Password Manager 5.11 - Administration Guide

Different Site for Different Roles Password Manager Components Licensing

Installing the License Updating the License Telephone Verification Feature License

Checklist: Installing Password Manager Installing Password Manager

Configuring Password Manager Service Account and Application Pool Identity Enabling HTTPS Steps to Install Password Manager Instance Initialization Installing Legacy Self-Service, Password Manager Self-Service, and Helpdesk Sites on a Standalone Server FailSafe support in Password Manager Installing Multiple Instances of Password Manager

Specifying Custom Certificates for Authentication and Traffic Encryption Between Password Manager Service and Web Sites

Step 1: Obtain and Install Custom Certificates From a TrustedWindows-Based Certification Authority Step 2: Provide Certificate Issued for Server Computer to Password Manager Service Step 3: Provide Certificate Issued for Client Computers to Self-Service and Helpdesk Sites

Configuring Management Policy

Configuring User Scope

Configuring Permissions for Domain Management Account Adding Domain Connection

Enable LDAP over SSL

Specifying Advanced Options for Domain Connection

Domain Controller Active Directory Sites Changes Propagation

Propagating account-related changes Propagating Q&A profile-related changes Propagating password-related changes

Changing Domain Management Account Removing a Domain Connection User Logon Requirements

Adding Secret Questions

Password Manager Components and Third-Party Solutions

Password Manager Service and Administration Site Self-Service Site Helpdesk Site Password Policy Manager Secure Password Extension Offline Password Reset Migration Wizard Telesign SQL Server Database and SQL Server Reporting Services One Identity Quick Connect Sync Engine Defender Password Manager Secure Token Server RADIUS Two-Factor Authentication Quest Enterprise Single Sign-On Redistributable Secret Management Service Location sensitive authentication Password Manager permission checker Working with Power BI templates Password Manager Credential Checker

Typical Deployment Scenarios

Simple Deployment Deployment of the Legacy Self-Service, Password Manager Self-Service site and Helpdesk Sites on Standalone Servers Realm Deployment Multiple Realm Deployment

Password Manager in Perimeter Network

Installing Password Manager in Perimeter Network with Read-Only Domain Controllers Installing Password Manager in Perimeter Network with Reverse Proxy Installing Password Manager in Perimeter Networ kwithout AD DS

Management Policy Overview

Management Policy Components Management Policy and Other Password Manager Settings

Password Policy Overview

Using One Identity Password Policies Using Fine-Grained Password Policies Applying Multiple Password Policies Using Password Policy Manager

Secure Password Extension Overview

Locating Self-Service Site

Obtaining Self-Service Site URL from Service Connection Point Changing Self-Service Site URL on the Administration Site

Launching User Notification

reCAPTCHA Overview

How It Works How to Use reCAPTCHA on Password Manager Sites System Requirements for Using reCAPTCHA References

User Enrollment Process Overview Questions and Answers Policy Overview

Q&A Policy and Authentication Q&A Policy and User Enforcement

Password Change and Reset Process Overview

Resetting and Changing Password in Connected Systems Enforcing Password History When Resetting Password Replicating Password Changes

Data Replication

Storing Data Replicating Data Changing Replication Settings

Phone-Based Authentication Service Overview

How It Works How to Use Phone-Based Authentication System Requirements

Checklist: Configuring Password Manager Understanding Management Policies Configuring Access to the Administration Site Configuring Access to the Self-Service Site Configuring Access to the Helpdesk Site

Specifying Advanced Options for Domain Connection

Active Directory Sites

Changes Propagation

Changing Domain Management Account Removing a Domain Connection

Configuring Questions and Answers Policy

Creating Secret Questions Editing and Deleting Questions Configuring Q&A Profile Settings

Workflow overview

Workflow structure Workflow state Workflow settings

Custom workflows

Importing and exporting workflows

Custom Activities

Custom Activity Settings Creating Custom Activities Importing and Exporting Custom Activities Removing Custom Activities

Self-Service Workflows

Register

Configuring country code drop-down menu

Manage My Profile Forgot My Password Manage My Passwords Unlock My Account My Notifications I Have a Passcode Self-Service Activities Overview

Authentication Activities

Display CAPTCHA Display reCAPTCHA Authentication Methods Authenticate with Password Authenticate with Q&A Profile (Random Questions) Authenticate with Q&A Profile (Specific Questions) Authenticate with Defender Authenticate with an external provider Authenticate with RADIUS Two-Factor Authentication Authenticate via Phone Authenticate with Passcode

Action Activities

Register Manage My Profile Edit Q&A Profile Reset Password in Active Directory Change Password in Active Directory Reset Password in Active Directory and Connected Systems Change Password in Active Directory and Connected Systems Reset password in connected systems through embedded connectors Unlock Account Enable Account Force User to Change Password at Next Logon Subscribe to Notifications Lock Q&A Profile Display User Agreement Restart Workflow if Error Occurs Issue BitLocker Recovery Key Provide product feedback

Notification Activities

Customizing Notifications Email User if Workflow Succeeds Email User if Workflow Fails Email Administrator if Workflow Succeeds Email Administrator if Workflow Fails

Helpdesk Workflows

Assign Passcode Reset Password Unlock Account Unlock Profile Verify User Identity Enforce Update of Profile Helpdesk Activities Overview

Authentication Activities

Authentication Methods Authenticate with Q&A Profile Authenticate via Phone Authenticate with Defender Authenticate with RADIUS Two-Factor Authentication

Action Activities

Reset Password in Active Directory Reset Password in Active Directory and Connected Systems Unlock Account Enable Account Force User to Change Password at Next Logon Assign Passcode Unlock Q&A Profile Enforce Update of Q&A Profile Restart Workflow if Error Occurs

Notification Activities

Customizing Notifications Email User if Workflow Succeeds Email User if Workflow Fails Email Administrator if Workflow Succeeds Email Administrator if Workflow Fails

User Enforcement Rules

Invite Users to Create/Update Q&A Profiles Remind Users to Create/Update Q&A Profiles

Forced Enrollment

Disable account Enable Account

Remind Users to Change Password

General Settings Overview Search and Logon Options

Configuring Account Search Options

Partial user search on external network

Configuring Security Options

Hiding the domain user name on the Self-Service Site Hiding personally identifiable information for logged-in users Configuring anti-bot security settings

Configuring CAPTCHA security images Configuring reCAPTCHA security settings

Import/Export Configuration Settings

Exporting Configuration Settings Importing Configuration Settings

Outgoing Mail Servers Diagnostic Logging Scheduled Tasks

Invitation to Create/Update Profile Task Reminder to Create/Update Profile Task Reminder to Change Password Task Active Directory Sites Maximum Password Age Policy Task User Status Statistics Task Clear Old Records from Reporting Database Environment Health Checker Task Update RADIUS server status

Web Interface Customization Instance Reinitialization

Modifying Service Connection Settings Modifying Advanced Settings

Realm Instances Domain Connections

Using Domain Connections Specifying Access Account for Domain Connections Changing Access Account for Domain Connections Specifying Advanced Options for Domain Connection

Active Directory Sites

Changes Propagation

Propagating account-related changes Propagating Q&A profile-related changes Propagating password-related changes

Removing a Domain Connection

Extensibility Features

Extensibility Features Overview

RADIUS Two-Factor Authentication

Working with RADIUS servers

Password Manager components and third-party applications

Password Manager Secure Token Server Configuring Password Manager Secure Token Server

Unregistering users from Password Manager Bulk Password Reset Working with Redistributable Secret Management account

Redistributable Secret Management Service supported platforms Customizing Redistributable Secret Management log path

Email Templates

Upgrade Requirements About Secure Password Extension Upgrading Multiple Instances of Password Manager Upgrading Password Manager

In-place upgrade Upgrade 5.7.1 or later versions Running the Migration Wizard Modifying the service account Converting Q&A Profiles

Upgrading Secure Password Extension Upgrading Password Policy Manager

Installing Administrative Templates Configuring Administrative Templates Updating Administrative Templates Removing Administrative Templates

Configuring Access to Self-Service Site from Windows Logon Screen

Introducing Secure Password Extension Understanding How Secure Password Extension Works

Locating Self-Service Site Obtaining Self-Service Site URL from Service Connection Point Changing Self-Service Site URL on the Administration Site Changing Self-Service Site URL in the Administrative Template Launching User Notification

Deploying and Configuring Secure Password Extension

Deploying Secure Password Extension Configuring Secure Password Extension

Overriding Automatic Self-Service Site Location Password Manager Realm Affinity

Managing Secure Password Extension Using Administrative Templates

Generic Settings

Uninstalling Secure Password Extension

Logging in Secure Password Extension

About Password Policies

Password Policy Manager Password Policy Rules

Installing Password Policy Manager Uninstalling Password Policy Manager Creating and Configuring a Password Policy

Configuring Password Policy Rules

Password Compliance Password Age Rule Length Rule Complexity Rule Required Characters Rule Disallowed Characters Rule Sequence Rule User Properties Rule Dictionary Rule Symmetry Rule Custom Rule

Managing Password Policy Scope

Applying Password Policies Changing Policy Priority

Deleting a Password Policy

Reporting and User Action History Overview

Setting Up Reporting Environment Using Reports User Action History Managing Connections to SQL Server and Report Server

Best Practices for Configuring Reporting Services

Reporting Services Default Configuration Reporting Services Firewall Issues

Quest Enterprise Single Sign-On (QESSO)

Appendix A: Accounts Used in Password Manager

Password Manager Service Account Application Pool Identity Domain Management Account Password Policy Account Account for Using One Identity Quick Connect

Appendix B: Open Communication Ports for Password Manager Appendix C: Customization Options Overview

Customization of Steps in Self-Service and Helpdesk Tasks Email Notification Customization User Agreement Customization Account Search Options Customization Web Interface Customization Customization of Password Policies List Customization of Password Strength Meter Customization of User Name

Appendix D: Feature imparities between the legacy and the new Self-Service Sites

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Password Manager 5.11 - Administration Guide

Appendixes

Appendix A: Accounts Used in Password Manager

Appendix A: Accounts Used in Password Manager

Password Manager Service Account

Application Pool Identity