-
Title
Password Manager Best Practices and Troubleshooting Guide -
Description
This article outlines the Best Practices and Troubleshooting for Password Manager.
Best Practices
Purpose
This Guide outlines best practices for deployment and functionality and is intended for general use, as environments have varying requirements that may exceed the best practices outlined in this guide.
Password Manager Topology
Password Manager can run as a single instance or with multiple instances of the Password Manager service, all sharing the same configuration, referred to as a Realm.
Running different versions of Password Manager or multiple standalone instances (different Realms) in the same Domain is not supported and can lead to users becoming unregistered, unable to manage their profiles, and unable to reset their passwords.
Password Manager Components
Password Manager components are specific to each version. Although some basic features may function, changes in the product may prevent full functionality between mis-matched versions. It is recommended to upgrade all components at the same time.
Server components:
-
Password Manager service
-
Password Manager Workflow service (5.15 and later)
-
Secure Token Server service
-
Redistributable Secret Management Service (rSMS)
Domain Controller components:
-
Password Policy Manager (PPM)
-
Group Policy Administrative Template
Client computer components:
-
Secure Password Extension (SPE)
-
Offline Password Reset (OPR)
Password Manager service
This is the main service that is responsible for the configuration and general operation of Password Manager.
Password Manager Workflow service
New to version 5.15, this service hosts the PMSelfService and PMHelpdesk workflows running on port 20002 (default).
Secure Token Server
This component provides the option of using 2FA and MFA using third-party providers such as OneLogin, Azure and Okta.
Redistributable Secret Management Service (rSMS)
This service provides the ability to reset passwords in numerous third-party systems, including LDAP, Unix, IBM AS/400, and SAP.
Password Policy Manager
This component is required if you are using Password Manager Password Policies. This must be installed on all Domain Controllers to enforce password policies to end users outside of Password Manager.
NOTE: Password Manager Policies are created as native Group Policy Objects. While the Group Policy object is visible in Group Policy Manager, the contents appear blank as they are encrypted. Only Password Manager and the Password Policy Manager component can decrypt these objects.
Secure Password Extension
This component can be installed on end user machines to allow users to manage their domain passwords at the Windows logon prompt. Access to the Password Manager service is required. This can be directly in the domain, over a VPN, or indirectly through the internet, such as a publicly accessible server in a DMZ.
Offline Password Reset
This component can be installed on end user machines to allow users the ability to reset their password or unlock their account if they are unable to login to their computer.
Group Policy Administrative Template
The ADMx template can be used to configure settings for Secure Password Extension and Offline Password Reset components.
Certificate Requirements
Starting in version 5.15, HSTS is enforced and certificates are required for Password Manager to function.
HSTS Certificate requirement for Password Manager 5.15 (4381287)
License Requirement
Starting in Password Manager 5.15, a new license key is required.
New License requirement for Password Manager 5.15 (4380378)
Password Manager Web Sites
Password Manager includes PMAdmin, PMHelpdesk and PMSelfService web sites. The PMHelpdesk and PMSelfService sites can also be installed on a standalone server if required.
NOTE: If PMHelpdesk or PMSelfService is installed on a standalone server, Port 20002 (default port) must be opened bi-directionally to the server running the Password Manager service.
Integrations with One Identity products
Password Manager directly integrates with other One Identity products including:
-
Defender
-
Starling Connect
-
OneLogin
Customization
Password Manager can be extended with customization using out-of-the-box capabilities, and with other options such as scripting.
Customizations covered by One Identity Support:
-
SDK samples
Types of customizations not covered by One Identity Support:
-
If Extensibility is enabled, Support may be limited
-
Custom scripts that do not use SDK sample code
-
Undocumented modifications of configuration files
-
Third-party Add-Ons not provided by One Identity
NOTE: For assistance with Custom Scripts, please consult One Identity Professional Services.
Installing and Upgrading Password Manager
Before installing Password Manager, review System Requirements in the Password Manager Release Notes to ensure that all hardware and software components meet the minimum requirements. Failure to meet minimum requirements may result in an unsupported configuration.
IMPORTANT: The minimum requirements outlined in the Password Manager Release Notes list the necessary requirements for basic Password Manager functionality. When installing Password Manager, also consider enough resources for the operating system as well as other software installed on the server. Additional resources may be required in larger environments.
Installation checklist:
This checklist provides tasks that an administrator should perform before installing Password Manager.
-
Before installing Password Manager, obtain a new license key. For more information on the license requirement, see Knowledge Base Article 4380378 on the One Identity support portal.
-
If you are performing an upgrade, make sure to export the Password Manager configuration settings. For more information, see Exporting configuration settings.
-
Ensure that the required firewall ports are open.
-
Ensure to have a service account and application pool account with the required permissions.
-
Obtain a certificate that contains all names used for accessing Password Manager.
-
Configure the following ports in IIS with the proper certificate:
-
443 (Default HTTPS)
-
20000 (Secure Token Server)
-
For additional information, see Knowledge Base Article 4381287 on the One Identity support portal.
Installation
To install Password Manager:
-
Open IIS and navigate to Default Web Site
-
Select Bindings
-
Add an entry and certificate for ports 443 and 20000.
-
Run Autorun.exe from the Password Manager ISO.
-
Under Setup, click Install on the Password Manager x64 option
-
If prompted, click Accept to install Microsoft .Net 6 Runtime
-
Click Next
-
Select I Accept the terms in the License Agreement and click Next
-
Enter the Full Name and Organization
-
Click Browse License and select the Password Manager license file (.dlv)
-
Click Next
-
Choose the appropriate options as required and click Next
-
Enter the account in which the Password Manager service will run as.
-
Enter the account to be used for the Application Pool Identity
-
Click Install
-
Click done once complete
Configuring Password Manager
These steps outline the initial and essential settings for Password Manager functionality:
-
Launch Administration Site from the Windows Start Menu under One Identity.
-
Login to the PMAdmin site with the service account.
NOTE: With the exception of the Password Manager service account, logging into the PMAdmin site requires membership in the local group PMAdmin. -
On the Instance Initialization Page, update settings as required for your requirements, such as the ports and click Save.
-
If this is a new server but you would like to import an existing configuration, you may import the configuration. Otherwise click Home.
-
Click Configure the user scope.
-
Click Add Domain Connection.
-
Enter the appropriate domain information and click Save.
-
Click Edit to change the Included Groups as desired.
-
Click Home.
-
Click Add secret questions.
-
Click Add questions in the default language.
-
Create questions as required in your environment and click Save.
-
Click Home to ensure the basic configuration options are set for the user Workflows.
Next, review the following settings and update them to meet your specific requirements:
-
User Enforcement Rules
-
Helpdesk Workflows
-
General Settings | Search and Logon options
Installing Password Manager client components
Client computers may have the following optional components installed:
-
Secure Password Extension
-
Offline Password Reset
The Secure Password Extension (SPE) and Offline Password Reset (OPR) components require the included Password Manager Administrative template (.admx) to be deployed and assigned in a Group Policy Object (GPO).
For further details, please refer to Password Manager Administration Guide, Deploying Secure Password Extension and Managing Secure Password Extension using Administrative Templates.
For testing or troubleshooting purposes, the Secure Password Extension URL settings can be manually configured on the client computer as outlined here:
Secure Password Extension URL setting
NOTE: The official supported method of deployment for Secure Password Extension and Offline Password Reset is through a Microsoft Group Policy software installation method as outlined in the Password Manager Administration Guide, Deploying Secure Password Extension.
Installing Password Manager in a DMZ
The Password Manager Self Service site (PMSelfService) can be deployed in a DMZ environment to provide access to users outside of the corporate network.
Best practices:
-
The host should be a standalone server (not domain joined)
-
Local admin account set to run the PMSelfService Application Pool
-
Only port 20002 (default) is required for communication to the internal Password Manager Workflow service
-
In PMAdmin under General Settings → Search and logon Options, it is recommended to set the following options:
-
Do not allow users to search for their accounts
-
Select the corresponding options that work best for your environment
-
-
Show a security image to prevent bot attacks
-
Choose either Captcha or reCaptcha
-
Enable Show a security image every time the search is performed
-
-
IMPORTANT: It is not recommended to deploy the PMHelpdesk or PMAdmin sites in a DMZ or any other public facing environment.
Upgrading Password Manager
Supported Upgrade Paths
Upgrading from an unsupported version may result in a loss of functionality. Please refer to the Password Manager Administration Guide for the supported upgrade paths as this may change with each version of Password Manager.
In addition to the Password Manager system requirements, consider the following when upgrading:
-
Custom solutions provided by Professional Services may be version specific. Refer to any provided documentation or consult One Identity Professional Services before proceeding with an upgrade.
-
Any other customizations should be tested in a lab or staging environment before upgrading.
-
Customizations made to configuration files may be lost during upgrade.
