Chat now with support
Chat mit Support

Password Manager 5.14 - Administration Guide

About Password Manager Getting started Password Manager architecture
Password Manager components and third-party applications Typical deployment scenarios Password Manager in a perimeter network Management Policy overview Password policy overview Secure Password Extension overview reCAPTCHA overview User enrollment process overview Questions and Answers policy overview Password change and reset process overview Data replication Phone-based authentication service overview
Management policies
Checklist: Configuring Password Manager Understanding Management Policies Adding or cloning a new Management Policy Configuring access to the Administration Site Configuring access to the Password Manager Self-Service Site Configuring access to the Helpdesk Site Configuring Questions and Answers policy Workflow overview Custom workflows Custom activities Password Manager Self-Service Site workflows Helpdesk workflows Notification activities User enforcement rules
General Settings
General Settings overview Search and logon options Importing and exporting configuration settings Outgoing mail servers Diagnostic logging Scheduled tasks Web Interface customization Instance reinitialization Realm Instances Domain Connections Extensibility features RADIUS Two-Factor Authentication Internal Feedback Customizing help link URL Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable 2FA for administrators and helpdesk users Reporting Password Manager integration Accounts used in Password Manager Open communication ports for Password Manager Customization options overview Third-party contributions Glossary

Deploying Secure Password Extension

Secure Password Extension is deployed on client computers through Group Policy. You can create a new Group Policy object (GPO) or use an existing one to assign the installation package with Secure Password Extension for installing it on the destination computers. Secure Password Extension is then installed on computers to which the GPO applies. Depending on the operating system running on the destination computers, you must apply either of the following installation packages included on the installation CD:

  • SecurePasswordExtension_x86.msi: Installs Secure Password Extension on computers running x86 versions of operating systems.

  • SecurePasswordExtension_x64.msi: Installs Secure Password Extension on computers running x64 versions of operating systems.

You can modify the behavior and on-screen appearance of Secure Password Extension components by configuring an administrative template's settings, and then applying the template to the target computers through Group Policy.

The administrative template is available in only one format: prm_gina.admx.

The prm_gina.admx administrative template file is located in the \Password Manager\Setup\Template\Administrative Template\ folder of the installation CD. This administrative template is designed to be used with Windows Server 2016 or later operating systems. Before using this administrative template, copy the prm_gina.admx and prm_gina.adml files from the installation CD to the following locations: %systemroot%\SYSVOL\domain\Policies\PolicyDefinitions(for the prm_gina.admx file) and %systemroot%\SYSVOL\sysvol\domain\Policies\PolicyDefinitions\en-US (for the prm_gina.adml file).

Alternatively, you could use the Administrative Template configuration tool to copy and use the admx templates.

Follow the steps below to configure and deploy the Secure Password Extension on end-user computers.

To deploy and configure Secure Password Extension

  1. Copy the required installation package (SecurePasswordExtension_x86.msi or SecurePasswordExtension_x64.msi) from the installation CD to a network share accessible from all domain controllers where you want to install Secure Password Extension. The MSI packages are located in the \Password Manager\Setup\ folder of the installation media.

  2. Create a GPO and link it to all computers, sites, domains, or Organizational Units where you want to use Secure Password Extension. You may also choose an existing GPO to use with Secure Password Extension.

  3. Open the Group Policy Management Editor in the Group Policy Management, and then do the following:

    • Expand Computer Configuration/Policies/Software Settings, right-click Software installation, and then select New > Package.

    • Browse for the MSI package you have copied in step 1, and then click Open.

    • In the Deploy Software window, select a deployment method and click OK.

    • Verify and configure the properties of the installation, if needed.

Configuring Secure Password Extension

This section describes how to override automatic location of the Self-Service Site and customize Secure Password Extension.

Overriding automatic Self-Service Site location

By default, Secure Password Extension uses service connection points published in Active Directory to locate the Self-Service site. If you need to override the default behavior and force Secure Password Extension to use a specific Self-Service site, you must manually specify the URL path and override the default behavior of Secure Password Extension.

To override automatic Self-Service site location

  1. Click the Start button, click Run, and type mmc. Click OK.

  2. In the Console window on the File menu, click Add/Remove Snap-in.

  3. Double-click Group Policy Management Editor in the list of available snap-ins.

  4. In the Group Policy Wizard window, click Browse, select Default Domain Policy and click OK.

  5. Click Finish to exit Group Policy Wizard.

  6. Click OK.

  7. Login to the Active Directory Domain Controller machine with Administrative Privileges.

  8. Copy the Administrative Template Configuration folder from <CD >/Password Manager/Setup/Tools.

  9. Copy the Administrative Template folder into the Machine from <CD>/Password Manager/Setup/Template.

  10. Double click QPM.AdministrativeTemplateConfiguration.exe tool from the Administrative Template Configuration folder.

  11. In the Password Manager Administrative Template Configuration windows, browse the Administrative Template folder path and verify the path to Policy Definitions.

  12. Click Execute to run the tool.

  13. Once the execution is complete, click Exit to close the window.

  14. Launch the Group Policy Management utility.

  15. Right click the domain, and then on the shortcut menu, click Create a GPO in the domain and Link it here to link the policy.

  16. Enter a name to the New GPO. For example, OneIdentity.

  17. Right click the new GPO (OneIdentity) and select Enforced to apply the policy.

  18. Right click the new GPO (OneIdentity) and select Edit.

  19. To view the latest Administrative Template, follow the steps mentioned below

    1. Expand the newly created GPO.

    2. Go to Computer Configuration > Policies.

    3. Expand Administrative Templates: Policy Definitions(ADMX files) retrieved from the central store > One Identity Password Manager > Generic Settings.

  20. Double-click Specify URL path to the Self-Service site.

  21. Select the Enabled option on the Settings tab and then enter the URL path to the Self-Service site into the entry field using the following format: https://COMPUTER_NAME/PMSelfService/, where COMPUTER_NAME is the name of the server in which the Self-Service site is installed. Substitute https:// with http:// if you don’t use HTTPS.

    IMPORTANT: It is strongly recommended that you enable HTTPS on the Password Manager server.

  22. Click OK. The specified URL will be used only if service connection points are unavailable or if the Self-Service site URL specified in the service connection point cannot be found. If you want Secure Password Extensions to always use the specified URL, perform the following steps.

  23. Double-click Override URL path to the Self-Service site.

  24. Select the Enabled option on the Settings tab.

  25. Click OK.

  26. Apply the updated policy to the computers in the managed domain.

    NOTE: Application of the updated policy to the computers in the managed domain may take some time to complete.

Password Manager Realm Affinity

In some instances, you may want Secure Password Extension to contact only specific Password Manager Service instances when locating the Self-Service site. You can force Secure Password Extension to use only Password Manager Service instances that belong to a specific Password Manager realm.

Password Manager realm is one or more Password Manager instances sharing common configuration (the same user and helpdesk scopes, Management Policies and workflow configuration, general settings). Normally, you add a member to a Password Manager realm by installing a new Password Manager instance and selecting the A replica of an existing instance option during instance initialization. To learn more about Password Manager realms, see Installing multiple instances of Password Manager.

To force Secure Password Extension to use only Password Manager Service from a specific realm, you must set the Secure Password Extension affinity for that realm.

To set Secure Password Extension affinity for a Password Manager realm

  1. Open the Administration site of the Password Manager Service instance that belongs to the target realm.

  2. On the Administration site home page, click General Settings > Realm Instances.

  3. Select the value of the Realm affinity ID setting, right-click the selection and select Copy.

  4. On the domain controller machine, click the Start button, click Run, and type mmc. Click OK.

  5. In the Console window on the File menu, click Add/Remove Snap-in.

  6. Double-click Group Policy Management Editor in the list of available snap-ins.

  7. In the Group Policy Wizard window, click Browse, select Default Domain Policy and click OK.

  8. Click Finish to exit Group Policy Wizard.

  9. Click OK.

  10. Login to the Active Directory Domain Controller machine with Administrative Privileges.

  11. Copy the Administrative Template Configuration folder from <CD>/Password Manager/Setup/Tools.

  12. Copy the Administrative Template folder into the Machine from <CD>/Password Manager/Setup/Template.

  13. Double click QPM.AdministrativeTemplateConfiguration.exe from the Administrative Template Configuration folder.

  14. In the Password Manager Administrative Template Configuration windows, browse the Administrative Template folder path and verify the path to Policy Definitions.

  15. Click Execute to run the tool.

  16. Once the execution is complete click Exit to close the window, and launch the Group Policy Management utility.

  17. Right click the domain node, and on the shortcut menu, click Create a GPO in the domain and Link it here to link the policy.

  18. Enter a name to the New GPO. For example, OneIdentity.

  19. Right click the new GPO (OneIdentity) and select Enforced to apply the policy.

  20. Right click the new GPO (OneIdentity) and select Edit.

  21. To view the latest Administrative Template, follow the steps mentioned below.

    1. Expand the newly created GPO.

    2. Go to Computer Configuration > Policies.

    3. Expand Administrative Templates: Policy Definitions (ADMX files) retrieved from the central store > One Identity Password Manager > Generic Settings.

  22. In the right pane, double-click Password Manager Realm Affinity..

  23. Select the Enabled option on the Settings tab, then right-click the Realm Affinity ID text box, and select Paste.

  24. Click OK.

  25. Apply the updated policy to the computers in the managed domain.

    NOTE: Application of the updated policy to the computers in the managed domain may take some time to complete.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen