- Navigate to
Administrative Tools l Toolbox.
- Open the Tasks pane.
- Click
Popout in the upper right corner to float the Tasks pane.
- Click
Cancel next to a running task.
Introduction
System requirements and versions
Desktop client system requirements
Web client system requirements
Web management console system requirements
Supported platforms
Licenses
Long Term Support (LTS) and Feature Releases
Using API and PowerShell tools
Using the virtual appliance and web management console
Cloud deployment considerations
Setting up Safeguard for Privileged Passwords for the first time
Step 1: Create the Authorizer Administrator
Step 2: Authorizer Administrator creates administrators
Step 3: Appliance Administrator configures the appliance
Step 4: User Administrator adds users
Step 5: Asset Administrator adds managed systems
Step 6: Security Policy Administrator adds access request policies
Using the web client
Home
My Requests (web client)
Personal password vault (web client)
Approvals (web client)
Reviews (web client)
Favorites (web client)
Application Settings and desktop client download (web client)
Change password (web client)
FIDO2 keys (web client)
Log out (web client)
Getting started with the desktop client
Using the desktop client
Settings (desktop client)
User information and log out
Desktop client favorite request
Desktop client navigation pane
Search box
Privileged access requests
Home
Dashboard
Activity Center
Applying search criteria
Saving search criteria
Generating an activity audit log report
Scheduling an activity audit log report
Editing or deleting a saved search or scheduled report
Viewing event details
Auditing request workflow
Filtering report results
Sorting report results
Reports
Administrative Tools
Configuring alerts
Password release request workflow
Toolbox
Accounts
Requesting a password release
Approving a password release request
Reviewing a completed password release request
SSH key release request workflow
Requesting an SSH key release
Approving an SSH key release request
Reviewing a completed SSH key release request
Session request workflow
General tab (account)
Access Request Policies tab (account)
Account Groups tab (account)
Dependent Assets (account)
Check and Change Log tab (account)
Discovered SSH Keys (account)
History tab (account)
Managing accounts
Account Groups
Adding an account
Adding a cloud platform account
Manually adding a tag to an account
Adding an account to one or more account groups
Modifying an account
Deleting an account
Importing objects
Checking, changing, or setting an account password
Viewing password archive
Checking, changing, or setting an SSH key
Viewing SSH key archive
General tab (account group)
Accounts tab (account group)
Access Request Policies tab (account group)
History tab (account group)
Managing account groups
Assets
Adding an account group
Adding a dynamic account group
General tab (add dynamic account group)
Account Rules tab (add dynamic account group)
Summary tab (add dynamic account group)
Adding one or more accounts to an account group
Adding accounts to an access request policy
Modifying an account group
Deleting an account group
General tab (asset)
Accounts tab (asset)
Account Dependencies tab (asset)
Access Request Policies tab (asset)
Asset Groups tab (asset)
Discovered Services tab (asset)
History tab (asset)
Managing assets
Asset Groups
Adding an asset
General tab (add asset)
Management tab (add asset)
Connection tab (add asset)
Checking an asset's connectivity
Assigning an asset to a partition
Assigning a profile to an asset
Manually adding a tag to an asset
Adding an account to an asset
Adding account dependencies
Adding an asset to asset groups
Modifying an asset
Deleting an asset
Account Discovery tab (add asset)
Importing objects
Downloading a public SSH key
About service accounts
About Test Connection
SSH Key
Directory Account
Local System Account
Password (local service account)
Access Key
None
Attributes tab (add asset)
General tab (asset group)
Assets tab (asset group)
Access Request Policies tab (asset group)
History tab (asset group)
Managing asset groups
Discovery
Asset Discovery
Entitlements
Asset Discovery job workflow
Adding an Asset Discovery job
Asset Discovery Results
Account Discovery
General tab (asset discovery)
Information tab (asset discovery)
Rules tab (asset discovery)
Editing an Asset Discovery job
Deleting an Asset Discovery job
Add Condition (asset discovery)
Edit Connection Template (asset discovery)
Add Asset Profile (asset discovery)
Schedule tab (asset discovery)
Summary tab (asset discovery)
Account Discovery job workflow
Adding an Account Discovery job
Editing an Account Discovery job
Deleting an Account Discovery job
Account Discovery Results
Discovered Accounts
Service Discovery Results
Discovered Services
SSH Key Discovery
General tab
Users tab
Access Request Policies tab
History tab
Managing entitlements
Partitions
Adding an entitlement
Creating an access request policy
General tab
Scope tab
Requester tab
Approver tab
Reviewer tab
Access Config tab
Session Settings tab
Time Restrictions tab
Emergency tab
Adding users or user groups to an entitlement
Deleting an access request policy
Modifying an access request policy
Copying an access request policy
Viewing and editing policy details
Modifying an entitlement
Deleting an entitlement
About profiles
General tab (partitions)
Assets tab (partitions)
Accounts tab (partitions)
Profiles tab (partitions)
SSH Key Profiles tab (partitions)
History tab (partitions)
Managing partitions
Settings
Adding a partition
Adding assets to a partition
Removing assets from a partition
Creating a profile
Modifying a password profile
Creating an SSH key profile
Modifying an SSH key profile
Setting a default partition
Setting a default profile
Assigning assets or accounts to a password profile and SSH key profile
Modify a partition
Delete a partition
Access Request settings
Appliance settings
Users
Appliance Diagnostics
Appliance Information
Debug
Enable or disable A2A and audit log stream
Factory Reset
Licensing settings
Lights Out Management (BMC)
Network Diagnostics
Networking
Operating System Licensing
SSH Algorithms
Patch Updates
Power
Support Bundle
Time
Updates
Asset Management settings
Backup and Retention settings
About backups
Archive servers
Audit Log Maintenance
Safeguard Backup and Restore
Certificates settings
Run Now
Download a backup
Upload a backup
Restore a backup
Archive backup
Backup settings
Backup protection settings
Safeguard Backup Retention
About Certificate Signing Requests (CSRs)
Audit Log Signing Certificate
Certificate Signing Request
SMTP Certificate
SSL/TLS Certificates
Cluster settings
Enable or Disable Services settings
External Integration settings
Creating an SSL/TLS Certificate Signing Request
Installing an SSL/TLS certificate
Assigning an SSL/TLS certificate to appliances
Syslog Client Certificate
Trusted CA Certificates
Application to Application
Messaging settings (desktop client)
Password Management settings
Safeguard Access settings
SSH Key Management settings
About Application to Application functionality
Setting up Application to Application
Adding an application registration
Deleting an application registration
Regenerating an API key
Making a request using the Application to Application service
Approval Anywhere
Email
Email Templates
Identity and Authentication (desktop client)
SNMP
Starling
Syslog
Syslog Events
Ticketing systems
ServiceNow ticketing system integration
Remedy ticketing system integration
Not integrated with ticketing system
Trusted Servers, CORS, and Redirects
General tab (user)
User Groups tab (user)
Partitions tab (user)
Entitlements tab (user)
Linked Accounts tab (user)
History (user)
Managing users
User Groups
Adding a user
Identity tab (add user)
Authentication tab (add user)
Location tab (add user)
Permissions tab (add user)
Requiring secondary authentication log in
Adding a user to user groups
Assigning a user to partitions
Adding a user to entitlements
Linking a directory account to a user
Modifying a user
Enabling or disabling a user
Deleting a user
Importing objects
Setting a local user's password
Unlocking a user's account
General tab (user groups)
Users tab (user groups)
Entitlements tab (user groups)
History tab (user groups)
Managing user groups
Disaster recovery and clusters
Enrolling replicas into a cluster
Unjoining replicas from a cluster
Maintaining and diagnosing cluster members
Administrator permissions
About Offline Workflow Mode
Failing over to a replica by promoting it to be the new primary
Activating a read-only appliance
Diagnosing a cluster member
Patching cluster members
Using a backup to restore a clustered appliance
Resetting a cluster that has lost consensus
Performing a factory reset
Unlocking a locked cluster
Troubleshooting tips
Appliance Administrator permissions
Asset Administrator permissions
Auditor permissions
Authorizer Administrator permissions
Help Desk Administrator permissions
Operations Administrator permissions
Security Policy Administrator permissions
User Administrator permissions
Preparing systems for management
Preparing ACF - Mainframe systems
Preparing Amazon Web Services platforms
Preparing Cisco devices
Preparing Dell iDRAC devices
Preparing VMware ESXi hosts
Preparing Fortinet FortiOS devices
Preparing F5 Big-IP devices
Preparing HP iLO servers
Preparing HP iLO MP (Management Processors)
Preparing IBM i (AS/400) systems
Preparing JunOS Juniper Networks systems
Preparing MongoDB
Preparing MySQL servers
Preparing Oracle databases
Preparing PAN-OS (Palo Alto) networks
Preparing PostgreSQL
Preparing RACF mainframe systems
Preparing SAP HANA
Preparing SAP Netweaver Application Servers
Preparing Sybase (Adaptive Server Enterprise) servers
Preparing SonicOS devices
Preparing SonicWALL SMA or CMS appliances
Preparing SQL Servers
Preparing Top Secret mainframe systems
Preparing Unix-based systems
Preparing Windows systems
Preparing Windows SSH systems
Troubleshooting
Anti-CSRF (cross-site request forgery) token error
Appliance is sick
Connectivity failures
Frequently asked questions
Change password or SSH key fails
Incorrect authentication credentials
Missing or incorrect SSH host key
No cipher supported error
Service account has insufficient privileges
Cannot connect to remote machine through SSH or RDP
Cannot delete account
Cannot play session message
Domain user denied access to Safeguard for Privileged Passwords
LCD status messages
My Mac keychain password or SSH key was lost
Password fails for Unix host
Password or SSH key is pending review
Password or SSH key is pending a reset
Password or SSH key profile did not run
Recovery Kiosk (Serial Kiosk)
Appliance information (Recovery Kiosk)
Power options
Admin password reset
Factory reset from the Recovery Kiosk
Support bundle
Replica not adding
System services did not update or restart after password change
Test Connection failures
Test Connection failures on archive server
Certificate issue
Cipher support
Domain controller issue
Networking issue
Windows WMI connection failure
Timeout errors causing operations to fail
User locked out
User not notified
How do I audit transaction activity
How do I configure external federation authentication
Appendix A: Safeguard ports
Appendix B: SPP 2.7 or later migration guidance
Appendix C: SPP and SPS join guidance
Appendix D: Regular Expressions
SPP Glossary
About us
How do I add an external federation provider trust
How do I create a relying party trust for the STS
How do I add an external federation user account
How do I manage accounts on unsupported platforms
How do I modify the appliance configuration settings
How do I prevent Safeguard for Privileged Passwords messages when making RDP connections
How do I set up telnet and TN3270/TN5250 session access requests
How do Safeguard for Privileged Passwords database servers use SSL
What are the access request states
What do I do when an appliance goes into quarantine
When does the rules engine run for dynamic grouping and tagging
Why did the password or SSH key change during an open request
Stopping a task
Accounts
A Safeguard for Privileged Passwords account is a unique identifier that Safeguard for Privileged Passwords uses to control access to assets. Managed accounts (including directory accounts and service accounts ) and groups of accounts can be associated with an asset. Each account has an associated asset; if you delete an asset, Safeguard for Privileged Passwords permanently deletes all the accounts associated with it.
The Auditor and the Asset Administrator have permission to access Accounts.
On Unix assets, the accounts are stored in etc/passwd; however, each platform implements this concept differently.
Service accounts are designated with a 
The Accounts view displays the following information about the selected account.
- General tab (account): Displays general information about the selected account.
- Access Request Policies tab (account): Displays the entitlements and access request policies associated with the selected account.
- Account Groups tab (account): Displays the account groups that contain the selected account.
- Dependent Assets (account): (Directory assets) Displays the assets that have dependency on the selected directory account. This tab only displays for a directory asset and displays the assets that have dependency on the selected directory account.
- Check and Change Log tab (account): Displays the password and SSH key validation and reset history for the selected account.
- Discovered SSH Keys (account): Displays the SSH keys discovered on the account.
- History tab (account): Displays the details of each operation that has affected the selected account.
For information about configuring Account Discovery in Safeguard for Privileged Passwords, see Account Discovery job workflow.
Use these toolbar buttons to manage accounts.
Add Account: Add accounts to Safeguard for Privileged Passwords. For more information, see Adding an account.
Delete Selected: Remove the selected account. For more information, see Deleting an account.
Refresh: Update the list of accounts.
Import Accounts: Add accounts to Safeguard for Privileged Passwords. For more information, see Importing objects.
Account Security: Menu options include:
- Check Password, Change Password, and Set Password. For more information, see Checking, changing, or setting an account password.
- Toggle Global Access: For more information, see Available for discovery across all partitions (Global Access).
- Check SSH Key, Change SSH Key, Set SSH Key: For more information, see Checking, changing, or setting an SSH key.
Password Archive: Display the password history for the selected account. For more information, see Viewing password archive.
Discover SSH Keys: Run the SSH Key Discovery job associated with the account. For more information, see SSH Key Discovery.
Access Requests: Allows you to enable or disable access request services for the selected account. Menu options include:
- Enable Password Request
- Disable Password Request
- Enable Session Request
- Disable Session Request
- Enable SSH Key Request
- Disable SSH Key Request
Show Disabled: Display the accounts that are not managed and are disabled and have no associated assets. Account management can be controlled by right-clicking on an asset and selecting
- Click
Disable to prevent Safeguard for Privileged Passwords from managing the selected account.
- Click
Enable to manage the selected account and assign it to the scope of the default profile.
- Click
Hide Disabled: Hide the accounts that are not managed and are disabled and have no associated assets. Asset management can be controlled by right-clicking on an account and selecting
- Click
- Click
- Click
Search: You can search by a character string or by a selected attribute with conditions you enter. To search by a selected attribute click
General tab (account)
The General tab lists information about the selected account.
Large tiles at the top of the tab display the number of Access Request Policies, Account Groups, and Dependent Assets associated with the selected account. Clicking a tile heading opens the corresponding tab. The time stamps for the password and SSH key check and change transactions are based on the user's local time.
Navigate to Administrative Tools | Accounts | General. Information for the account displays. Not all the information listed below is applicable for every account.
| Property | Description |
|---|---|
| Name | The name of the selected account. |
|
Distinguished Name |
For LDAP platforms, the fully qualified distinguished name (FQDN) for the service account |
|
Domain Name (for directories) |
The name of the domain where the account was discovered |
|
SID (for directories) |
Security IDentifer for a Windows account. |
| Asset |
The display name of the managed system associated with this account. Accounts are only associated with one asset. |
|
Asset Type |
The type of the asset (for example, Windows, Linux, OpenLDAP, or Active Directory). |
| Partition | The name of the partition where the selected account resides. |
| Password Profile |
The name of the password profile that governs the accounts assigned to a partition. |
|
Password Sync Group |
If assigned, the password sync group to control password validation and reset across all associated accounts. |
| SSH Key Profile |
The name of the SSH key profile that governs the accounts assigned to a partition. |
|
SSH Key Sync Group |
If assigned, the SSH key sync group to control SSH key validation and reset across all associated accounts. |
|
Account Discovery Job |
The account discovery job with rule-based settings to discover all accounts that are assigned to the assets in a selected partition, that are made available globally, or that meet the rules criteria. |
|
Date/Time Discovered |
The date and time when the account was discovered. |
|
Discovered User ID |
The User ID of the discovered account. |
|
Discovered Groups (for directories) |
The groups in which the account is a member. Click the link to go to the Discovered groups dialog to view the groups. |
| Enable Password Request | True or False, indicating whether password release requests are enabled for this account. |
| Enable Session Request | True or False, indicating whether session access requests are enabled for this account. |
| Enable SSH Key Request | True or False, indicating whether SSH key release requests are enabled for this account. |
