The Account comparison feature in the Manager allows you to compare the access for two accounts. The results are grouped by:
The account comparison results contain the following details.
Column | Description |
---|---|
Resource Name | The name of the resource to which one or both of the selected accounts has access. |
<Source Account> |
Indicates whether the Source account has access to the resource.
|
<Target Account> |
Indicates whether the Target account has access to the resource.
|
Right | The type of access granted to the resource. |
Via Group |
Displays the name of the account through which the displayed access (Right column) was granted.
|
Governed Resource |
Indicates whether the resource is governed:
|
Column | Description |
---|---|
Resource Name | The name of the resource to which both of the selected accounts have similar access. |
<Source Account> |
A green check mark indicates that the Source account has access to the resource.
|
<Target Account> |
A green check mark indicates that the Target account has access to the resource.
|
Right | The type of access granted to the resources. |
Via Group |
When rights are granted through the same group membership, the name of the group through which the access was granted. |
Governed Resource |
Indicates whether the resource is governed:
|
Simulating changes to group membership enables you to see the access that would be gained or removed if a user or group had a change to their existing group membership.
|
Note: Account membership simulation is not supported for machine local trustees, well-known group accounts or built-in group accounts. |
Once you have reviewed the results of the simulation, and before making any changes to the group membership, investigate the group membership on all managed hosts for the selected user or group. For details, see Viewing group membership and Managing account access.
To simulate changes to group membership
Navigate to and select an account (through the Security Index node, Accounts view, Security editor, etc.)
Select Account simulation in the Tasks view or right-click menu.
Select the type of modification to be simulated:
Click the Change button to limit your simulation to selected resource types or managed hosts. Clicking the Change button displays additional fields allowing you to make your selections:
Host: Click the arrow control to select one or more managed hosts from a list of available managed hosts. To exclude a managed host, click the selected check box to clear it.
|
Note: Running an account simulation for all hosts and resource types could take a significant amount of time to process. It is recommended that you select the hosts and resource types you are interested in to speed up the simulation process. |
In the Remove Groups or Add Groups dialog, click the Browse Groups button to launch the Select User or Group dialog. Locate and select the groups to be included in the simulation and click OK.
The selected groups appear on the Remove Groups or Add Groups dialog.
Click the Simulate button.
For a "Remove from groups" simulation, the resources the selected account would no longer have access to if removed from the specified groups.
See Account simulation results for a more detailed description of the simulation results.
(Optional) Click the Export to CSV button to export the results to a file. The Save As dialog appears allowing you to select the location where the report is to be saved and to specify a file name.
|
Note: The exported CSV file contains more information about the account simulation. For example, it contains the managed host ID which can be used to run scripts/commands against a particular managed host. |
|
NOTE: You can use the Layout controls to select a predefined layout for displaying data. If you do not see the Layout field or buttons, use the Toggle layout options task to display these controls. |
The account simulation feature allows you to simulate changes to group membership before making any changes to the group membership.
The results generated by an account simulation contain the following details:
Column | Description |
---|---|
Simulation Type |
The type of simulation performed:
|
Resource Name | The name of the resource, to which the account would be granted access or revoked access. |
Resource Type | The type of resource. |
Right |
The access rights that would be granted or revoked.
|
Via Group |
The name of the group through which access would be granted or revoked. |
Governed Resource |
Indicates whether the resource is governed.
|
Use the Add groups dialog to select the groups to be included in an add simulation. This dialog appears when you click the Select Groups button at the top of the Account Simulation view when performing an add to groups simulation.
This dialog contains the following controls:
Control | Description |
---|---|
Groups list | Once groups have been selected, this list displays the groups to be included in the simulation. |
Browse Groups |
Click the Browse Groups button to launch the Select User or Group dialog to locate and select the groups to be included in the simulation. |
Simulate |
After selecting the groups to be used in the simulation, click the Simulate button to initiate the simulation process. |
Cancel |
Click the Cancel button to close the dialog without saving your selections or launching a simulation. |
© 2023 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy