Chat now with support
Chat with Support

Defender 5.8 - Administrator Guide

Getting started Managing Defender objects in Active Directory Configuring security tokens Securing VPN access Securing Web sites Securing Windows-based computers Securing PAM-enabled services Defender Management Portal (Web interface) Delegating Defender roles, tasks, and functions Automating administrative tasks Administrative templates Integration with Active Roles Integration with Cloud Access Manager Appendices
Appendix A: Enabling diagnostic logging Appendix B: Troubleshooting common authentication issues Appendix C: Troubleshooting DIGIPASS token issues Appendix D: Defender classes and attributes in Active Directory Appendix E: Defender Event Log messages Appendix F: Defender Client SDK Appendix G: Defender Web Service API

Log Receiver Service database

The Log Receiver Service uses .sdf files to store logs received from Defender Security Servers. For each Defender Security Server, the Log Receiver Service creates a separate .sdf file.
These .sdf files are called the Log Receiver Service database and contain data used by the Defender Management Portal to display authentication log-related data, including the authentication statistics provided on the Dashboard tab of the portal.
On the Defender Management Portal computer, you can find these .sdf files in the following folder:
%ProgramFiles%\Dell\Defender\Management Portal\WWW\App_Data
The name of each .sdf file has the following format: <DSS name>.<domain>.sdf
where
•
<DSS name>  is the name of the corresponding Defender Security Server.
•
<domain>  is the name of the Active Directory domain where the corresponding Defender Security Server resides.

Delegating Defender roles, tasks, and functions

Defender provides a scalable approach to the administration of access rights, enabling you to delegate specific Defender roles, tasks, and functions to the users or groups you want.
The Defender Administration Console provides a wizard you can use to search for and select one or multiple user accounts, and then choose which Defender roles or tasks you want these accounts to perform.
Besides delegating roles or tasks, you can delegate specific Defender functions, for example, appoint selected user accounts as service accounts for the Defender Security Servers or Defender Management Portal, or grant full control over particular Defender objects, such as Access Nodes, Defender Security Servers, licenses, RADIUS payloads, or security tokens.
•
Steps to delegate roles, tasks, and functions
•
Roles
•
Service accounts
•
Advanced control
•
Full control
•
Using control access rights

Steps to delegate roles, tasks, and functions

You can delegate Defender roles, tasks, or functions to specific users or groups by using the Defender Delegated Administration Wizard.
To delegate Defender roles, tasks, or functions
1
On the computer where the Defender Administration Console is installed, open the Active Directory Users and Computers tool (dsa.msc).
2
In the left pane (console tree), expand the appropriate domain node, and click to select the Defender container.
3
On the menu bar, select Defender | Delegate Control.
Step through the wizard.
4
In the Users and Groups step, add the user accounts or groups to which you want to delegate Defender roles, tasks, or functions. Click Next.
5
In the Tasks to Delegate step, select the check boxes next to the Defender roles, tasks, or functions you want to delegate. Click Next.
For more information, see:
•
Roles
•
Service accounts
•
Advanced control
•
Full control
6
Follow the steps in the wizard to complete delegating the roles, tasks, or functions.
The wizard does not modify any standard Active Directory permissions. Rather, it modifies permissions on the Defender attributes in the Active Directory schema.

Roles

You can delegate the below-listed Defender roles to the users or groups you want. If necessary, you can delegate two or more roles to the same user.
 
Table 1. Defender roles
Role
Description
Administrator
Members of this role can modify any Defender object and have complete control over the Defender configuration. This includes modification of all user-based Defender items.
Members of this role can:
•
Assign and unassign tokens.
•
Set a Defender password.
•
Set a Defender PIN.
•
Modify access nodes, Defender Security Servers, Defender policies, tokens, and RADIUS payloads.
•
Manage Defender licenses.
Basic Helpdesk
Members of this role can:
•
Reset tokens.
•
Test a token via the Defender Administration Console.
•
Reset a locked token by resetting the violation count for the user to whom the token is assigned.
Provisioning
Members of this role can:
•
Assign a Defender token.
•
Program a Defender token.
•
Remove a Defender token from a user’s account.
•
Reset a Defender PIN.
Enhanced Helpdesk
Members of this role can:
•
Assign a Defender token.
•
Program a Defender token.
•
Remove a Defender token.
•
Reset a Defender token.
•
Recover a Defender token.
•
Test a Defender token.
•
Reset a locked Defender token.
•
Set a Defender PIN.
•
Set a Defender password.
•
Assign a temporary token response.
Auditor
Members of this role have read-only access to
•
All Defender objects of Users and Groups.
•
All Defender attributes of Users and Groups.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating