Defender 5.7 Integration Pack for ActiveRoles Server

Transcription

1 Integration Pack for ActiveRoles Server Introduction ActiveRoles Server offers a practical approach to automated user provisioning and administration, for maximum security and efficiency. It provides total control of user provisioning and administration for Active Directory. The Defender extends the management and administration of user s Defender Properties allowing token assignments and token administration through a Web Interface. Versions and later include support for the administration of Defender objects from within the Quest ActiveRoles Server MMC Admin console. Defender administration functions available include: token assignment and removal token test token recovery token programming reset token drift set Defender ID set Defender password view and reset violation count view last logon time issue fixed temporary response reset PIN.

2 Examples of the Quest ActiveRoles Server dialogs used for Defender token administration are shown below: Figure 1: Quest ActiveRoles Server Interface Figure 2: Quest ActiveRoles Server - Program Defender Token 2

3 Figure 3: Quest ActiveRoles Server - Program Defender Token with Activation Option 3

4 The administration options within the Quest ActiveRoles Server MMC Admin console include: Defender menu for license, token imports and token programming Administration and configuration of Defender objects such as Defender Security Servers, Polices and access nodes Defender user management options such as programming a token, assigning, un-assigning and testing tokens. For further information, please refer to the Defender Configuration Guide. Figure 4: Quest ActiveRoles Server MMC Admin Console Defender menu Figure 5: Quest ActiveRoles Server MMC Admin Console User properties 4

5 Pre-installation Considerations Before installation, ensure the following systems are deployed in your Active Directory environment: ActiveRoles Server version 6.7, 6.8 or 6.9, the Administration Service, Web Interface and ActiveRoles Server console. Please note that ActiveRoles Server version 7.0 is not supported for use with Defender version 5.7. Defender Administration Console or higher installed on the same server as the Web Interface. Installing the Defender Integration Pack for ARS To install the Defender Integration Pack for ARS, perform the following steps: 1. On the server where the ARS Web Interface is installed, either select Defender Integration Pack for ActiveRoles server web interface from the Defender Autorun or run ArsDefPack.msi or ArsDefPack(x64).msi directly. The ActiveRoles Server Wizard starts Figure 6: Defender ActiveRoles Server Integration Pack Setup Wizard 2. Click Next. The Wizard will now check that the Defender Administration Console is the correct version level. If the Defender Administration Console version level is correct, skip to step 3. 5

6 If the Defender Administration Console version level is incorrect, the Setup Wizard will terminate with the following message: Figure 7: Defender ActiveRoles Server Integration Pack Setup Wizard 3. The End User License Agreement dialog is displayed: Figure 8: Defender ActiveRoles Server Integration Pack - License Agreement 6

7 4. Click Next. The Administration Service Selection dialog is displayed: Figure 9: Defender ActiveRoles Server Integration Pack - Administration Service Selection 5. Specify whether the Administration Service that the Web Interface connects to is located on this computer, or on a different computer. If the Administration Service is located on a different computer, enter the required computer name. 6. Click Next. The Setup Wizard will try to contact the Administration Service. If a connection cannot be established, the following message is displayed: Figure 10: Defender ActiveRoles Server Integration Pack - Administration Service Selection Error Ensure that the Administration Service is: installed and started that you have entered correctly the name of the computer where the Administration Service is located. 7

8 7. Click OK to continue. The Ready to Install Defender ARS Integration Pack dialog is displayed: Figure 11: Defender ActiveRoles Server Integration Pack - Ready to Install 8. Click Install. The Installing Defender ARS Integration Pack dialog is displayed: Figure 12: Defender ActiveRoles Server Integration Pack - Installing 8

9 9. On completion of the installation, the Installation Complete dialog is displayed: Figure 13: Defender ActiveRoles Server Integration Pack - Setup Complete 10. Click Finish. 11. Restart the Quest ActiveRoles Administration Service on the host server(s) to complete the installation. 12. On each computer running the ActiveRoles Server Admin Service, if on a different server to the Web Interface, install the Defender Active Roles Admin Service Pack.msi or Defender Active Roles Admin Service Pack (x64).msi. 9

10 13. On completion of the installation, the Defender user and token management options are available from the ActiveRoles Server User Interface. Figure 14: Defender ActiveRoles Server User Interface Optional Configuration The Defender can be configured to provide the following options: Group Policy Options Auto-deletion of tokens. Defender Group Policy Options Defender Group Policy Options provide the following features: automatic token programming configuration temporary response expiry limit. To enable Group Policy Options, follow the instructions in Installing Defender Group Policy.txt to install the DefenderGroupPolicy.adm administrative template on a domain controller. Installing Defender Group Policy.txt is available from the Defender ARS Integration Pack folder on the Defender Installation CD. Auto-Deletion of Tokens The Auto-Deletion of Tokens feature provides automatic deletion of tokens when de-provisioning a user account. To enable this feature, from the ActiveRoles Server Console, add the ARS Defender - Unassign Tokens policy object to the Users container or the containers hosting the user accounts. 10

11 Defender Administration Defender Administration includes the following options: Defender Properties Set Defender Password Program Defender Token. Defender Properties The Defender Properties option enables you to view and manage the Defender properties for a user, allowing token assignment and administration: Figure 15: Defender ActiveRoles Server Integration - Defender Properties The fields on the Defender Properties page are described in the following table: FIELD Add.. Defender ID Violation Count Reset Count Last authentication DESCRIPTION click to add a Defender token for this user assign a Defender ID to a user the number of unsuccessful authentication attempts made by this user. If the user s violation count is not 0, a Reset Violation Count option is available. To reset the violation count, click the reset Violation Count button, then click Save. the number of times the violation count has been reset the time and date of the last successful authentication for this user 11

12 To administer the token currently assigned to this user, click the link for the token type adjacent to the required token serial number, in this example, the token type of Windows Desktop Token has been selected. The following dialog is displayed: Figure 16: Defender ActiveRoles Server Integration - Token Administration Any options that are unavailable on this page are not applicable to the selected token type. Setting a PIN To set a 4 digit PIN to be used with this token: Figure 17: Defender Set Token PIN 1. Select Set PIN. 2. In the New PIN field, enter the required PIN. 3. In the Confirm PIN field, enter the PIN again to confirm. 4. If you want the PIN to expire, prompting the user to change their PIN on first use, check the Expire PIN checkbox. 12

13 5. Click Set PIN to finish. The following message is displayed to tell you that the PIN has been set successfully. Figure 18: Defender Set Token PIN Removing the PIN To remove the current PIN from the selected token, click Clear PIN. The following message is displayed to tell you that the PIN has been successfully removed from the token: Figure 19: Defender Set Token PIN Setting a Temporary Token Response If the user needs to authenticate, but does not currently have their token available, a temporary response can be generated. To generate a temporary response for this token: 1. Click Temporary Response: Figure 20: Defender Temporary Response 2. In the Expires field, select the period of time that the temporary response will remain valid. 13

14 3. If the response can be used multiple times, check the Allow response to be used multiple times checkbox. If this box is unchecked the temporary response is single use only. 4. Click Assign to finish. The automatically generated temporary response is displayed in the Response field. This response is then provided to the end user. Testing the Defender Token To test that the Defender token is functioning correctly: 1. Click Test Token: Figure 21: Defender Token Test 2. The token serial number and token type are displayed. 3. Enter the response displayed on the token and click Verify. Recovering a Defender Token Use Recover to reset the passphrase for a Windows Desktop Token. Unassigning a Defender Token Use Unassign to unassign a Defender token from a user. 14

15 Set Defender Password The Set Defender Password option enables you to set a Defender Password for the selected user: Figure 22: Set Defender Password 1. In the Password field, enter the new Defender password for this user. 2. In the Confirm password field, enter the new password again to confirm. 3. If you want the password to expire after a pre-defined period of time, check the Expire Password checkbox. 15

16 4. Click Set Password to finish. A message is displayed telling you that the password has been set successfully. Figure 23: Defender Password Set Successfully Program Defender Token The Program Defender Token option enables you to program a Defender Desktop Token for the selected user. The options displayed on the Program Defender Token dialog are determined by the settings in the Group Policy if installed. 16

