You can uninstall a desktop client.
To uninstall the desktop client
- In the Windows Control Panel, open Programs and Features.
- Right-click the Safeguard for Privileged Passwords application and choose Uninstall.
Introduction
System requirements and versions
Desktop client system requirements
Web client system requirements
Web management console system requirements
Supported platforms
Licenses
Long Term Support (LTS) and Feature Releases
Using API and PowerShell tools
Using the virtual appliance and web management console
Cloud deployment considerations
Setting up Safeguard for Privileged Passwords for the first time
Step 1: Create the Authorizer Administrator
Step 2: Authorizer Administrator creates administrators
Step 3: Appliance Administrator configures the appliance
Step 4: User Administrator adds users
Step 5: Asset Administrator adds managed systems
Step 6: Security Policy Administrator adds access request policies
Using the web client
Home
My Requests (web client)
Personal password vault (web client)
Approvals (web client)
Reviews (web client)
Favorites (web client)
My Settings (web client)
Log out (web client)
Getting started with the desktop client
Using the desktop client
Settings (desktop client)
User information and log out (desktop client)
Desktop client favorite request
Desktop client navigation pane
Activity Center
Applying search criteria
Saving search criteria
Generating an activity audit log report
Scheduling an activity audit log report
Editing or deleting a saved search or scheduled report
Viewing event details
Auditing request workflow
Filtering report results
Sorting report results
Search box
Privileged access requests
Configuring alerts
Password release request workflow
Toolbox
Accounts
Requesting a password release
Approving a password release request
Reviewing a completed password release request
SSH key release request workflow
Requesting an SSH key release
Approving an SSH key release request
Reviewing a completed SSH key release request
Session request workflow
General tab/Properties (account)
Owners tab (account)
Access Request Policies tab (account)
Account Groups tab (account)
Dependent Assets (account)
Check and Change Log tab (account)
Discovered SSH Keys (account)
History tab (account)
Managing accounts
Account Groups
Adding an account
Adding a cloud platform account
Manually adding a tag to an account
Adding an account to one or more account groups
Deleting an account
Adding users or user groups to an account
Importing objects
Checking, changing, or setting an account password
Viewing password archive
Checking, changing, or setting an SSH key
Viewing SSH key archive
General/Properties tab (account group)
Accounts tab (account group)
Access Request Policies tab (account group)
History tab (account group)
Managing account groups
Assets
General/Properties tab (asset)
Accounts tab (asset)
Account Dependencies tab (asset)
Owners tab (asset)
Access Request Policies tab (asset)
Asset Groups tab (asset)
Discovered SSH Keys (asset)
Discovered Services tab (asset)
History tab (asset)
Managing assets
Asset Groups
Adding an asset (desktop client)
General tab (add asset desktop client)
Management tab (add asset desktop client)
Connection tab (add asset desktop client)
Adding an asset (web client)
About service accounts
About Test Connection
SSH Key (add asset desktop client)
Directory Account (add asset desktop client)
Starling Connect (add asset desktop client)
Local System Account (add asset desktop client)
Password (local service account desktop client)
Access Key (add asset desktop client)
None
Attributes tab (add asset desktop client)
General tab (add asset web client)
Connection tab (add asset web client)
Checking an asset's connectivity
Assigning an asset to a partition
Assigning a profile to an asset
Manually adding a tag to an asset
Adding an account to an asset
Adding account dependencies
Adding users or user groups to an asset
Adding an asset to asset groups
Deleting an asset
Account Discovery tab (add asset)
Importing objects
Downloading a public SSH key
About service accounts
About Test Connection
SSH Key (web client)
Directory Account (web client)
Starling Connect (web client)
Local System Account (web client)
Password (local service account web client)
Access Key (web client)
None
Management tab (add asset web client)
Attributes tab (edit asset web client)
General/Properties tab (asset group)
Assets tab (asset group)
Access Request Policies tab (asset group)
History tab (asset group)
Managing asset groups
Discovery
Asset Discovery
Entitlements
Asset Discovery job workflow
Adding an Asset Discovery job
Asset Discovery Results
Account Discovery
Account Discovery Results
Discovered Accounts
Service Discovery Results
Discovered Services
SSH Key Discovery
General tab (asset discovery)
Information tab (asset discovery)
Rules/Asset Discovery Rules tab (asset discovery)
Deleting an Asset Discovery job
Add Condition (asset discovery)
Edit Connection Template (asset discovery)
Add Asset Profile (asset discovery)
Schedule tab (asset discovery)
Summary tab (asset discovery)
General tab (entitlements)
Users tab (entitlements)
Access Request Policies tab (entitlements)
History tab (entitlements)
Managing entitlements
Linked Accounts
Partitions
Adding an entitlement (desktop client)
Adding an entitlement (web client)
How Safeguard for Privileged Passwords evaluates policy when a user submits an access request
Creating an access request policy (desktop client)
General tab (create access request policy desktop client)
Scope tab (create access request policy desktop client)
Requester tab (create access request policy desktop client)
Approver tab (create access request policy desktop client)
Reviewer tab (create access request policy desktop client)
Access Config tab (create access request policy desktop client)
Session Settings tab (create access request policy desktop client)
Time Restrictions tab (create access request policy desktop client)
Emergency tab (create access request policy desktop client)
Creating an access request policy (web client)
General tab (create access request policy web client)
Security tab (create access request policy web client)
Scope tab (create access request policy web client)
Workflow tab (create access request policy web client)
Adding users or user groups to an entitlement
Deleting an access request policy
Modifying an access request policy
Copying an access request policy
Viewing and editing policy details
Deleting an entitlement
About profiles
General/Properties tab (partitions)
Assets tab (partitions)
Accounts tab (partitions)
Owners tab (partitions)
Password Profiles tab (partitions)
SSH Key Profiles tab (partitions)
History tab (partitions)
Managing partitions
Profiles
Adding a partition
Adding assets to a partition
Adding an account to a partition (web client)
Removing assets from a partition
Adding users or user groups to a partition
Creating a password profile
Creating an SSH key profile
Setting a default partition
Setting a default profile
Assigning assets or accounts to a password profile and SSH key profile
Deleting a partition
Password Profiles (profiles)
Settings
Properties tab (profiles)
Assets tab (profiles)
Accounts tab (profiles)
View Password Profile Components (profiles)
SSH Key Profiles (profiles)
Managing profiles
Access Request settings
Appliance settings
Users
Appliance Diagnostics
Appliance Information
Debug
Enable or disable A2A and audit log stream
Factory Reset
Licensing settings
Lights Out Management (BMC)
Network Diagnostics
Networking
Operating System Licensing
SSH Algorithms
Patch Updates
Power
Support bundle
Time
Updates
Asset Management settings
Tags
Adding a tag for tagging of assets or asset accounts
Deleting an asset or asset account tag
Modifying an asset or asset account tag
Copying an asset or asset account tag to another partition
Viewing asset and asset account tag assignments
Backup and Retention settings
About backups
Archive servers
Audit Log Maintenance
Backup and Restore
Certificates settings
Run Now
Download a backup
Upload a backup
Restore a backup
Archive backup
Backup settings
Backup protection settings
Backup Retention
Authorize VM Compatible Backups (web client)
About Certificate Signing Requests (CSRs)
Audit Log Signing Certificate
Certificate Signing Request
Hardware Security Module Certificates
Cluster settings
Enable or Disable Services settings
External Integration settings
Installing a Hardware Security Module client certificate
Assigning a Hardware Security Module client certificate
Uploading a Hardware Security Module server certificate
SMTP Certificate
SSL/TLS Certificates
Creating an SSL/TLS Certificate Signing Request
Installing an SSL/TLS certificate
Assigning an SSL/TLS certificate to appliances
Syslog Client Certificate
Trusted CA Certificates
Application to Application
Password Management settings
Real-Time Reports
Safeguard Access settings
SSH Key Management settings
About Application to Application functionality
Setting up Application to Application
Adding an application registration
Deleting an application registration
Regenerating an API key
Making a request using the Application to Application service
Approval Anywhere
Email
Email Templates
Hardware Security Module
SNMP
Starling
Cloud Assistant
Syslog
Syslog Events
Ticketing systems
ServiceNow ticketing system integration
Remedy ticketing system integration
Not integrated with ticketing system
Trusted Servers, CORS, and Redirects
Change SSH Key settings
Check SSH Key settings
Discover SSH Key settings
SSH Key Sync Groups settings
Security Policy Settings
General/Properties tab (user)
User Groups tab (user)
Owned Objects tab (user)
Entitlements tab (user)
Linked Accounts tab (user)
