NETWRIX PASSWORD MANAGER

Transcription

1 NETWRIX PASSWORD MANAGER ADMINISTRATOR S GUIDE Prduct Versin: 6.5 March 2014

2 Legal Ntice The infrmatin in this publicatin is furnished fr infrmatin use nly, and des nt cnstitute a cmmitment frm Netwrix Crpratin f any features r functins, as this publicatin may describe features r functinality nt applicable t the prduct release r versin yu are using. Netwrix makes n representatins r warranties abut the Sftware beynd what is prvided in the License Agreement. Netwrix Crpratin assumes n respnsibility r liability fr the accuracy f the infrmatin presented, which is subject t change withut ntice. If yu believe there is an errr in this publicatin, please reprt it t us in writing. Netwrix is a registered trademark f Netwrix Crpratin. The Netwrix lg and all ther Netwrix prduct r service names and slgans are registered trademarks r trademarks f Netwrix Crpratin. Active Directry is a trademark f Micrsft Crpratin. All ther trademarks and registered trademarks are prperty f their respective wners. Disclaimers This dcument may cntain infrmatin regarding the use and installatin f nn-netwrix prducts. Please nte that this infrmatin is prvided as a curtesy t assist yu. While Netwrix tries t ensure that this infrmatin accurately reflects the infrmatin prvided by the supplier, please refer t the materials prvided with any nn-netwrix prduct and cntact the supplier fr cnfirmatin. Netwrix Crpratin assumes n respnsibility r liability fr incrrect r incmplete infrmatin prvided abut nn-netwrix prducts Netwrix Crpratin. All rights reserved. Page 2 f 53

3 Table f Cntents 1. INTRODUCTION Overview Hw This Guide is Organized PRODUCT OVERVIEW Key Features and Benefits Prduct Architecture Deplyment Structure Licensing Infrmatin INSTALLING NETWRIX PASSWORD MANAGER Installatin Prerequisites Hardware Requirements Sftware Requirements Installing Passwrd Manager Service and Web Applicatin Installing Passwrd Manager Client Upgrading frm Previus Versins Migrating t Anther Server CONFIGURING PASSWORD MANAGER SECURITY Cnfiguring Web Applicatin Security Cnfiguring Rles Cnfiguring Service Accunt Permissins Installing Web Applicatin in a DMZ Cnfiguring a DMZ Server that is an AD Dmain Member Cnfiguring a DMZ Server that is nt an AD Dmain Member Clustering fr Enhanced Stability Cnfiguring Passwrd Manager Client Security Cnfiguring Prfile Database Security Cnfiguring Built-In Security Plicies CONFIGURING PASSWORD MANAGER SETTINGS Accessing the Administrative Prtal Cnfiguratin Optins Overview Cnfiguring the Managed Dmains Cnfiguring Ggle Apps Settings Editing Ntificatin Templates Page 3 f 53

4 5.5. Custmizing the Self-Service Prtal Branding User Optins Predefined Questins Questins Plicy Authenticatin Plicy Passwrd Plicy Alerts SMTP Settings Updates Assigning Rles ENROLLING USERS FOR SELF-SERVICE Manual Enrllment Autmatic Enrllment Batch Enrllment Batch Remval TROUBLESHOOTING NETWRIX PASSWORD MANAGER Errr Issue Descriptin Hw t Fix A APPENDIX: NETWRIX PASSWORD MANAGER REGISTRY KEYS Page 4 f 53

5 1. INTRODUCTION 1.1. Overview This guide is intended fr system administratrs and integratrs. It cntains a detailed prduct verview, instructins n hw t install the prduct and infrmatin abut security installatin and cnfiguratin ptins. It als explains hw t setup and use Netwrix Passwrd Manager Hw This Guide is Organized This sectin explains hw this guide is rganized and prvides a brief verview f each chapter. Chapter 1 Intrductin: the current chapter. It explains the purpse f this dcument, defines its audience and explains its structure. Chapter 2 Prduct Overview prvides an verview f the Netwrix Passwrd Manager features, and explains the system s architecture and deplyment structure. It als cntains infrmatin n licensing. Chapter 3 Installing Netwrix Passwrd Manager cntains detailed instructins that will guide yu thrugh the installatin prcess f the Passwrd Manager Service and Client applicatins. It explains different installatin scenaris, and als prvides infrmatin n hw t upgrade frm previus prduct versins. Chapter 4 Cnfiguring Passwrd Manager Security explains different cnfiguratin and deplyment ptins that prvide fr enhanced applicatin security. It cntains detailed instructins n hw t setup the prduct fr maximum perfrmance and security. Chapter 5 Cnfiguring Passwrd Manager Settings explains hw t cnfigure the Self- Service Prtal and the ptins available t users, hw t enfrce verificatin questins plicies and apply passwrd restrictins, etc. Chapter 6 Enrlling Users fr Self-Service lists and explains different enrllment ptins, and prvides guidance fr administratrs n which ptin t chse. Chapter 7 Trubleshting Netwrix Passwrd Manager lists the issues that may be encuntered while using Netwrix Passwrd Manager, and cntains detailed instructins n hw t reslve them. Appendix: cntains a list f all registry keys that prvide additinal ptins fr Netwrix Passwrd Manager cnfiguratin. Page 5 f 53

6 2. PRODUCT OVERVIEW 2.1. Key Features and Benefits In an Active Directry envirnment, administratin f user passwrds includes multiple tasks, such as enfrcing passwrd security requirements thrugh Grup Plicy, help-desk activities, and batch cnfiguratin f user accunt management ptins. Often, these peratins are decentralized, and accunt wners are left ut f accunt management. Netwrix Passwrd Manager is a slutin that helps reduce help-desk and administratin wrklad by ding the fllwing: Prviding end users with self-service web access t cmmn passwrd management tasks; Allwing help-desk peratrs t manage users accunts and view reprts n their status thrugh a simple web interface; Allwing administratrs t enfrce restrictins n the kinds f passwrds that can be used, and t apply security plicies and identity verificatin prcedures t the managed dmains. T achieve this, the fllwing three rles are distinguished: End users Help-desk peratrs Administratrs By assigning these rles t grups and single users, yu can cntrl wh can perfrm which passwrd management peratins Prduct Architecture Netwrix Passwrd Manager cnsists f the fllwing three cmpnents: Web Applicatin: supprts the web prtals that prvide the Passwrd Manager functinality: Administrative Prtal: allws cnfiguring passwrd plicies and user ptins, imprting user accunt data fr batch enrllment, etc. Help-Desk Prtal: allws centralized management and reprting n the enrlled users accunts. Self-Service Prtal: a web-interface fr end users t perfrm passwrd management peratins withut cntacting the help-desk. Passwrd Manager Service: executes the peratins requested thrugh the web prtals. Passwrd Manager Client (als referred t as Windws Lgn Prmpt Extensin*): extends the standard Windws lgn prmpt and pps up a dialg bx that allws end users t perfrm self-service passwrd management peratins. It als supprts the enrllment wizard. * It is referred t as GINA extensin n pre Windws Vista systems and as Credentials Prvider n Windws Vista and Windws Server 2008 r higher. Bth Passwrd Manager Client and the web clients cnnect t the web service via the HTTP r HTTPS prtcl. The web service, in turn, cnnects t Passwrd Manager Service via the RPC Page 6 f 53

7 prtcl. Passwrd Manager Service hlds a secure prfile database in the lcal file system, and cmmunicates with Active Directry via encrypted LDAP and RPC channels. The figure belw illustrates the Netwrix Passwrd Manager architecture and wrkflws: Figure 1: Passwrd Manager Architecture 2.3. Deplyment Structure Netwrix Passwrd Manager cmpnents are typically distributed as fllws: I. Passwrd Manager Service runs n a member server in an Active Directry dmain. Nte: Installatin f the Service n dmain cntrllers is pssible but nt recmmended. II. Web Applicatin is installed n the same cmputer where Passwrd Manager Service is installed. The Administrative, Help-Desk and Self-Service prtals prvided by Web Applicatin are available frm anywhere in the dmain, and, ptinally, frm the Internet. Nte: If yu want t install Web Applicatin in a DMZ (demilitarized zne), s that the web prtals are accesible frm anywhere n the Internet, yu may want t install Passwrd Manager Service n a different machine behind yur firewall as a Page 7 f 53

8 mre secure cnfiguratin ptin. Fr infrmatin n this installatin scenari and detailed instructins, refer t Sectin 4.4 Installing Web Applicatin in a DMZ. III. Passwrd Manager Client is installed n end users cmputers (this cmpnent is ptinal). Nte: The Passwrd Manager Client and the Self-Service Prtal are identical in terms f the functins they prvide. Depending n yur plicies, yu can chse nt t deply the Passwrd Manager Client, and nt sacrifice any functinality; r yu can deply it t give end users mre self-service access ptins Licensing Infrmatin Netwrix Passwrd Manager is licensed fr a free 20-days evaluatin perid. Netwrix Passwrd Manager can be used as freeware fr 100 users r less. Otherwise, a cmmercial license is required. Fr license types and pricing infrmatin, please refer t Netwrix Passwrd Manager web page. T register the prduct with a permanent cmmercial license purchased frm Netwrix, take the fllwing steps: 1. Purchase the license cde (it can be requested frm the prduct page). 2. Install the prduct fllwing the instructins in Chapter 3 Installing Netwrix Passwrd Manager. 3. Open the Administrative Prtal (fr instructins refer t Sectin 5.1 Accessing the Administrative Prtal) and click License. The Licensing Infrmatin page will be displayed: Figure 2: Licensing Infrmatin Page 4. Fill in the fields and click OK. Page 8 f 53

9 3. INSTALLING NETWRIX PASSWORD MANAGER This chapter guides yu thrugh the installatin prcess f Passwrd Manager Service, Web Applicatin and Passwrd Manager Client. It cntains the fllwing sectins: Installatin Prerequisites Installing Passwrd Manager Client Upgrading frm Previus Versins Migrating t Anther Server 3.1. Installatin Prerequisites Hardware Requirements Befre installing Netwrix Passwrd Manager, make sure that the cmputers, where Passwrd Manager Service and Web Applicatin are ging t be installed, meet the fllwing hardware requirements: Minimum 20 MB f free hard disk space Minimum 512 MB f RAM Sftware Requirements Make sure that this sftware has been installed n the crrespnding cmputers befre prceeding with the installatin. Table 1: Passwrd Manager Sftware Requirements Prduct Cmpnent Passwrd Manager Service and Web Applicatin Required Sftware Platfrm: Intel x86, AMD 32 r 64 bit General requirements: Windws XP SP3 r abve.net Framewrk 3.5 SP1 Windws Installer 3.1 r abve Micrsft Internet Explrer 6.0 r abve / Mzilla Firefx 2.0 r abve / Apple Safari 2.0 r abve / Ggle Chrme 4.0 r abve IIS 6.0 r abve (Web Server rle fr Windws Server 2008) The fllwing features must be enabled prir t the installatin: IIS 6 Management Cmpatibility ASP extensin Windws Integrated Authenticatin Annymus Authenticatin ASP.NET Fr instructins n hw t install the Web Server rle, please refer t the fllwing article: Installing the Web Server Rle. Passwrd Manager Client OS: Windws XP SP3 r abve Web brwser: Micrsft Internet Explrer 6.0 r abve Make sure that the end users cmputers have ne f the fllwing web brwsers installed: Micrsft Internet Explrer 6.0 r abve Page 9 f 53

10 Mzilla Firefx 2.0 r abve Apple Safari 2.0 r abve Ggle Chrme 4.0 r abve 3.2. Installing Passwrd Manager Service and Web Applicatin Prcedure 1. T install Passwrd Manager Service and Web Applicatin 1. Run the prduct setup file called prm_setup.exe n a member server r a wrkstatin. 2. In a simple scenari, accept the default settings and specify the service accunt in the DOMAIN\user frmat. The service accunt must have the apprpriate access rights t yur dmain accunts t be able t reset passwrds and unlck accunts. Fr details n the service accunt privileges, refer t Sectin 4.3 Cnfiguring Service Accunt Permissins. 3. Fllw the instructins f the wizard t cmplete the installatin. As a result, nce the installatin is cmplete, the Administrative Prtal will be started in the default web brwser. Fr security cnsideratins, it is recmmended t enable the HTTPS prtcl fr the Web Server n the machine where Passwrd Manager Service is installed. Fr details n hw t enable encryptin fr IIS, refer t the fllwing dcumentatin: Hw t implement SSL in IIS Hw t Set Up SSL n IIS 7 Fr the advanced installatin scenari (installatin n an Internet-facing DMZ server), refer t Sectin 4.4 Installing Web Applicatin in a DMZ Installing Passwrd Manager Client Passwrd Manager Client can be installed manually r autmatically thrugh Grup Plicy. Installatin thrugh Grup Plicy is recmmended when yu need t deply Passwrd Manager Client n a large number f client cmputers. If yu want t perfrm silent installatin, yu can d it via the cmmand prmpt by using the msiexec cmpnent with any f its ptins enabled. See the prcedures belw fr instructins n the installatin ptins: Prcedure 2 T install Passwrd Manager Client manually Prcedure 3 T install Passwrd Manager Client via the cmmand prmpt Prcedure 4 Run the fllwing cmmand in the cmmand prmpt: msiexec.exe /I prm_client.msi PM_URL= /quiet. 1. T check all available ptins, type in msiexec/help and press Enter. 2. T enable the required Passwrd Manager self-service ptin, add its name and a value t the cmmand prmpt when installing the client. The available ptins are as fllws: PM_NOLPE: can be true r false, qutes needed. If true, nly the enrllment wizard is installed, withut the lgn prmpt extensin, which helps reset a passwrd frm the lgn screen. Page 10 f 53

11 PM_URL: URL f the Passwrd Manager server, by default Prcedure 2. Prcedure 3. ALLUSERS: can be 1 r 2, if 1 the enrllment wizard is installed fr all users. PM_NOREBOOT= can be true r false, qutes needed. If true, Windws XP/2003 machines will nt rebt after installatin. The ptins shuld be added in the fllwing frmat: msiexec /i <file name>.msi <ptin name=%ptin value%> /quiet Example: msiexec.exe /i prm_client.msi ALLUSERS="1" PM_URL= /quiet. T add several ptins, separate them by a space in the fllwing frmat: msiexec /i <file name>.msi <ptin1 name=%ptin1 value%> <ptin2 name=%ptin2 value%> quiet Example: msiexec.exe /i prm_client.msi ALLUSERS="1" PM_NOLPE="false" PM_URL= PM_NOREBOOT="true" /quiet. T install Passwrd Manager Client via Grup Plicy T install Passwrd Manager Client manually 1. Run the prm_client.msi installatin package (lcated in the Passwrd Manager installatin flder) n all cmputers where yu want t deply the Passwrd Manager Client (Windws Lgn Prmpt Extensin). The installatin wizard will start. 2. When prmpted, specify the installatin path and the path t the Self-Service Prtal. 3. Fllw the instructins f the wizard t cmplete the installatin. T install Passwrd Manager Client via the cmmand prmpt 3. Run the fllwing cmmand in the cmmand prmpt: msiexec.exe /I prm_client.msi PM_URL= /quiet. 4. T check all available ptins, type in msiexec/help and press Enter. 5. T enable the required Passwrd Manager self-service ptin, add its name and a value t the cmmand prmpt when installing the client. The available ptins are as fllws: PM_NOLPE: can be true r false, qutes needed. If true, nly the enrllment wizard is installed, withut the lgn prmpt extensin, which helps reset a passwrd frm the lgn screen. PM_URL: URL f the Passwrd Manager server, by default ALLUSERS: can be 1 r 2, if 1 the enrllment wizard is installed fr all users. PM_NOREBOOT= can be true r false, qutes needed. If true, Windws XP/2003 machines will nt rebt after installatin. The ptins shuld be added in the fllwing frmat: msiexec /i <file name>.msi <ptin name=%ptin value%> /quiet Example: msiexec.exe /i prm_client.msi ALLUSERS="1" PM_URL= /quiet. Page 11 f 53

12 Prcedure 4. T add several ptins, separate them by a space in the fllwing frmat: msiexec /i <file name>.msi <ptin1 name=%ptin1 value%> <ptin2 name=%ptin2 value%> quiet Example: msiexec.exe /i prm_client.msi ALLUSERS="1" PM_NOLPE="false" PM_URL= PM_NOREBOOT="true" /quiet. 1. Verify that: T install Passwrd Manager Client via Grup Plicy Passwrd Manager Service and Web Applicatin are installed n the server. The Grup Plicy Management Cnsle (GPMC) is installed n the target cmputer. Nte: The Grup Plicy Management Cnsle is a free dwnlad frm Micrsft, and can be btained frm the fllwing link: 2. Start the GPMC by ging t Start Cntrl Panel Administrative Tls Grup Plicy Management. 3. Right-click the OU (rganizatinal unit), r the entire dmain, that yur client cmputers belng t, and select Create and Link a GPO Here. Enter the name f the new GPO (Grup Plicy Object), fr example Netwrix Passwrd Manager. 4. Right-click the newly created GPO and select Edit t start Grup Plicy Object Editr. 5. Navigate t the Cmputer Cnfiguratin Administrative Templates nde, right click it and select the Add/Remve Templates ptin. Click Add and brwse t the Netwrixpm.adm file (by default installed t C:\PrgramFiles\Netwrix Passwrd Manager). 6. Navigate t the Cmputer Cnfiguratin Administrative Templates Netwrix Passwrd Manager nde and duble-click Passwrd Manager server URL in the right pane. In the dialg that pens, select the Enabled ptin, and enter the Self-Service Prtal URL. 7. Adjust the advanced ptins (fr example Suppress Enrllment Errrs, Reset Lcal Credentials Cache, and thers) if necessary. 8. Place the prm_client.msi package in a netwrk share, e.g. \\MYSERVER\Share. Nte: This share and its cntents must be available t all users. 9. Navigate t Cmputer Cnfiguratin Plicies Sftware Settings. Right-click Sftware Installatin, and select New Package. 10. Select the package frm the share. In the Deply Sftware dialg select Assigned (the default value), and click OK. The Passwrd Manager Client will be deplyed autmatically n end users cmputers during the next startup. They will be restarted autmatically after the installatin. Nte: If later the Passwrd Manager Web Applicatin is mved t anther server, the Passwrd Manager URL must be updated. Figure 3: and Figure 5: belw shw the lgn dialg fr Windws 7 and Windws XP/2000 with the Lgn Prmpt Extensin that will nw be displayed each time yu lg n the system: Page 12 f 53

13 Figure 3: Lgn Prmpt Extensin Dialg in Windws 7 Nte: If yu cannt lg n the system, click the Other Credentials buttn, and then select the Can t lg n? Click HERE fr assistance icn: Figure 4: The lgn assistance icn Figure 5: Lgn Prmpt Extensin Dialg in Windws XP/2000 Page 13 f 53

14 3.4. Upgrading frm Previus Versins Prcedure 5. T upgrade Passwrd Manager Service and Web Applicatin 1. Back up the three.bin files in the prduct installatin flder (alinf.bin, inv_lgn.bin and secrets.bin). 2. Install a new versin in the same way as explained in Sectin 0 Make sure that the end users cmputers have ne f the fllwing web brwsers installed: Micrsft Internet Explrer 6.0 r abve Mzilla Firefx 2.0 r abve Apple Safari 2.0 r abve Ggle Chrme 4.0 r abve 3. Installing Passwrd Manager Service and Web Applicatin abve. All current prduct settings will be preserved, and n recnfiguratin is required. Nte: If yu applied sme specific IIS settings t yur previus Netwrix Passwrd Manager versin, verify them and recnfigure if necessary. Prcedure 6. T upgrade Passwrd Manager Client via Grup Plicy 1. Uplad the latest prm_client.msi file t a netwrk share as explained in Prcedure 4 Run the fllwing cmmand in the cmmand prmpt: msiexec.exe /I prm_client.msi PM_URL= /quiet. 6. T check all available ptins, type in msiexec/help and press Enter. 7. T enable the required Passwrd Manager self-service ptin, add its name and a value t the cmmand prmpt when installing the client. The available ptins are as fllws: PM_NOLPE: can be true r false, qutes needed. If true, nly the enrllment wizard is installed, withut the lgn prmpt extensin, which helps reset a passwrd frm the lgn screen. PM_URL: URL f the Passwrd Manager server, by default ALLUSERS: can be 1 r 2, if 1 the enrllment wizard is installed fr all users. PM_NOREBOOT= can be true r false, qutes needed. If true, Windws XP/2003 machines will nt rebt after installatin. The ptins shuld be added in the fllwing frmat: msiexec /i <file name>.msi <ptin name=%ptin value%> /quiet Example: msiexec.exe /i prm_client.msi ALLUSERS="1" PM_URL= /quiet. T add several ptins, separate them by a space in the fllwing frmat: msiexec /i <file name>.msi <ptin1 name=%ptin1 value%> <ptin2 name=%ptin2 value%> quiet Example: msiexec.exe /i prm_client.msi ALLUSERS="1" PM_NOLPE="false" PM_URL= PM_NOREBOOT="true" /quiet. 2. T install Passwrd Manager Client via Grup Plicy. Page 14 f 53

15 3. Navigate t Start Cntrl Panel Administrative Tls Grup Plicy Management. T lcate the required Dmain Plicy, expand the Frest <frest_name> Dmains <dmain_name> Grup Plicy Objects nde. Right-click the nde and select Edit. 4. Navigate t Cmputer Cnfiguratin Plicies Sftware Settings, right-click Passwrd Manager Client package and select All Tasks Redeply Applicatin. The Passwrd Manager Client will be reinstalled n all cmputers where the Grup Plicy applies Migrating t Anther Server Prcedure 7. T migrate Netwrix Passwrd Manager t anther server 1. Install Netwrix Passwrd Manager n a new server. 2. Stp Netwrix Passwrd Manager Service n the server where the prduct was installed initially. 3. On the ld server, navigate t the prduct installatin directry (the default path is C:\PrgramFiles(x86)\Netwrix Passwrd Manager) and cpy the fllwing files t the same lcatin n the new server: alinf.bin secrets.bin PredefinedQuestins.txt the entire Templates flder 4. Start Passwrd Manager Service n the new server. 5. If yu are using Netwrix Passwrd Manager Client, change Netwrix Passwrd Manager server address as fllws: a. Navigate t Start Administrative Tls Grup Plicy Management Cnsle. b. Right-click the GPO created fr Netwrix Passwrd Manager and select Edit frm the pp-up menu. c. In the dialg that pens, navigate t Cmputer Cnfiguratin Administrative Templates <Yur_Passwrd_Manager_Template>. d. In the right pane, specify the new server URL in the Passwrd Manager Server URL entry field. Page 15 f 53

16 4. CONFIGURING PASSWORD MANAGER SECURITY There are several ways t enhance Passwrd Manager peratinal security. This chapter explains the available security ptins and prvides detailed instructins n hw t cnfigure them. This chapter cvers: Cnfiguring Web Applicatin Security Cnfiguring Rles Cnfiguring Service Accunt Permissins Installing Web Applicatin in a DMZ Clustering fr Enhanced Stability Cnfiguring Passwrd Manager Client Security Cnfiguring Prfile Database Security Cnfiguring Built-In Security Plicies 4.1. Cnfiguring Web Applicatin Security The Web Applicatin cmpnent des nt have any inner security lgic: it acts merely as a cmmunicatin and presentatin layer between the Web Prtals/Passwrd Manager Client and the Passwrd Manager Service. All security checks and plicy enfrcements are realized n the Passwrd Manager Service side. Hwever, t prvide fr secure cmmunicatins, SSL (Secure Sckets Layer) is required t prevent data eavesdrpping and tampering. Yu must install an SSL certificate (fr example, btained frm n yur web server, and enable the HTTPS prtcl at prt 443. It is recmmended t disable the nn-secure HTTP prtcl n prt 80. T install an SSL certificate, perfrm ne f the prcedures belw depending n yur IIS versin: Prcedure 8 T install an SSL certificate n IIS7 Prcedure 9 T install an SSL certificate n IIS6 T redirect users frm any page f yur website right t the Passwrd Manager Prtal, r t create redirectin frm an http address t an https address, fllw the prcedure belw: Prcedure 8. Prcedure 10 T create a redirect in IIS T install an SSL certificate n IIS7 1. On the Passwrd Manager server, navigate t Start Cntrl Panel Administrative Tls Internet Infrmatin Services (IIS) Manager. In the left pane, select the cmputer where the Passwrd Manager Web Applicatin is installed. 2. In the center pane, duble-click Server Certificates. 3. In the Server Certificate dialg that pens, select ne f the ptins in the Actins pane depending n the actin yu want t take: imprt an existing certificate, request a certificate, r create a certificate: Page 16 f 53

17 Figure 6: Server Certificate: Actins Tab 4. When a certificate has been installed, in the left pane select the default web site where yur PRM flder is displayed. 5. In the Actins pane, click Bindings, and then click Add. The fllwing dialg will be displayed: Figure 7: Add Site Binding 6. In the Type drp-dwn list, select https, specify yur SSL certificate, and click OK. Prcedure 9. T install an SSL certificate n IIS6 1. On the Netwrix Passwrd Manager server, navigate t Start Cntrl Panel Administrative Tls Internet Infrmatin Services (IIS) Manager <cmputer_name> Web Sites Default Web Site, where yur PRM flder is displayed. Page 17 f 53

18 2. Right-click the web site flder and switch t the Prperties Directry Security tab: Figure 8: Default Web Site Prperties 3. Click the Server Certificate buttn and fllw the Web Server Certificate Wizard by specifying yur certificate. Prcedure 10. T create a redirect in IIS 1. On the Passwrd Manager server, make sure yu have installed the HTTP Redirect feature fr IIS: navigate t Start Cntrl Panel Prgrams and Features and select Turn Windws features n r ff. 2. In the Server Manager dialg, select Web Server (IIS) and click Add Rle Services n the right. 3. In the Add Rle Services dialg, make sure the HTTP Redirectin service is selected. Otherwise prceed with installing it. Figure 9: Add Rle Services Page 18 f 53

