Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.5 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

VMware vCenter Server

SPP manages single sign-on (SSO) accounts on the vCenter Server platform.

To manage single sign-on accounts on the VMware vCenter Server platform

  1. Enable SSH access to the vCenter appliance.

  2. Use the SSO administrator account as the service account when creating the asset in Safeguard.

    NOTE: If the administrator account is managed by Safeguard, then Safeguard will also attempt to synchronize

    the local root account with the SSO administrator account.

  3. When creating the managed account in Safeguard, you must use the fully qualified name of the SSO account. The default fully qualified name is <account>@vsphere.local.

SPP supports asset discovery for the vCenter Server platform.

To discover the virtual machines in Vsphere, ensure that the service account has HTTPS access to the vCenter Server.

Minimum required permissions for Windows assets

The following minimum permissions are required for Windows assets to perform directory password management and sessions management tasks using Windows Management Instrumentation (WMI).

NOTE: Microsoft has started hardening DCOM servers which may change your configuration decisions. For more information, see https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26414 and https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c.

Asset password management

Using a local account or domain account:

  • (Only applies to Windows Desktop and Windows Server) Test connection, Check connection, Password check, and Account discovery tasks require the following permissions:
    • Remote Enable permission on WMI's CIMV2 Namespace
    • Enable Account permission on WMI's CIMV2 Namespace

    • Remote Activation permission on computer via DCOM.

      To set Remote Enable and Enable Account permissions

      1. Open wmimgmt.msc.
      2. Right-click WMI Control (Local) and select Properties.
      3. Select the Security tab.
      4. Expand the Root node.
      5. Select the CIMV2 node.
      6. Click the Security button.
      7. Add user/group and select Remote Enable and Enable Account.
      8. Click OK.

      To set Remote Activation permissions

      1. Open dcomcnfg.
      2. Expand Component Services > Computers.
      3. Right-click My Computer and select Properties.
      4. Open the COM Security tab.
      5. Under Launch and Activation Permissions, select Edit Limits.
      6. Add user/group and select Allow for Remote Activation.
      7. Click OK.
  • Password change task requires the following permission:
    • Member of Local Administrators group
Domain password management

Using a Domain account:

  • Test connection, Check connection, Password check, and Account discovery tasks require the following permissions:
    • Member of Domain Users
  • Password change task requires that the Service account has the following delegated permissions:
    • LockoutTime (Read/Write)

    • Account Restrictions (Read/Write)

    • Reset Password

Asset session access

Using a local account:

  • Member of Remote Desktop Users group
  • Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
  • Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)

Using a Domain account:

  • Defined in the Remote Desktop Users group or be a member of a domain security group by a group policy update to the Remote Desktop Users group for that asset
  • Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
  • Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)

Troubleshooting

One Identity recommends the following resolutions to some of the common problems you may encounter as you deploy and use SPP. For more information about how to troubleshoot SPP, refer to the Appliance.

Related Topics

Frequently asked questions

Appliance is sick

There are so many possible root causes for a sick appliance. If you receive an error that the appliance is sick take the following steps.

  1. Check network connectivity between nodes.
  2. Wait (up to 30m) to see if the error resolves automatically.
  3. If the error persists, create a support bundle and contact support. For more information, see Support bundle..
Categories of appliance sick events by error message prefix

There are 6 categories for appliance sick events which can be distinguished by the error message prefix.

Audit Log is sick : <reason>

There is an error in the underlying audit log database. The reason will provide more details about the exact issue. Typically this is due to loss of consensus as a result of network connectivity. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes.

If not, check network connectivity between Safeguard nodes. After ruling out network connectivity, generate a support bundle and contact Support. Do not reboot the appliance until consulting with Support. In some cases, rebooting the appliance can make the condition worse.

Access Request Workflow is sick : <reason>

There is an error in the underlying password workflow database. The reason will provide more details about the exact issue. Typically this is due to loss of consensus as a result of network connectivity. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes. After ruling out network connectivity, generate a support bundle and contact Support.

Policy Data is sick : <reason>

There is an error in the underlying policy database. The reason will provide more details about the exact issue. Typically this occurs when a replica has lost network connectivity to the primary. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes. After ruling out network connectivity, generate a support bundle and contact Support.

Cluster Connectivity is sick : <reason>

There is an error in the VPN connection between Safeguard nodes. The reason will provide more details about the exact issue. This may be the result of temporary network conditions and, if so, it will resolve automatically after a few minutes. If not, check network connectivity between Safeguard nodes on the public IP address since the VPN is tunneled over the public IP. After ruling out network connectivity, generate a support bundle and contact Support.

Appliance Resource Usage is sick : <reason>

A Safeguard process or underlying database is exhibiting unexpectedly high OS resource usage (CPU, Memory, Disk). The reason will provide more details about the exact issue. Restarting the appliance may resolve this issue. If the problem persists or recurs frequently, generate a support bundle and contact Support.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating