Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 2.7 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time The console Navigation pane Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Discovery Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Safeguard Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 migration guidance Appendix C: SPP and SPS join guidance Glossary

Minimum required permissions for Windows assets

The following minimum permissions are required for Windows assets to perform directory password management and sessions management tasks using Windows Management Instrumentation (WMI).

Asset password management

Using a Local account or Domain account:

  • Test connection, Check connection, Password check, and Account discovery tasks require the following permissions:
    • Remote Enable permission on WMI's CIMV2 Namespace
    • Enable Account permission on WMI's CIMV2 Namespace
    • Remote Activation permission on computer via DCOM.

      To set Remote Enable and Enable Account permissions

      1. Open wmimgmt.
      2. Right-click WMI Control (Local) and select Properties.
      3. Select the Security tab.
      4. Expand the Root node.
      5. Select the CIMV2 node.
      6. Click the Security button.
      7. Add user/group and select Remote Enable and Enable Account.
      8. Click OK.

      To set Remote Activation permissions

      1. Open dcomcnfg.
      2. Expand Component Services | Computers.
      3. Right-click My Computer and select Properties.
      4. Open the COM Security tab.
      5. Under Launch and Activation Permissions, select Edit Limits.
      6. Add user/group and select Allow for Remote Activation.
      7. Click OK.
  • Password change task requires the following permission:
    • Member of Local Administrators group
Domain password management

Using a Domain account:

  • Test connection, Check connection, Password check, and Account discovery tasks require the following permissions:
    • Member of Domain Users
  • Password change task requires that the Service account has the following delegated permissions:
    • Read All Properties
    • Write All Properties
    • Read Permissions
    • Modify Permissions
    • Reset Password
Asset session access

Using a Local account:

  • Member of Remote Desktop Users group
  • Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
  • Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)

Using a Domain account:

  • Defined in the Remote Desktop Users group or be a member of a domain security group by a group policy update to the Remote Desktop Users group for that asset
  • Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
  • Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)

Troubleshooting

One Identity recommends the following resolutions to some of the common problems you might encounter as you deploy and use Safeguard for Privileged Passwords. For more information about how to troubleshoot Safeguard for Privileged Passwords, refer to the Appliance settings.

Related Topics

Frequently asked questions

Anti Cross-Site Request Forgery token error

If you receive an Anti Cross-Site Request Forgery token error when attempting to log into Safeguard for Privileged Passwords using Microsoft Internet Explorer 9 on Windows 7 SP1, this indicates that cookies are blocked.

To resolve this issue

  1. In Internet Explorer, open Tools and choose Internet Options.
  2. In the Privacy tab, click the Advanced button.
  3. Select the Always allow session cookies option.

Connectivity failures

The most common causes of failure in Safeguard for Privileged Passwords are either connectivity issues between the appliance and the managed system, or problems with service accounts.

Always verify network connectivity and asset power before troubleshooting.

The following topics explain some possible reasons that Check Password, Change Password, and Set Password could fail and gives you some corrective steps you can take.

Related Documents