Management Policy is a core element of Password Manager. Using the Management Policy you can configure workflows for registering new users, resetting passwords, and others. For each Management Policy you can configure a user scope, and delegate helpdesk tasks by configuring a helpdesk scope. You can configure multiple Management Policies with different user and helpdesk scopes, workflows and secret questions. The default Management Policy with preconfigured workflows is available out of the box.
A Management Policy consists of the following components:
User scope is a group or several groups of users managed by Password Manager. When configuring the user scope for a Management Policy, you can add connections to multiple AD LDS instances. For more information about the user scope, see .
Helpdesk scope is a group of helpdesk operators who are allowed to manage users from the user scope of the same Management Policy. By configuring the helpdesk scope you can delegate administrative tasks to specified helpdesk operators. For more information about the helpdesk scope, see Configuring Access to the Helpdesk Site.
Questions and Answers policy (Q&A policy) is a policy within which secret questions and Q&A profile settings are defined. Secret questions are a set of mandatory, optional and helpdesk questions for users’ Questions and Answers profiles. These questions are used to register users with Password Manager and later to authenticate users when they use the Self-Service site. Q&A profile settings define how many questions a user must answer to create Q&A profile settings and set requirements for user’s questions and answers. For more information about Q&A policy, see Configuring Questions and Answers Policy.
All workflows are divided into two categories: self-service and helpdesk workflows. The self-service workflows define the tasks available to users on the Self-Service site, i.e. every configured workflow is a task on the Self-Service site. The helpdesk workflows define what tasks are available to helpdesk operators on the Helpdesk site. A workflow consists of several activities that you can add to or remove from the workflow to customize it.
The Default Management Policy offers preconfigured workflows. You can also create your own workflows. For more information about workflows, see Workflow Overview.
User enforcement rules allow you to set up the enforcement schedule to invite users to create or update their Q&A profiles and configure the reminder that will notify users to change passwords before password expiration. For more information, see User Enforcement Rules.
By default, the access to the Administration site is granted to the local Administrators group and to the PMAdminADLDS group which is created during Password Manager installation.
To provide access to the Administration site, add the delegated administrators' accounts to the PMAdminADLDS group, on the computer where Password Manager is installed. Members of the PMAdminADLDS group have access to the complete functionality of the Administration site.
Note, that the account which you specified as Application Pool Identity when installing Password Manager is automatically added to the PMAdminADLDS group.
|IMPORTANT: Make sure you add only the most trustworthy persons to the PMAdminADLDS group, since changing Password Manager configuration involves dealing with user-sensitive information.|
To configure access to the Self-Service site, you need to configure a user scope for the Management Policy you want to use. The workflows and secret questions that you configure for the Management Policy will apply only to the user scope of this Management Policy. You can add connections to several AD LDS instances to a single user scope. For more information, see .
In Password Manager you can easily delegate administrative tasks to dedicated helpdesk operators. By configuring the helpdesk scope you select groups of helpdesk operators who will have access to the Helpdesk site. The Helpdesk site handles typical tasks performed by helpdesk operators, such as resetting passwords, unlocking user accounts, assigning temporary passcodes, and others.
Members of the helpdesk scope are allowed to access the Helpdesk site and manage users from the user scope of the same Management Policy only.
You can also restrict groups of helpdesk operators from accessing the Helpdesk site.
To configure a helpdesk scope, you need to add a connection to an AD LDS instance to the scope at first, and then specify groups that will be allowed or denied access to the Helpdesk site.
To manage all connections from a single place, click General Settings|AD LDS Instance Connections on the Administration site. For more information, view AD LDS Instance Connections.
To connect to AD LDS instance
For information on how to prepare the access account, see Configuring Permissions for Access Account.
To specify groups or OUs that are allowed to access the Helpdesk site