PrivilegeManagementforWindows 21.5 …

Privilege Management for Windows 21.5

Administration Guide

?2003-2021 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

TC:8/16/2021

PRIVILEGE MANAGEMENT FOR WINDOWS 21.5 ADMINISTRATION GUIDE

Table of Contents

Privilege Management for Windows Administration

10

Define User Roles

10

Implement Least Privilege

10

Install, Uninstall, and Upgrade Privilege Management for Windows

12

Install the Privilege Management Policy Editor

12

Install Privilege Management for Windows

13

Client Packages

13

Unattended Client Deployment

14

Configure an Alternate Event Log Location

14

Upgrade Privilege Management for Windows

16

Use Policy Precedence in a Migration Scenario

16

Recommended Steps

17

Privilege Management Reporting Console

21

Auditing Report

21

Privilege Monitoring Report

22

Diagnose Connection Problems

23

Sign Privilege Management for Windows Settings

24

Privilege Management for Windows Installation Mode Parameters

24

Create a PFX File for Use With Privilege Management for Windows

25

Use MakeCert to Generate Your Certificate

25

Use Certificate Template in a Certificate Request

26

Microsoft Certificate Services

26

Create a Privilege Management for Windows Configuration Certificate Template

26

Issue and Distribute the Certificate

27

Issue the Certificate

28

Distribute Public Keys

28

Create and Edit Signed Settings

28

Behavior when Policy Certificate Verification Fails

29

Manual Deployment of Privilege Management for Windows

31

Launch the Privilege Management Policy Editor

32

Navigate the Policy Editor

32

SALES: contact SUPPORT: support DOCUMENTATION: docs ?2003-2021 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

2 TC: 8/16/2021

PRIVILEGE MANAGEMENT FOR WINDOWS 21.5 ADMINISTRATION GUIDE

Automatic Save

33

Policies and Templates

34

Users

34

Policies

34

Edit Group Policy

34

Privilege Management Settings

34

Create

35

Delete

35

Export

36

Import

36

Import Template

36

Digitally Sign

36

Save Report

36

Set Challenge/Response Shared Key

36

Show Hidden Groups

37

View

37

License

37

HTML Report

37

Privilege Management for Windows Activity Viewer

38

Response Code Generator

39

Templates

40

Windows QuickStart

40

Windows QuickStart Policy Summary

42

Windows Workstyles

42

Windows Workstyle Parameters

43

Windows Application Groups

45

Windows Messages

46

Windows Custom Token

46

Customize the Windows QuickStart Policy

46

Discovery

47

Server Roles

47

Trusted App Protection (TAP)

48

Trusted Application Protection Policies Summary

48

SALES: contact SUPPORT: support DOCUMENTATION: docs ?2003-2021 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

3 TC: 8/16/2021

PRIVILEGE MANAGEMENT FOR WINDOWS 21.5 ADMINISTRATION GUIDE

Trusted Application Protection Precedence

50

Modify the Trusted Application Protection Policies

50

Trusted Application Protection Reporting

51

Trusted Application Protection Blocklist

52

Use Advanced Parent Tracking

52

Privilege Management for Windows Policies for Windows

54

Policy Administration

54

Advanced Agent Settings

54

Windows Policy Configuration Precedence

55

Workstyles

56

Workstyle Properties

56

Create Workstyles

58

Disable/Enable Workstyles

59

Workstyle Precedence

59

Workstyle Summary

59

Overview

60

Application Rules

61

Power Rules

63

Power Rules Additional Guidance

64

Compatibility

64

Third Party Integration Security

64

Supported Application Types

64

Validation

65

Script Restrictions

65

#Requires

65

Script Audit Failure Event

65

PowerShell Scripts Execution Policy

66

Encodings

66

Manage Scripts

66

Audit Scripts

69

On-Demand Application Rules

71

Content Rules

73

Insert a Content Rule

73

SALES: contact SUPPORT: support DOCUMENTATION: docs ?2003-2021 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

4 TC: 8/16/2021

PRIVILEGE MANAGEMENT FOR WINDOWS 21.5 ADMINISTRATION GUIDE

Built-in Groups

74

Trusted Application DLL Protection

75

Configure Trusted Application DLL Protection

76

General Rules

76

Collect User Information

76

Collect Host Information

77

Prohibit Privileged Account Management

77

Enable Windows Remote Management Connections

78

Filters

78

Account Filters

79

Computer Filters

80

Time Range Filters

80

Expiry Filter

81

WMI (Windows Management information) Filters

81

Application Groups

82

Create Application Groups

82

View or Edit the Properties of an Application Group

82

Delete an Application Group

83

Duplicate an Application Group

83

Rule Precedence

83

Application Definitions

83

ActiveX Codebase Matches

84

ActiveX Version Matches

84

App ID Matches

84

Application Requires Elevation (UAC)

84

Application Requires Elevation (UAC)

84

Uninstaller

84

BeyondTrust Zone Identifier Exists

84

CLSID Matches

85

COM Display Name Matches

85

Command Line Matches

85

Controlling Process Matches

85

Drive Matches

85

SALES: contact SUPPORT: support DOCUMENTATION: docs ?2003-2021 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

5 TC: 8/16/2021

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download