Chatee ahora con Soporte
Chat con el soporte

Safeguard Privilege Manager for Windows 4.6 - Administration Guide

TitlePageProxy Copyright Table of Contents About this guide What is Safeguard Privilege Manager for Windows? Installing Safeguard Privilege Manager for Windows Configuring Client data collection Configuring Instant Elevation Configuring Self-Service Elevation Configuring Temporary Session Elevation Configuring privileged application discovery Deploying rules Removing local admin rights Reporting Client-side UI customization Using Microsoft tools Maintaining a least privileged use environment Database Planning Product Improvement Program About us

Using Active Directory user groups (Privilege Elevation Rules only)

Use the Groups tab to add or remove an Active Directory user group from the security token of the target process. Removing a group decreases the privileges with which the process will run.

To add or remove an Active Directory user group using the Groups tab in the Create Rule Wizard

  1. If the Administrators group (stored within the BUILTIN\Administrators Active Directory OU) does not appear on the list by default, click to add it.

    • Select this group of users, who have complete and unrestricted access to a local computer, instead of domain administrators.

    • The button will not be active if the group is already on the list.

  2. Use the button to add or remove other groups. When the window opens:

  3. Click Browse to specify the group name.

  4. Select add or remove.

  5. To delete or modify a record within the Security Group list, select it and use the or button.

    • You can only add security groups in Active Directory which have a group scope property of Built-in local to the security token of a process on a client computer if the Client also has the same security identifier definition (SID) in its built-in security groups.

    • When removing a group from the security token, ensure that the user account under which the process is launched is a member of more than one primary group. Otherwise, the rule will not apply as intended.

Using Validation Logic

Detailed information about this topic

Available only in Safeguard Privilege Manager for Windows Professional Edition and Professional Evaluation Edition.

By default, a rule will apply to all client computers to which the previously selected GPO is linked. For more granular targeting, you can use the Standard Rules and Validation Logic Rules sub-tabs of the Validation Logic tab in the Create Rule Wizard to target the rule based on the client’s operating system, their IP address, and/or a logged-in user.

Using standard rules

Within the Standard Rules sub-tab in the Create Rule Wizard, you can set a rule to apply only to clients with specified operating systems, servers, or workstations. By default, all operating systems are selected. If no options are selected, then the rule will apply to all supported operating systems.

To use the Standard Rules sub-tab in the Create Rule Wizard

  • Select the Server check box in the Class section to apply the rule to your Windows Server installation.

  • Select the Workstation check box in the Class section to apply the rule to Windows 10.

  • In the Operating System section, select the check boxes for your operating systems.

Using Validation Logic rules

The Validation Logic Rules sub-tab in the Create Rule Wizard allows you to set additional parameters to target the rule. You can define whether the rule will run on computers with a prefix in the name, a group or IP address range, or a user currently logged in. For example, you can target the rule to computers belonging to OUs that end with DEPARTMENT and are in subnet 192.168.0.X, except for the IP address 192.168.0.1.

NOTE: Client Deployment Settings can only be targeted to specific computers and not to user accounts or groups.

Setting rule parameters

To set rule parameters using the Validation Logic Rules sub-tab in the Create Rule Wizard

  1. Click Add to open the Add Validation Logic Rule window.

  2. Select the type of rule:

Type of Rule

Action

Computer Group

Set a rule for one or several names, or partial names, of your Active Directory computer groups. Enter the NetBIOS name, for example:

DERPA\DOMAIN CONTROLLERS

User Group

Set a rule for one or several names, or partial names, of your Active Directory user groups. The group membership value you enter will be compared against the groups that the user belongs to during the logon process and must match for the configuration to be processed. Enter the NetBIOS name, for example:

DERPA\ADMINISTRATORS

User Name

Set a rule if specific users are logged into client computers. Enter the NetBIOS name, for example:

DERPA\HELPDESK

OU (Computer)

Set a rule for names, or partial names, of computer-based OUs or the Computers container in your Active Directory. The OU value you enter will be compared against the OU the client computer belongs to during the logon process and must match for the configuration to be processed. Enter the fully qualified domain name (FQDN), for example:

DERPA.DERPADEV.LOCAL\DOMAIN CONTROLLERS

  • To select OUs, select the OU checkboxes.

  • To select all containers (instead of OUs), select the domain so that it is highlighted.

  • To include child objects, highlight the parent object and check Include child objects.

OU (User)

Set a rule for names or partial names of the user-based OUs or the Users container in your Active Directory. The OU value you enter will be compared against the OU the user belongs to during the logon process and must match for the configuration to be processed. Enter the FQDN, for example:

DERPA.DERPADEV.LOCAL\USER ACCOUNTS

  • To select OUs, select the OU checkboxes.

  • To select all containers (instead of OUs), select the domain so that it is highlighted.

  • To include child objects, highlight the parent object and check Include child objects.

Computer Name

Set a rule for computers with names or partial names. Enter the FQDN, for example:

DERPA.DERPADEV.LOCAL\PASERVER

IP Address Range (v4/v6)

Set a rule for IP addresses or ranges of computers.

Registry Key Exists

Set a rule based on the registry keys on client computers.

File Exists

Set a rule for files on the client computer or on the network. Specify a file that must exist on the client computer or on the network in order for the rule to run, for example:

\\ComputerName\SharedFolder\Filename.exe DriveLetter:\Filename.exe

NOTE: On the Type tab of the Create Rule Wizard, check the User’s context will be used to resolve system and resource access check box to ensure that the rule will apply.

Date and Time Range

Define when a rule should start and/or stop being enforced.

Select the check boxes before the date and/or time fields in the Date Range / Time Range sections.

In the Date Range and Time Range sections:

  1. Set the values.

  2. The rule will apply according to the time/date parameters of the Console used to create the rule.

User’s context will be used to resolve system and resource access to ensure that the rule will apply.

  1. Specify the rule's parameters in the dialog window that will display on the right:

    • Use the common asterisk (*) and question mark (?) wildcards in the validation value, as necessary.

      • * : Stands for no or any number of any characters

      • ? : Stands for a single character

    • Check the NOT check box to exclude the items specified from the rule.

    • For Computer Group, User Group, User Name, OU (Computer), OU (User), and Computer Name use one of the following options:

      • Use the Name field to specify the rule's value manually (see example values in the table above), and then click the button.

      • Use the Browse button to select the items available on your network. You can filter the items by the first letters. Wildcards are not supported in the Filter field.

      The desired value will be added to the list. You may add as many rule values as necessary.

  2. Click OK when you are finished specifying the settings within the rule type. The record will display in the main Validation Logic Rules list.

  3. To add another Validation Logic rule, repeat the steps above.

  4. Add or combine Validation Logic rules with AND or OR Boolean logic. By default, rules will combine with OR Boolean logic. To make the rule use the AND operator, select AND at the bottom of the Validation Logic Rules window.

  5. To edit a rule setting:

    1. Within the Validation Logic Rules list, double-click a rule value or click Edit.

    2. Make changes in the dialog.

  6. When finished specifying Validation Logic rules, click Next. If the Display Advanced Options check box has not been selected, complete the rule creation process.

Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación