Safeguard Authentication Services 5.0.2 - Evaluation Guide

Product licenses usage report

The following report provides product licensing information.

Use Safeguard Authentication Services PowerShell

Safeguard Authentication Services includes PowerShell modules that provide a "scriptable" interface to many Safeguard Authentication Services management tasks. You can access a customized PowerShell console from the Control Center Tools navigation link.

You can perform the following tasks using PowerShell cmdlets:

• Unix-enable Active Directory users and groups
• Unix-disable Active Directory users and groups
• Manage Unix attributes on Active Directory users and groups
• Search for and report on Unix-enabled users and groups in Active Directory
• Install product license files
• Manage Safeguard Authentication Services global configuration settings
• Find Group Policy objects with Unix/macOS settings configured

Using the Safeguard Authentication Services PowerShell modules, it is possible to script the import of Unix account information into Active Directory.

Unix-enabling a user and user group (PowerShell Console)

The following procedure explains how to Unix-enable a user and user group using the Authentication Services PowerShell Console.

To Unix-enable a user and user group

1. From the Control Center, navigate to Tools | Safeguard Authentication Services.
2. Click Safeguard Authentication Services PowerShell Console.

   Note: The first time you launch the PowerShell Console, it asks you if you want to run software from this untrusted publisher. Enter A at the PowerShell prompt to import the digital certificate to your system as a trusted entity. Once you have done this, you will never be asked this question again on this machine.

3. At the PowerShell prompt, enter the following:

   Enable-QasUnixGroup UNIXusers | Set-QasUnixGroup -GidNumber 1234567

   Note: You created the UNIXusers group in a previous exercise. See Adding an Active Directory group account.

   Unix attributes are generated automatically based on the Default Unix Attributes settings that were configured earlier and look similar to the following:

   ObjectClass              : group
   DistinguishedName        : CN=UNIXusers,CN=Users,DC=example,DC=com
   ObjectGuid               : 71aaa88-d164-43e4-a72a-459365e84a25
   GroupName                : UNIXusers
   UnixEnabled              : True
   GidNumber                : 1234567
   AdsPath                  : LDAP://windows.example.com/CN=UNIXusers,CN=Users,
                              DC=example,DC=com
   CommonName               : UNIXusers

4. At the PowerShell prompt, to Unix-enable an Active Directory user using the default Unix attribute values, enter:

   Enable-QasUnixUser ADuser | Seet-QasUnixUser -PrimaryGidNumber 1234567

   The Unix properties of the user display:

   ObjectClass              : user
   DistinguishedName        : CN=ADuser,CN=Users,DC=example,DC=com
   ObjectGuid               : 5f83687c-e29d-448f-9795-54d272cf9f25
   UserName                 : ADuser
   UnixEnabled              : True
   UidNumber                : 80791532
   PrimaryGidNumber         : 1234567
   Gecos                    :
   HomeDirectory            : /home/ADuser
   LoginShell               : /bin/sh
   AdsPath                  : LDAP://windows.example.com/CN=ADuser,CN=Users,
                              DC=example,DC=com
   CommonName               : ADuser

5. To disable the ADuser user for Unix login, at the PowerShell prompt enter:

   Disable-QasUnixUser ADuser

   Note: To clear all Unix attribute information, enter:

   Clear-QasUnixUser ADuser

   Now that you have Unix-disabled the user, that user can no longer log in to systems running the Safeguard Authentication Services agent.

6. From the Control Center, under Login to remote host, enter:
   • Host name: The Unix host name.
   • User name: The Active Directory user name, ADuser.

   Click Login to log in to the Unix host with your Active Directory user account.

   A PuTTY window displays.

   Note: PuTTY attempts to log in using Kerberos, but will fail over to password authentication if Kerberos is not enabled or properly configured for the remote SSH service.

7. Enter the password for the Active Directory user account.

   You will receive a message that says Access denied.

PowerShell cmdlets

Safeguard Authentication Services supports the flexible scripting capabilities of PowerShell to automate administrative, installation, and configuration tasks. A wide range of new PowerShell cmdlets are included in Safeguard Authentication Services.

Safeguard Authentication Services PowerShell cmdlets are contained in PowerShell modules named Quest.AuthenticationServices and Quest.AuthenticationServices.GroupPolicy. Use the Import-Module command to import the Safeguard Authentication Services commands into an existing PowerShell session.