立即与支持人员聊天
与支持团队交流

Password Manager 5.14.2 - Administration Guide

About Password Manager Getting started Password Manager architecture
Password Manager components and third-party applications Typical deployment scenarios Password Manager in a perimeter network Management Policy overview Password policy overview Secure Password Extension overview reCAPTCHA overview User enrollment process overview Questions and Answers policy overview Password change and reset process overview Data replication Phone-based authentication service overview
Management policies
Checklist: Configuring Password Manager Understanding Management Policies Adding or cloning a new Management Policy Configuring access to the Administration Site Configuring access to the Password Manager Self-Service Site Configuring access to the Helpdesk Site Configuring Questions and Answers policy Workflow overview Custom workflows Custom activities Password Manager Self-Service Site workflows Helpdesk workflows Notification activities User enforcement rules
General Settings
General Settings overview Search and logon options Importing and exporting configuration settings Outgoing mail servers Diagnostic logging Scheduled tasks Web Interface customization Instance reinitialization Realm Instances Domain Connections Extensibility features RADIUS Two-Factor Authentication Internal Feedback Customizing help link URL Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable 2FA for administrators and helpdesk users Reporting Password Manager integration Accounts used in Password Manager Open communication ports for Password Manager Customization options overview Third-party contributions Glossary

Domain Controller

Selecting the domain controller allows you to specify what domain controller Password Manager should use when connecting to the managed domain. By default, two options are available: domain controller used by user computer and default domain controller.

Domain controller used by user computer is a domain controller that a user computer connects to. It may not be the same as the domain controller used by the computer running the Password Manager Service. The information about this domain controller is passed to Password Manager in requests made by Secure Password Extension.

Default domain controller is a domain controller that is automatically identified as a preferred domain controller for the computer running the Password Manager Service.

You can also add any other domain controller from the specified domain by pressing the Add button under the domain controllers table on the Advanced settings tab of the Edit Domain Connection dialog.

You can select several domain controllers to ensure fault tolerance in your environment. By default, the first domain controller in the list will be used by Password Manager to connect to the domain. But if the first domain controller is not available, Password Manager will attempt to connect to the next domain controller in the list, and so on.

When Password Manager uses a domain controller other than the first one in the list of domain controllers, the Environment Health Checker scheduled task checks whether the first domain controller (with the highest priority) is available. When it becomes available, Password Manager switches back to using this domain controller. For more information, see Environment Health Checker Task.

To specify domain controllers

  1. On the Administration Site, select the Management Policy you want to configure and click the User Scope link.

  2. On the User Scope page, select the domain connection for which you want to specify domain controllers and click Edit.

  3. On the User Scope Settings for #Domain# page, click Edit.

  4. On the Advanced settings tab of the Edit Domain Connection dialog, click Add under the domain controllers table then select required domain controllers, and click Add.

  5. Click Save and select how you want to apply the updated settings. You can either apply the new settings for this user scope only, or everywhere where this domain connection is used.

Active Directory Sites

By specifying Active Directory sites in the domain connection settings you select the site in which you want Password Manager to replicate changes as soon as they occur in other sites. This reduces downtime that users may experience when your environment has several Active Directory sites and changes do not get immediately replicated between the sites.

For example, when users unlock their accounts on the Self-Service Site, this operation may occur in one site. But when they attempt to log in to their computers, this operation may occur in another site, to which the information about the unlocked account has not been replicated yet. In this case, users will not be able to log in until the information is replicated to the second site. To mitigate this issue, select the Active Directory sites in which you want to replicate changes immediately in the domain connection settings.

When specifying the site, you can select either the default writable domain controller (automatically selected in Active Directory) or select several writable domain controllers from this site. If you specify several domain controllers, changes will be propagated to the first available domain controller in the site.

To specify Active Directory sites

  1. On the Administration Site, select the Management Policy you want to configure and click the User Scope link.

  2. On the User Scope page, select the domain connection for which you want to specify Active Directory sites and click Edit.

  3. On the User Scope Settings for #Domain# page, click Edit.

  4. On the Advanced Options tab of the Edit Domain Connection dialog, click Add under the Active Directory sites table, select required sites, and click Add.

  5. Click Save and select how you want to apply the updated settings. You can either apply the new settings for this user scope only, or everywhere where this domain connection is used.

Propagating changes

After you specify the Active Directory sites in which you want to push changes, you can also select what kind of changes to propagate. The following options are available:

Propagating account-related changes

Select this option to propagate information about unlocking and enabling user accounts in Active Directory. It is recommended to use this option when a managed domain has users in multiple Active Directory sites.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级