Best Practices for Upgrading
Password Manager can be upgraded in one of two ways:
-
In-Place Upgrade
-
Clean Installation and then Import Configuration
With either option you choose, ensure to follow the upgrade steps as outlined in the Password Manager Administration Guide. Most notably:
-
Perform the upgrade as the existing Password Manager service account.
-
Upgrade all Password Manager servers, including any DMZ or standalone PMSelfService instances at the same time.
-
Upgrade the Password Policy Manager component on all Domain Controllers.
-
Upgrade all Secure Password Extension and Offline Password Reset components on client machines.
IMPORTANT: Running mixed versions of Password Manager or any of its components in the same domain may result in loss of functionality.
Upgrade Steps
-
Ensure the Installation checklist is complete, and system requirements are met.
-
Run the Autorun.exe as the existing service account. This will ensure it can access and export the current configuration.
-
Save the export as prompted.
-
Follow the prompts to continue installation.
-
Login to PMAdmin and ensure the configuration is accurate.
-
Upgrade all remaining Password Manager services and any standalone/DMZ servers.
Minimum Permissions
Password Manager requires specific permissions to perform its functions and tasks. Please refer to the Password Manager Administration Guide for the required permissions as they may change with each version of Password Manager.
WARNING: Failure to use the documented permissions will result in limited functionality and may result in an unsupported configuration.
As a security best practice, it is recommended to use a different account for the Application Pool Identity in IIS, and most notably:
-
The Application Pool Identity account must be a member of the IIS_IUSRS local group on the Web server.
-
While it does not need to be a local Administrator, this account must have permissions to create files in the <Password Manager installation folder>\App_Data folder.
-
The Application pool Identity account must have Full Control permission set for the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\One Identity\Password Manager.
Secure Token Server (rSTS)
Secure Token Server provides the ability to integrate with 3rd-party providers that offer 2FA or MFA solutions, such as OneLogin, Microsoft Entra, Okta and RADIUS.
By default, Secure Token Server listens on port 20000 and requires an HTTPS binding in IIS. While the port can be changed, it is not recommended to use 443 if there is another Secure Token Server instance installed, such as from Active Roles or Safeguard products, as both instances will fail to run.
For more information on configuring Secure Token Server, see the Password Manager Secure Token Server topic in the Password Manager Administration Guide.
Password Manager service recovery
By default, the Password Manager service recovery option is not set. As with any Windows service, there are recovery options that can be configured, such as Restart the Computer or Run a Program.
While it is recommended to set an option that is appropriate for your specific environment, one example is to use Run a Program option that uses a PowerShell script using Send-MailMessage to create an email alert to the appropriate people to be notified in such an event.
Send-MailMessage:
Send-MailMessage (Microsoft.PowerShell.Utility) - PowerShell
NOTE: Send-MailMessage is a Microsoft cmdlet and is not supported by One Identity.
Establish a Baseline or Benchmark
It can be very useful to gather a performance baseline to better provide contrast against any issues which might be encountered.
After Password Manager is initially installed and configured, it is a good practice to monitor the overall usage for an appropriate amount of time to determine if additional resources are required. For some environments this could be a week, and for others it may involve an entire month to establish a baseline.
Once the system resources have matched typical usage requirements, it is a good practice to create a baseline to establish typical usage in your environment. Once the typical baseline is established, any abnormal usage can be identified easier.
Password Manager has daily Scheduled Tasks that perform tasks such as sending Password Expiry reminders, and updating the Reporting database for user statistics. During this time, any given Scheduled Task may temporarily increase CPU or memory usage. You may have to increase system requirements to accommodate the usage.
Regular Maintenance
It is a Microsoft Best Practice to regularly patch and reboot your Windows Servers. These regularly scheduled maintenance windows on the host server are a good opportunity to ensure that the latest update for Password Manager is also installed.
Performance Bottlenecks
Many factors can contribute to performance bottlenecks such as:
-
Domain connections
-
Scripts
-
Internet Information System (IIS)
-
Load balancers
-
Proxies
-
Incorrect Pagefile settings
-
Pagefile should be set to System owned
-
-
Antivirus
-
Firewall ports
-
Add exclusions: List of Ports used by Password Manager (4272055)
-
-
Intrusion detection software or hardware
Resources on the host serverPassword Manager requires a minimum of a 1.6ghz CPU and 4gb of memory. The memory requirement is in addition to the Operating System and any other installed software requirements. This means that at a minimum, the server should have 8gb of memory with only the Operating System, IIS and Password Manager installed.
While this may be sufficient for small environments of less than 1000 users, larger environments will require additional CPU and memory resources, particularly when running Password Manager Scheduled Tasks.
It is recommended to monitor the system resources usage when the Scheduled Tasks run, and add additional resources, if necessary.
There are several factors that can affect system resource usage, including but not limited to:
-
Large User Scope
-
Nested or overlapping Group membership in the User Scope
-
Scheduled Tasks, such as Invitation emails, Maximum Password Age, and User Status Statistics.
-
NOTE: The Scheduled Tasks may cause the memory to spike during these times. Monitor the resources when the Scheduled Tasks run and add additional memory as required.
-
-
Customizations, including scripts
Other Windows Host Configuration Considerations
The default power plan enabled in Windows Server is Balanced, which balances power consumption and performance. If performance is the primary consideration, the power plan should be updated to High Performance. This can be done under Control Panel\All Control Panel Items\Power Options.
The Windows page file settings on the host server can also negatively impact performance if they are set too low. As per this Microsoft resource, the minimum page file size should be equal to the amount of RAM present on the host server, and the maximum size should be three times the amount of RAM present.
SQL, SQL Reporting Services and PowerBI
Password Manager only requires SQL and SQL Reporting Services for the optional Reporting feature. If Reporting is configured, an occasional cleanup or archive may be desired to keep the reporting database at a reasonable size.
Archiving the database can be performed by running the Scheduled Task Clear Old Records from Reporting Database found in PMAdmin | General Settings | Scheduled Tasks.
Native SQL Reporting Services or PowerBI can be used to generate and run Reports.
Hard disk space
On the Password Manager hosts:
-
Limited paging file size
-
It is recommended to use the System-managed setting regardless of how much memory is installed on the host.
-
-
Logging
-
Enabling Password Manager verbose logging may result in large log files and potentially cause the host to run out of disk space. It is recommended to only enable verbose logging for troubleshooting purposes.
-
Network
The following network devices can impact performance:
-
Proxies
-
Network connections
-
Firewalls
-
Load balancers
-
Load Balancers fall outside the scope of Support. Bypass the load balancer to confirm if the issue exists without the load balancer in place
-
It is recommended to bypass any such device as a first step in troubleshooting.
-
-
Resolution
Troubleshooting
The following options and key areas can be used to troubleshoot Password Manager.
Logging
Password Manager automatically logs general informational, warning, and error events to the Windows Event Log called PM - One Identity Password Manager, found under Applications and Services.
Additional verbose logging can be enabled for troubleshooting purposes as follows:
-
Password Manager service host:
-
Password Policy Manager:
-
Secure Password Extension:
IMPORTANT: It is recommended to only enable verbose logging when needed. Leaving logging enabled will cause performance issues and may cause excessive disk usage.
Secure Password Extension (SPE)
-
If the PMSelfService URL gets changed and the Password Manager service account does not have permissions to update the corresponding Service Connection Point (SCP) object in Active Directory, or if the Service Connection Point becomes corrupted, then the users who use the Secure Password Extension component will no longer be able to find the Self-Service site. For more information, see Obtaining Self-Service Site URL from Service Connection Point and Changing Self-Service Site URL on the Administration Site in the Password Manager Administrator Guide.
-
It is also important to push the Self-Service settings via GPO to address any scenario in which users are unable to contact the Domain Controller to discover the settings, such as users working remotely and not connected via VPN.
-
The URL must include a direct link to the self-service site, such as https://reset.mydomain.local/PMSelfService. If the link resolves to a redirect, Secure Password Extension will fail to load the page. This is expected and by design to ensure the site resolves to a Password Manager instance.
Domain Connections
Password Manager provides the ability to define and prioritize Domain Controllers for a domain connection.
The default setting is:
-
Domain Controller used by user computer
-
Default domain controller
It is advised to leave the default settings as a password reset action will be performed on the Domain Controller the user authenticates with, resulting in the user being able to authenticate with the new password faster. Specifying other Domain Controllers can result in a delay for the user due to Active Directory Replication. It is advised to only specify alternative Domain Controllers for troubleshooting purposes, or if there are only specific Domain Controllers that should be used in your specific environment.
Unable to access PMAdmin after upgrading
Unable to access the PMAdmin portal after upgrading to 5.15.x (4381539)
How to Reinitialize the PMSelfService and PMHelpDesk sites
Starting in Password Manager 5.15, the PMSelfService and PMHelpdesk sites no longer use WCF.
How to Reinitialize the Self Service and Help Desk Sites (4217347)
Certificate Errors
Load Balancers
Who to contact for support with load balancers (4307283)
How to configure Password Manager with network load balancing (4334370)
Changing the service account password or credentials
-