Account Discovery tab (add asset)
The Account Discovery tab is only available after Active Directory Asset has been created. On the Account Discovery tab, the default is Do not perform account discovery.
Table 49: Account Discovery tab properties
| Description |
Select the description of the Account Discovery job desired and the details of the configuration display.
Click  Add to add a job or  Edit to edit the job. You can click the drop-down and select Do not perform account discovery. |
| Partition |
The partition in which to manage the discovered assets or accounts. |
| Discovery Type |
The type platform, for example, Windows, Unix, or Directory. |
|
Directory |
The directory for account discovery. |
| Schedule |
Click Schedule to control the job schedule.
Select Run Every to run the job along per the run details you enter. (If you clear Run Every, the schedule details are lost.)
-
Configure the following.
To specify the frequency without start and end times, select from the following controls. If you want to specify start and end times, go to the Use Time Window selection in this section.
- Minutes: The job runs per the frequency of minutes you specify. For example, Every 30 Minutes runs the job every half hour over a 24-hour period. It is recommended you do not use the frequency of minutes except in unusual situations, such as testing.
-
Hours: The job runs per the minute setting you specify. For example, if it is 9 a.m. and you want to run the job every two hours at 15 minutes past the hour starting at 9:15 a.m., select Runs Every 2 Hours @ 15 minutes after the hour.
-
Days: The job runs on the frequency of days and the time you enter.
For example, Every 2 Days Starting @ 11:59:00 PM runs the job every other evening just before midnight.
-
Weeks The job runs per the frequency of weeks at the time and on the days you specify.
For example, Every 2 Weeks Starting @ 5:00:00 AM and Repeat on these days with MON, WED, FRI selected runs the job every other week at 5 a.m. on Monday, Wednesday, and Friday.
-
Months: The job runs on the frequency of months at the time and on the day you specify.
For example, If you select Every 2 Months Starting @ 1:00:00 AM along with First Saturday of the month, the job will run at 1 a.m. on the first Saturday of every other month.
-
Select Use Time Windows if you want to enter the Start and End time. You can click add or - delete to control multiple time restrictions. Each time window must be at least one minute apart and not overlap.
For example, for a job to run every ten minutes every day from 10 p.m. to 2 a.m., enter these values:
Enter Every 10 Minutes and Use Time Windows:
If you have selected Days, Weeks, or Months, you will be able to select the number of times for the job to Repeat in the time window you enter.
For a job to run two times every other day at 10:30 am between the hours of 4 a.m. and 8 p.m., enter these values:
For days, enter Every 2 Days and set the Use Time Windows as Start 4:00:00 AM and End 20:00:00 PM and Repeat 2.
- Time Zone: Select the time zone.
|
| Rules |
You may click Add,  Delete, Edit, or  Copy to update the Rules grid.
Details about the selected account discovery setting rules may include the following based on the type of asset.
- Name: Name of the discovery job
- Rule Type: What the search is based on. For example, the rule may be Name based or Property Constraint based if the search is based on account properties. For more information, see Adding an Account Discovery rule.
- Filter Search Location: If a directory is searched, this is the container within the directory that was searched.
- Auto Manage: A check mark displays if discovered accounts are automatically added to Safeguard for Privileged Passwords.
- Set default password: A check mark displays if the rule causes default passwords to be set automatically.
- Assign to Profile: The partition profile assigned
- Assign to Sync Group: A check mark displays if the rule automatically associated the accounts with a password sync group.
- Enable Password Request: A check mark displays if the passwords is available for release.
- Enable Session Request: A check mark displays if session access is enabled.
|
Connection tab (add asset)
On the Connection tab, choose an Authentication Type (see the table that follows) and specify the service account credentials. The type of asset specified in the Product field on the Management tab determines the authentication types available for the asset. If the asset has a custom platform, the Custom Properties elements are displayed. For more information, see Custom platforms.
Table 50: Connection tab: Asset authentication types
| SSH Key |
To authenticate to the asset using an SSH authentication key. |
| Directory Account |
To authenticate to the asset using a directory account from an external identity store such as Microsoft Active Directory.
|
| Local System Account |
For SQL Server assets, to authenticate to the asset using a local system account, which is a Windows user account on the server that is hosting the SQL database. |
| Password (local service account) |
To authenticate to the asset using a local service account and password. |
| Account Password |
When the function account credentials are not in the custom script, for example, Amazon Web Services. For more information, see Adding a cloud platform account. |
| Access Key |
For Amazon Web Services assets, to authenticate to the asset using an access key. For more information, see Adding a cloud platform account. |
|
Custom |
No authentication information is taken because the custom parameters or parameters in a customer platform script are used. No accounts associated with the asset are stored. For more information, see Custom platforms. |
| None |
No authentication information is taken and check/change functions are disabled. No accounts associated with the asset are stored. |
|
Test Connection |
Verify that Safeguard can log in to the asset using the service account credentials that you have provided. |
|
Timeout |
Enter the connection timeout period. |
Client ID: For SAP assets, enter the client ID.
Custom platform properties
If the Product field on the Management tab identified a custom platform, complete the dialog based on the custom properties of the custom platform script. Safeguard for Privileged Passwords checks to ensure the values match the type of the property that include a string, boolean, integer, or password (which is called secret in the API scripts). Safeguard for Privileged Passwords cannot check the validity or system impact of values entered for custom platforms. For more information, see Creating a custom platform script.
About service accounts
Safeguard for Privileged Passwords uses a service account to connect to an asset to securely manage accounts and passwords on that asset. Therefore, a service account needs sufficient permissions to edit the passwords of other accounts.
When you add an asset, Safeguard for Privileged Passwords adds its service account to the list of Accounts and designates it with a 
Service Account icon. By default, Safeguard for Privileged Passwords automatically manages the service account password according to the check and change schedules in the profile that governs its asset. For more information, see Creating a profile.
When adding a service account, Safeguard for Privileged Passwords automatically disables it from access requests. If you want the password to be available for release, click 
Access Requests and select Enable Password Request. If you want to enable session access, select Enable Session Request.
TIP:As a best practice, if you do not want Safeguard for Privileged Passwords to manage a service account password, add the account to a profile that is set to never change passwords.
If you delete a service account, Safeguard for Privileged Passwords changes the asset's authentication type to None, which disables automatic password management for all accounts that are associated with this asset. A user can continue to check out the passwords, however, if the policy that governs the account requires that it change the password after release, the password can get stuck in a pending password reset state. For more information, see Password is pending a reset.
Test connectivity
The most common causes of failure in Safeguard for Privileged Passwords are either connectivity issues between the appliance and the managed system, or problems with service accounts. If you experience issues, first verify that you can access the managed system from another system (independent of Safeguard for Privileged Passwords), using the service account. For more information about troubleshooting connectivity issues, see Test Connection failures and Connectivity failures.
About Test Connection
When adding an asset, Test Connection verifies that Safeguard for Privileged Passwords can log in to the asset using the service account credentials that you have provided.
When adding an asset that requires an SSH host key, Test Connection first discovers the key and presents it to you for acceptance. When you accept it, Test Connection then verifies that Safeguard for Privileged Passwords can log in to the asset using the service account credentials that you have provided.
Once you save the new asset, Safeguard for Privileged Passwords saves the service account credentials. Safeguard for Privileged Passwords uses these credentials to connect to an asset to securely manage accounts and passwords on that asset. For more information, see About service accounts.
If you want to verify an existing asset's connectivity, use the Check Connection right-click command. For more information, see Checking an asset's connectivity.
