The mangement console uses the default log-on domain to authenticate the user name you use when logging onto the console.
To set the default log-on domain
The Active Directory Forest Configuration dialog displays.
This allows you to log onto the mangement console using a simple name instead of "user@domain".
You can configure the mangement console to communicate with one or more Privilege Manager policy groups which allows you to centrally manage security policy, remotely configure the Privilege Manager hosts, and view keystroke logs generated by the policy. The Privilege Manager settings in System Settings allows you to activate previously configured service accounts on policy servers. This enables you to view and edit the policy, view keystroke logs, and run policy reports.
Use the Privilege Manager settings to configure the service account and activate the policy groups that you want to use for checking policy and keystroke logging.
Before you can use the Privilege Manager features, you must install and configure a Privilege Manager primary policy server. (See Install the Privilege Manager Packages for details.)
Configuring a service account activates the policy group and allows the console to access both pmpolicy or sudoers policy files, view events and keystroke logs for a policy group.
To configure service account
Log in as supervisor or an Active Directory account with rights to change System Settings; that is, an account in the Console Administration role.
From the top-level Settings menu, navigate to System settings | Privilege Manager.
Click Configure service account next to the primary policy server listed.
|
Note: If your policy group is not listed, make sure you have added and profiled the host where Privilege Manager software is installed as the primary policy server to the mangement console; then re-profile the host. |
On the Configure Service Account dialog, enter credentials to log onto the primary policy server and click OK.
|
Note: This task requires elevated credentials. |
Verify that the Active box is checked and click OK to save System Settings.
When you configure the service account, the mangement console,
|
Note: The questusr account is a user service account used by Management Console for Unix to manage Privilege Manager policy and search event logs. It is a non-privileged account (that is, it does not require root-level permissions) used by the console to gather information about existing policy servers and commit policy changes. questgrp is the primary group (gid) for questusr. |
|
Note: questusr, pmpolicy, and pmclient are all non-privileged service accounts (that is, they do not require root-level permissions). The pmpolicy and pmclient users are used to sync the security policy on policy servers and on Sudo Plugin hosts (offline policy cache), respectively. The pmlog and pmpolicy groups are used to control access to log files and the security policy, respectively. |
|
Note: If you receive an error message saying you could not log in with the user service account, please refer to Service Account Login Fails to troubleshooting this issue. |
If questusr is inadvertently deleted from the console,
Unconfiguring a service account deactivates the policy group in the mangement console and disables console access to the policy file and keystroke logs on the primary policy server.
To unconfigure service account
|
Note: This task requires elevated credentials. |
|
Note: When you unconfigure a service account, the mangement console,
|
© 2023 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy