview

Workflow structure Workflow state Workflow settings

Custom workflows

Importing and exporting workflows

Custom activities

Custom activity settings Creating custom activities Importing and exporting custom activities Removing custom activities

Password Manager Self-Service Site workflows

Configuring the country code drop-down menu

Manage My Profile Forgot My Password Manage My Passwords Unlock My Account My Notifications I Have a Passcode task Password Manager Self-Service Site activities overview

Authentication activities

Display CAPTCHA Authentication methods Authenticate with password Authenticate with Q&A profile (random questions) Authenticate with Q&A Profile (specific questions) Authenticate with Q&A Profile (User-selected questions) Authenticate with Defender Authenticate with external provider Authenticate with RADIUS Two-Factor Authentication Authenticate via phone Authenticate with passcode

Action activities

Register Manage My Profile Edit Q&A Profile Reset Password in Active Directory Changing passwords in Active Directory Reset Password in Active Directory and Connected Systems Changing password in Active Directory and connected systems Reset password in connected systems through embedded connectors Unlock account Enable Account Force user to change password at next logon Subscribe to notifications Lock Q&A Profile Display user agreement Restart workflow if error occurs Issue BitLocker Recovery Key Provide product feedback

Notification activities

Customizing notifications Email user if workflow succeeds Email user if workflow fails Email administrator if workflow succeeds Email administrator if workflow fails

Helpdesk workflows

Assign Passcode Reset Password Unlock Account Unlock Profile Verify User Identity Enforce Update of Profile Helpdesk Activities Overview

Authentication activities

Authentication methods Authenticate with Q&A Profile Authenticate via phone Authenticate with Defender Authenticate with RADIUS Two-Factor Authentication

Action activities

Reset Password in Active Directory Reset Password in Active Directory and Connected Systems Unlock account Enable Account Force user to change password at next logon Assign Passcode Unlock Q&A Profile Enforce Update of Q&A Profile Restart workflow if error occurs

Notification activities

Customizing notifications Email user if workflow succeeds Email user if workflow fails Email administrator if workflow succeeds Email administrator if workflow fails

User enforcement rules

Invite users to create/update profiles Remind users to create/update profiles

Forced enrollment

Disable user account Enable user account

Remind users to change password

General Settings

General Settings overview Search and logon options

Configuring account search options

Partial user search on external network

Configuring Security Settings

Hiding the domain user name on the Self-Service Site Hiding personally identifiable information for logged-in users Configuring anti-bot security settings

Configuring CAPTCHA security images Configuring reCAPTCHA security settings

Importing and exporting configuration settings

Exporting configuration settings Importing configuration settings

Outgoing mail servers Diagnostic logging Scheduled tasks

Invitation to Create/Update Profile Task Reminder to Create/Update Profile Task Reminder to Change Password Task Active Directory Sites Maximum Password Age Policy Task User Status Statistics Task Clear Old Records from Reporting Database Environment Health Checker Task Update RADIUS server status

Web Interface customization Instance reinitialization

Modifying service connection settings Modifying advanced settings

Realm Instances Domain Connections

Using domain connections Specifying access account for domain connections Changing the access account for domain connections Specifying advanced settings for domain connection

Active Directory sites

Propagating changes

Propagating account-related changes Propagating Q&A profile-related changes Propagating password-related changes

Removing a domain connection

Extensibility features

Extensibility features overview

RADIUS Two-Factor Authentication

Working with RADIUS servers

Internal Feedback Customizing help link URL Password Manager components and third-party applications

Password Manager Secure Token Server Configuring Password Manager Secure Token Server

Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account

Redistributable Secret Management Service supported platforms Customizing Redistributable Secret Management log path

Email templates

Upgrading Password Manager

Upgrade requirements About Secure Password Extension Upgrading multiple instances of Password Manager Upgrading Password Manager

In-place upgrade from 5.8.2 or later versions to 5.14.0 Manual upgrade from 5.9.x or later versions Running the Migration Wizard Modifying the service account Converting Q&A Profiles

Upgrading Secure Password Extension Upgrading Password Policy Manager

Administrative Templates

Installing Administrative Templates Configuring Administrative Templates Updating Administrative Templates Removing Administrative Templates

Secure Password Extension

Configuring access to the Self-Service Site from the Windows login screen

Introducing Secure Password Extension Understanding how Secure Password Extension works

Locating Self-Service Site Obtaining Self-Service Site URL from service connection point Changing the Self-Service Site URL on the Administration Site Changing the Self-Service Site URL in the Administrative Template Launching user notification

Deploying and configuring Secure Password Extension

Deploying Secure Password Extension Configuring Secure Password Extension

Overriding automatic Self-Service Site location Password Manager Realm Affinity

Managing Secure Password Extension using Administrative Templates

Generic Settings

Uninstalling Secure Password Extension

Logging in Secure Password Extension

Password Policies

About Password Policies

Password Policy Manager Password Policy Rules

Installing Password Policy Manager Uninstalling Password Policy Manager Creating and Configuring a Password Policy

Configuring Password Policy Rules

Password Compliance Password Age Rule Length Rule Complexity Rule Required Characters Rule Disallowed Characters Rule Sequence Rule User Properties Rule Dictionary Rule Symmetry Rule Custom Rule

Managing Password Policy scope

Applying Password Policies Changing policy priority

Deleting a Password Policy

Enable 2FA for administrators and helpdesk users Reporting

Reporting and User Action History overview

Using Reports User Action History Managing Connections to SQL Server and Report Server Setting up Reporting environment

Best practices for configuring Reporting Services

Reporting Services default configuration Reporting Services firewall issues

Password Manager integration Accounts used in Password Manager

Password Manager Service account Application pool identity Domain management account Password policy account Account for using One Identity Quick Connect

Open communication ports for Password Manager Customization options overview

Customization of steps in Password Manager Self-Service Site, and Helpdesk Tasks Email notification customization User agreement customization Account search options customization Web Interface customization Customization of Password Policies list Customization of Password strength meter Customization of user name

Third-party contributions Glossary

Reporting Services firewall issues

Reporting > Best practices for configuring Reporting Services > Reporting Services firewall issues

If Password Manager fails to operate properly when Reporting Services are separated from Password Manager by a firewall, specific ports should be open in the firewall.

To get the complete list of Password Manager server port numbers, that have to be open for the application to function properly, see Open communication ports for Password Manager.

Password Manager integration

Password Manager integration

Accounts used in Password Manager

Accounts used in Password Manager

The following accounts can be used in Password Manager:

Password Manager Service account
Application pool identity
Domain management account
Password policy account
Account for One Identity Quick Connect Sync Engine

Password Manager Service account

Accounts used in Password Manager > Password Manager Service account

Password Manager Service account is used to install Password Manager. For Password Manager to run successfully, Password Manager Service account must be a member of the Administrators group on the Web server where Password Manager is installed.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center