History (user)
Managing users
User Groups
Adding a user
Identity tab (add user)
Authentication tab (add user)
Location tab (add user)
Permissions tab (add user)
Requiring secondary authentication log in
Adding a user to user groups
Adding a user to entitlements
Linking a directory account to a user
Activating or deactivating a user account
Deleting a user
Importing objects
Setting a local user's password
Unlocking a local user's account
General/Properties tab (user groups)
Users tab (user groups)
Entitlements tab (user groups)
History tab (user groups)
Managing user groups
Disaster recovery and clusters
Enrolling replicas into a cluster
Unjoining replicas from a cluster
Maintaining and diagnosing cluster members
Administrator permissions
About Offline Workflow Mode
Failing over to a replica by promoting it to be the new primary
Activating a read-only appliance
Diagnosing a cluster member
Patching cluster members
Using a backup to restore a clustered appliance
Resetting a cluster that has lost consensus
Performing a factory reset
Unlocking a locked cluster
Troubleshooting tips
Appliance Administrator permissions
Asset Administrator permissions
Auditor permissions
Authorizer Administrator permissions
Help Desk Administrator permissions
Operations Administrator permissions
Security Policy Administrator permissions
User Administrator permissions
Preparing systems for management
Preparing ACF - Mainframe systems
Preparing Amazon Web Services platforms
Preparing Cisco devices
Preparing Dell iDRAC devices
Preparing VMware ESXi hosts
Preparing Fortinet FortiOS devices
Preparing F5 Big-IP devices
Preparing HP iLO servers
Preparing HP iLO MP (Management Processors)
Preparing IBM i (AS/400) systems
Preparing JunOS Juniper Networks systems
Preparing MongoDB
Preparing MySQL servers
Preparing Oracle databases
Preparing PAN-OS (Palo Alto) networks
Preparing PostgreSQL
Preparing RACF mainframe systems
Preparing SAP HANA
Preparing SAP Netweaver Application Servers
Preparing Sybase (Adaptive Server Enterprise) servers
Preparing SonicOS devices
Preparing SonicWALL SMA or CMS appliances
Preparing SQL Servers
Preparing Top Secret mainframe systems
Preparing Unix-based systems
Preparing Windows systems
Preparing WinRM systems
Preparing Windows SSH systems
Minimum required permissions for Windows assets
Troubleshooting
Appliance is sick
Connectivity failures
Frequently asked questions
Change password or SSH key fails
Incorrect authentication credentials
Missing or incorrect SSH host key
No cipher supported error
Service account has insufficient privileges
Cannot connect to remote machine through SSH or RDP
Cannot delete account
Cannot play session message
Domain user denied access to Safeguard for Privileged Passwords
LCD status messages
My Mac keychain password or SSH key was lost
Password fails for Unix host
Password or SSH key is pending review
Password or SSH key is pending a reset
Password or SSH key profile did not run
Recovery Kiosk (Serial Kiosk)
Appliance information (Recovery Kiosk)
Power options
Admin password reset
Factory reset from the Recovery Kiosk
Support bundle
Replica not adding
System services did not update or restart after password or SSH key change
Test Connection failures
Test Connection failures on archive server
Certificate issue
Cipher support
Domain controller issue
Networking issue
Windows WMI connection
Timeout errors causing operations to fail
User locked out
User not notified
How do I audit transaction activity
How do I configure external federation authentication
Appendix A: Safeguard ports
Appendix B: SPP 2.7 or later migration guidance
Appendix C: SPP and SPS join guidance
Appendix D: Regular Expressions
About us
How do I add an external federation provider trust
How do I create a relying party trust for the STS
How do I add an external federation user account
How do I manage accounts on unsupported platforms
How do I modify the appliance configuration settings
How do I prevent Safeguard for Privileged Passwords messages when making RDP connections
How do I set up telnet and TN3270/TN5250 session access requests
How do Safeguard for Privileged Passwords database servers use SSL
What are the access request states
What do I do when an appliance goes into quarantine
When does the rules engine run for dynamic grouping and tagging
Why did the password or SSH key change during an open request
Uninstalling the desktop client
Using the desktop client
One Identity Safeguard for Privileged Passwords has two graphical user interfaces that allow you to manage password and session requests, approvals, and reviews for your managed accounts and systems:
- Windows desktop client: The desktop client consists of an end-user view and an administrator view. The administrative functionality is dynamically enabled based on the user's permissions. The desktop client user interface information follows.