|
Available for use across all partitions (Global Access for directories) |
When selected, any partition is able to use this account and the password is given to other administrators. For more information, see Adding an Account Discovery rule. |
| Last Successful Password Check |
The date and time of the last successful password validation. |
| Last Failed Password Check |
The date and time of the last password validation failure. |
|
Password Check Failures |
Displays the number of password check tasks that failed. |
| Next Password Check |
The date and time of the next automated password check as set in the Check Password schedule of the profile. For more information, see Adding check password settings. |
| Last Successful Password Change |
The date and time of the last successful password change. |
| Last Failed Password Change |
The date and time of the last password change failure. |
|
Password Change Failures |
Displays the number of password change tasks that failed. |
| Next Password Change |
The date and time of the next automated password change as set in the Change Password schedule of the profile. For more information, see Adding change password settings. |
| Last Successful SSH Key Check |
The date and time of the last successful SSH key validation. |
| Last Failed SSH Key Check |
The date and time of the last SSH key validation failure. |
|
SSH Key Check Failures |
Displays the number of SSH key check tasks that failed. |
| Next SSH Key Check |
The date and time of the next automated SSH key check as set in the Check SSH Key schedule of the profile. For more information, see Adding SSH key check settings . |
| Last Successful SSH Key Change |
The date and time of the last successful SSH key change. |
| Last Failed SSH Key Change |
The date and time of the last SSH key change failure. |
|
SSH Key Change Failures |
Displays the number of SSH key change tasks that failed. |
| Next SSH Key Change |
The date and time of the next automated SSH key change as set in the Change SSH Key schedule of the profile. For more information, see Adding SSH key change settings. |
|
Last Successful SSH Key Discovery |
The date and time of the last successful SSH key discovery. For more information, see SSH Key Discovery job workflow. |
|
Last Failed SSH Key Discovery Attempt |
The date and time of the last failed SSH key discovery attempt. |
|
SSH Key Discovery Failures |
The number of SSH key discovery failures. You can view a list of the accounts. |
|
Next SSH Key Discovery |
The date and time for the next SSH key discovery attempt. On the Dashboard, Account Automation tab, you can view a list of accounts where SSH key discovery tasks failed. For more information, see Account Automation. |
Tags: Tag assignments for the selected account.
The tiles displayed in the Tags pane include both the dynamic tags added through tagging rules and static tags that were added manually. In addition to viewing tag assignments, Asset Administrators can add and remove statically assigned tags.
NOTE: Dynamically assigned tags contain a lightening bolt icon and cannot be deleted. Static tags which can be removed contain an X icon.
Description: Information about selected account.
Related Topics
Access Request Policies tab (account)
The Access Request Policies tab displays the entitlements and access request policies, including password and SSH key release policies and session request policies, associated with the selected account.
Navigate to Administrative Tools | Accounts | Access Request Policies.
| Property | Description |
|---|---|
|
Entitlement |
The name of the access request policy's entitlement. |
|
Access Request Policy |
The name of the access request policy that governs the selected account. |
|
Accounts |
The number of unique accounts in the account groups that are associated with the access request policy. |
|
# Account Groups |
The number of unique account groups in the access request policy. |
|
Account Groups |
The names of the account groups that associate the selected account with the policy. |
|
Assets |
The number of unique assets in the asset groups that are associated with the access request policy. |
|
# Asset Groups |
The number of unique assets groups in the access request policy. |
|
Asset Groups |
The names of the asset groups that associate the selected account with the policy. |
Use these buttons on the details toolbar to manage your access request policies associated with the selected account.
| Option | Description |
|---|---|
|
|
Add the selected account to the scope of an access request policy. |
|
|
Remove the selected policy. |
|
|
Update the list of access request policies. |
|
|
View and edit details about the selected access request policy. For more information, see Creating an access request policy. |
|
|
To locate a specific policy or set of policies in this list, enter the character string to be used to search for a match. For more information, see Search box. |
Remove Selected