Processing discovered privileged applications
Use the Privileged Application Discovery screen under the Discovery & Remediation tab to process the privileged applications that were reported by the client computers. If these applications are approved and need to continue even after the least-privileged environment is in place, use this screen to automatically create and assign Elevation rules to appropriate groups. If a discovered application is not approved for use in the least privileged environment, you can ignore these applications and they will no longer display. Follow the prompts or see the Safeguard Privilege Manager for Windows Administration Guide for more information.
Deploying rules
To create the default rules provided by Privilege Manager, use the Create GPO with Default Rules Wizard. To access the wizard from the Getting Started screen, select the Setup Tasks tab and then double-click Create GPO with default rules. Follow the prompts or see the Safeguard Privilege Manager for Windows Administration Guide for more information.
Removing local admin rights
The last step in preparing your environment for least privileged use is to remove administrative access from users who no longer require it.
Using the Active Directory Users and Computers utility
Using the Active Directory Users and Computers utility
To scrub the Domain Administrators group of users that should no longer have administrative rights to every computer in the domain, use the native Active Directory Users and Computers utility of the supported Windows Server operating systems.
To remove users from the Domain Administrators group,
-
Select Domain Admins Properties > Members tab > Remove.
-
Click Discover Accounts in local Administrator groups to discover users and domain groups with local administrator rights.
NOTE: By default, the search results will only include domain users and domain groups. However, you can optionally opt to include local and built-in (for informational purposes only) users.
