立即与支持人员聊天
与支持团队交流

One Identity Management Console for Unix 2.5.3 - Administration Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Management Console for Unix Installing Management Console for Unix Preparing Unix hosts Working with host systems Managing local groups Managing local users Active Directory integration Authentication Services integration Privilege Manager integration Reporting Setting preferences Security Troubleshooting tips
Auto profiling issues Active Directory Issues Auditing and compliance Cannot create a service connection point Check Authentication Services agent status commands not available CSV or PDF reports do not open Database port number is already in use Elevation is not working Hosts do not display Import file lists fakepath Information does not display in the console License information in report is not accurate Out of memory error Post install configuration fails on Unix or Mac Privilege Manager feature issues Profile task never completes questusr account was deleted Readiness check failed Recovering from a failed upgrade Reports are slow Reset the supervisor password Running on a Windows 2008 R2 domain controller Service account login fails Setting custom configuration settings Single Sign-on (SSO) issues JVM memory tuning suggestions Start/stop/restart Management Console for Unix service Toolbar buttons are not enabled UID or GID conflicts
System maintenance Command line utilities Web services Database maintenance

Unconfiguring a service account

Unconfiguring a service account deactivates the policy group in the mangement console and disables console access to the policy file and keystroke logs on the primary policy server.

To unconfigure service account

  1. Log in as supervisor or an Active Directory account with rights to change System Settings; that is, an account in the Console Administration role.
  2. From the top-level Settings menu, navigate to System settings | Privilege Manager.
  3. Click Unconfigure service account next to the primary policy server listed.
  4. On the Unconfigure Service Account dialog, enter credentials to log onto the primary policy server and click OK.

    Note: This task requires elevated credentials.

  5. Verify that the Active box is not checked.

Note: When you unconfigure a service account, the mangement console,

  1. leaves the "questusr" and the corresponding "questgrp" account on the host.
  2. removes questusr from the pmpolicy and pmlog groups.
  3. leaves questusr as an implicit member of questgrp.
  4. removes the policy group SSH key from questusr's authorized_keys, /var/opt/quest/home/questusr/.ssh/authorized_keys.

Activating policy groups

To centrally manage a policy, view events, or reply keystroke logs for a policy group, you must activate it.

Note: You can only activate an inactive policy group if it has been previously configured. See Configuring a service account for details.

To activate policy groups

  1. Log in as supervisor or an Active Directory account with rights to change System Settings; that is, as an Active Directory account in the Console Administration role.
  2. From the top-level Settings menu, navigate to System settings | Privilege Manager.
  3. Select the Active box next to the policy groups you wish to activate and click OK to save the change and return to the mangement console.

    Note: If your policy group is not listed, make sure you have added and profiled the host where Privilege Manager software is installed as the primary policy server to the mangement console; then re-profile the host.

Deactivating policy groups

You cannot remove policy groups directly from Privilege Manager system settings. However, if you decide you no longer want to manage the policy file, view events or replay keystroke logs for a particular policy group, you can deactivate it. Deactivating the policy group does not unconfigure the service account; it simply disables console access to the policy and keystroke logs on the primary policy server. See Unconfiguring a service account for details about unconfiguring the Service Account.

To deactivate policy groups

  1. Log in as supervisor or an Active Directory account with rights to change System Settings; that is, as an Active Directory account in the Console Administration role.
  2. From the top-level Settings menu, navigate to System settings | Privilege Manager.
  3. Deselect the Active box to deactivate the policy group and click OK to save the change and return to the mangement console.

Software & Licenses settings

Use the Software & Licenses settings to:

  • Set the Privilege Manager software location on the server.
  • Check for Privilege Manager licenses.

Note: Centralized policy management and keystroke logging are licensed separately.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级