The Configure a User Deny Entry policy manages the Safeguard Authentication Services users.deny file. This file dictates users and groups that are explicitly denied access to the machine. Deny rules take precedence over allow rules.
To setup a users deny policy
-
Navigate to the UNIX Settings > Safeguard Authentication Services > Access Control node.
-
Double-click users.deny Configuration in the result pane to open the users.deny Configuration Properties dialog.
-
Click Browse AD to add a container. All users under this container are denied access.
-
Click Add Group to add a group. All members of the specified group are denied access.
-
Click Add User to add a specific user. The specified user is denied access.
-
Click Add Domain to add a domain. All users in the specified domain are denied access.
-
Click Add Custom to add an item manually. You must specify the correct type for the item. All users associated with the item are denied access.
-
Click OK to save settings and close the dialog.
Display specifiers are Active Directory objects that provide information about how other objects in the directory display in client applications.
NOTE: The Register Display Specifiers link is only displayed in the Control Center when display specifiers are not already registered with Active Directory. If the display specifiers are registered, Control Center does not display the link.
Because it is common to use the Find dialog in ADUC to manage users and groups, One Identity recommends that you register display specifiers with Active Directory. Registering display specifiers provides the following benefits:
NOTE: You must have Enterprise Administrator rights to register display specifiers.
You can inspect exactly which changes are made during the display specifier registration process by viewing the DsReg.vbs script found in the Safeguard Authentication Services installation directory. You can use this script to unregister display specifiers at a later time.
To register display specifiers with Active Directory
-
From a Windows management workstation with Safeguard Authentication Services installed, navigate to Start > Quest Software > Safeguard Authentication Services > Control Center.
-
Click Preferences on the left navigation panel.
-
Expand the Display Specifiers section.
NOTE: The Register Display Specifiers link is only displayed in the Control Center when display specifiers are not already registered with Active Directory. If the display specifiers are registered, Control Center does not display the link.
-
Click the Register Display Specifiers link to register display specifiers with Active Directory.
While it is registering the display specifiers with Active Directory, Control Center displays a progress indicator. When the process is complete, Control Center indicates that display specifiers are registered.
Alternatively, you can register display specifiers from the command line, as follows:
-
Log in as a user with Enterprise Administrator rights.
-
Open a command prompt, navigate to the Safeguard Authentication Services installation directory, and run this command:
DsReg.vbs /add
NOTE: To register One Identity Active Directory display specifiers with One Identity Active Directory, navigate to the installed location for Safeguard Authentication Services and run the following command:
DsReg.vbs /add /provider:EDMS
You must install the One Identity Active Directory management package locally or DsReg.vbs returns an "Invalid Syntax" error.
To see all the DsReg.vbs options, run the following command:
DsReg.vbs /help
If you want to unregister display specifiers, perform the following steps.
NOTE: You must have Enterprise Administrator rights to unregister display specifiers.
To unregister display specifiers in Active Directory
-
Log in as a user with Enterprise Administrator rights.
-
Open a command prompt and navigate to the Safeguard Authentication Services installation directory.
-
Run the DsReg.vbs script with the /remove option:
DsReg.vbs /remove
NOTE: To unregister display specifiers with One Identity Active Roles, run the following command:
DsReg.vbs /remove /provider:EDMS
To see all the DsReg.vbs options, run the following command:
DsReg.vbs /help
A SUCCESS message appears indicating that the display specifiers were removed successfully.