-
Web client: The web client is especially useful for requesters, reviewers, and approvers. Many administration functions are available as well. For more information, see Using the web client.
NOTE: In this documentation, you will see the following icons which denote the interface:
Desktop client toolbar
The toolbar along the top-right corner of the Safeguard for Privileged Passwords console, has these controls:
(User avatar): Modify personal information, view notifications, or log out of the Safeguard client. For more information, see User information and log out (desktop client).
Log events are created based on how the user logged out: UserLoggedOut or InactiveUserLoggedOut.
(Settings): Configure the desktop client application, including notifications and Home page widgets, or view product information, including contact information. For more information, see Settings (desktop client).
Settings (desktop client)
The desktop client console
Set the following then click Done to save settings.
Notifications
Control notifications within Safeguard for Privileged Passwords:
- Run in the System Tray when you close the application.
When you select the Run in the System Tray check box, you cannot modify the toast notifications check box which follows because you always get notifications. If you deselect the Run in the System Tray check box, you can enable or disable toast notifications which follows.
- Enable Toast Notifications to display event alerts on your console.
Toast notifications are alerts that appear when the desktop client application is not the active foreground application: for example, when you are in another application or when you have minimized the desktop client.
- Reset Notifications: Click Reset Notifications to reenable any notifications pop ups that have been preciously suppressed.
Widgets
All widgets are enabled by default, indicating that the corresponding controls display on your Home page. The toggles appear blue with the switch to the right when a widget is enabled, and gray with the switch to the left when a widget is disabled.
Click the toggles to enable (
- Enable Requests
- Enable Approvals
- Enable Reviews
About dialog tab
Click About Safeguard for Privileged Passwords to display the following information.
- About: The trademark and copyright information.
- Contact: Information about how to get in touch with One Identity.
- Components: Links to information regarding the third-party components used in Safeguard for Privileged Passwords.
User information and log out (desktop client)
Click the user avatar then click My Account to modify your personal information, time zone (if allowed), manage email notifications, view current notifications, or log out of Safeguard for Privileged Passwords.
NOTE: Safeguard for Privileged Passwords Active Directory users cannot use My Account to modify their email address, phone number, or change their password. They must do these actions in Active Directory.
(To update your personal information or time zone
- From the toolbar, select your
-
To change your image, select
Change Photo.
- To change your email address, Work Phone, or Mobile Phone, type into the appropriate box.
- Under Location, you can select a new Time Zone. Changing your time zone may be prohibited based on your organization's security procedures. If available, choose to:
- Display times in local computer time: This is the default. It is the time zone set on your local computer.
- Display times in my configured time zone: This is the time zone that is set on this page.
-
- Click Done to close the My Account pane.
To manage the notifications you receive
- From the toolbar, select your
-
Click Manage Email Notifications.
The Manage Email Notifications dialog displays the type of events for which you are receiving email notifications. You can define the types of events for which you want to receive notifications.
NOTE: When there are no delegated owners assigned to a partition, email notifications related to partitions are sent to the Asset Administrator. However, when a delegated owner is specified to manage the assets and accounts in a partition, email notifications related to partitions are sent to the delegated owner, not to the Asset Administrator.
-
By default, all events are selected. Clear the check box for any events for which you do not want to receive an email notification. You can clear or check all check boxes by selecting or deselecting the check box next to Events.
- Click OK to save your selections and close the dialog.
- Click Done to close the My Accounts pane.
At least one key must be registered. When a key is added, the placeholder name is Unnamed Key. You can enter a meaningful name or later edit the name. It is recommended that all users have more than one key registered in case a key is lost or damaged.
- From the toolbar, select your
- Click Manage FIDO2 Keys. The name and date each key was registered and last used displays.
- Click
Edit to change the name then click
Save. Click
Cancel to leave the editing operation.
- Click
Delete to delete a key. One key must remain registered. If a physical security key is lost, always delete the associated key from Safeguard for Privileged Passwords.
- Click Register New FIDO2 Key to add a key.
- You will be asked to insert or connect to the new key.
-
You will be prompted to reenter your primary credentials for verification.
-
Tap or activate your new FIDO2 key that is being registered.
-
You may then go back to the Manage FIDO2 Key page and give your newly registered key a name.
- Click
- Click Done to close the My Account pane.
For more information, see
To change your user password
- From the toolbar, select your
- To change your user password, click Change Password and complete the information.
- Click Done to close the My Account pane.
Log Out
Click the