17 Defender 5.7 If the Group Policy is not installed, all token types are available: Figure 24: Programming a Defender Token 1. Select the platform on which the Defender Token will be used. 2. Select the operation mode for the token. 3. Click Program to continue. The following dialog is displayed: Figure 25: Program Defender Token 17

18 FIELD Token Serial Number Activation Code Send Activation Mail To DESCRIPTION the serial number of the Defender Token the activation code that the user must enter before the token can be used for authentication the address of the user who will receive the activation code. This feature is only available if enabled through the Defender Group Policy option. addresses must be configured on the username Properties page in Active Directory Users and Computers. To copy the activation code to the clipboard, click Copy. To send the activation code to the user, click Send. 18

19 Policies An Unassign Tokens deprovisioning policy is available that can be configured to remove all Defender tokens during the deprovisioning of a user account. To enable this policy: 1. Open the ARS Server Console and navigate to the Policies container. Figure 26: Defender ActiveRoles Server Console - Policies Container 2. Right click Defender, select New and then Deprovisioning Policy to start the New Deprovisioning Policy Object Wizard. Select Next on the Welcome screen. Figure 27: Defender ActiveRoles Server Console - New Deprovisioning Policy Object Wizard 19

20 3. Enter a suitable name and select Next. Figure 28: Defender ActiveRoles Server Console - New Deprovisioning Policy Object Wizard 4. Select Unassign Tokens as in the example below. Select Next to continue. Figure 29: New Deprovisioning Policy Object Wizard - Policy to Configure 20

21 5. Select Next to continue. Figure 30: New Deprovisioning Policy Object Wizard - Policy Parameters 6. Select Next to continue. Figure 31: New Deprovisioning Policy Object Wizard - Enforce Policy 21

22 7. Select Finish to complete the new policy object wizard. Figure 32: New Deprovisioning Policy Object Wizard - Completing New Deprovisioning Policy 8. The new Unassign Tokens deprovisioning policy is now available for use and can be added as a deprovisioning policy. Access Templates ActiveRoles Server Access Templates can be used to configure specific roles for users or security groups such as Full Defender Administrator or Helpdesk. 22

23 Three pre-configured templates are available for use and a number of individual permission templates in the Advanced section, which can be used to provide more specific permissions if required. Figure 33: Defender Access Templates 23

24 Figure 34: Advanced Defender Access Templates Figure 35: Example of the Defender Helpdesk access template 24

25 Configuration Defender Access Templates can be assigned to users or groups using the Delegate Control Wizard. The following example shows how to assign the permissions in the pre-configured Defender Helpdesk access template to a group. Figure 36: Defender ActiveRoles Server Console 25

26 1. Right-click the domain and select Delegate Control from the menu. Figure 37: Defender ActiveRoles Server Security 2. Add the users or group click Add to run the Delegation of Control Wizard. Figure 38: ActiveRoles Server - Delegation of Control Wizard 26

27 3. Click Next. Figure 39: Delegation of Control Wizard - User or Groups 4. Click Add, then locate the required user or group from the Select Object dialog. Figure 40: Delegation of Control Wizard - User or Groups 27

28 5. Click Next. Figure 41: Delegation of Control Wizard - Access Templates 6. In the Delegation of Control Wizard, select the required access template. This example uses the Defender Helpdesk template. 7. Click Next. Figure 42: Delegation of Control Wizard - Inheritance Options 28

29 8. Accept the default settings. 9. Click Next. Figure 43: Delegation of Control Wizard - Permissions Propagation 10. Select Propagate permissions to Active Directory. 11. Click Next. Figure 44: Completing the Delegation of Control Wizard 29

30 12. Click Finish. The required permissions have now been granted to the user or group Quest Software, Inc. ALL RIGHTS RESERVED. Quest, Quest Software, the Quest Software logo, Simplicity at Work, ActiveRoles and Defender are trademarks of Quest Software, Inc., and its subsidiaries. See for a complete list of Quest Software's trademarks. Other trademarks are property of their respective owners. 30