19 4. In Server Manager, pen Internet Infrmatin Services (IIS) Manager under Web Server (IIS). 5. In the Cnnectins pane, navigate t <yur cmputer name> Sites Default Web Site and duble-click the HTTP Redirect feature n the right. Figure 10: HTTP Redirect Feature 6. In the HTTP Redirect windw, select the Redirect requests t this destinatin check bx and enter the Passwrd Manager prtal address, by default 7. HTTP Redirect Feature 4.2. Cnfiguring Rles Passwrd Manager Service authenticates Help-Desk Operatrs and Administratrs by means f integrated Windws authenticatin. N Windws authenticatin is implemented fr users with the Self-Service rle. This is dne t enable passwrd resets based n verificatin questins, withut lgging in. Rles (including the security rles) are assigned in the Administrative Prtal. Fr detailed instructins, refer t 5.6 Assigning Rles. Page 19 f 53

20 4.3. Cnfiguring Service Accunt Permissins The service accunt specified n installatin must be pwerful enugh t unlck accunts and reset passwrds in the managed dmains, since all self-service and help-desk passwrd management peratins are perfrmed under this accunt. This accunt must als be given lcal Admin access n the cmputer where Passwrd Manager Service is installed. The fllwing rights must be delegated t the service accunt n the managed OUs: Change Passwrd Reset Passwrd Read Accunt Restrictins Write Accunt Restrictins Read pwdlastset Write pwdlastset Read lckuttime Write lckuttime Fr instructins n hw t delegate specific rights t the service accunt, refer t the fllwing articles n the Micrsft supprt website: Hw T Delegate the Unlck Accunt Right Hw t grant help-desk persnnel the specific right t unlck lcked user accunts 4.4. Installing Web Applicatin in a DMZ If yu want the web prtals t be accessible frm anywhere n the Internet, as an additinal security measure, yu may want t separate the Internet-facing Web Applicatin frm Passwrd Manager Service acting as a back-end fr interfacing with Active Directry dmain accunts and passwrds. This measure decreases the ptential attack surface and imprves verall security. Fr step-by-step instructins n the deplyment scenaris, refer t the fllwing sectins: Cnfiguring a DMZ Server that is an AD Dmain Member Cnfiguring a DMZ Server that is nt an AD Dmain Member Nte: The DMZ Server must have ASP installed. In rder t allw cnnectins t Netwrix Passwrd Manager deplyed in a DMZ, make sure yur firewall settings cmply with the fllwing rules: Lcal Prts On DMZ Inbund 80, 443, 135 Table 2: Firewall Settings Rules Remte Prts Any RPC range* On DMZ RPC Range Outbund Remte Machine Any Backend Prtcl Applicatin Actin TCP TCP Any Any Allw Allw Backend, all DCs TCP, UDP Any Allw RPC Range 88, 389, 464 All DCs TCP, UDP Any Allw RPC Range DCOM range Backend TCP Any Allw RPC Range 53 DNS UDP Any Allw Page 20 f 53

21 On Backend Inbund On Backend Outbund On DCs Inbund DCOM range RPC range DMZ TCP Any Allw RPC range DMZ TCP, UDP Any Allw RPC range DMZ, all DCs TCP, UDP Any Allw RPC range 88, 389, 464 All DCs TCP, UDP Any Allw RPC range 53 DNS UDP Any Allw RPC range RPC range All DCs TCP Lsass.exe* Allw RPC range 25 Mail Server TCP Any Allw 88, 389, 464 RPC range DMZ, Backend TCP, UDP Any Allw RPC range Backend TCP, UDP Any Allw RPC dynamics On DCs Outbund: n rules required Additinal: DNS Inbund Mail Server Inbund RPC range Backend TCP Lsass.exe* Allw 53 Any Any UDP Any Allw 25 Any Any TCP Any Allw *The RPC range is (Windws NT/XP/2003), r (Windws Vista/2008/7/2k8r2) **Lsass.exe is %systemrt%\system32\lsass.exe Nte: All inbund and utbund cnnectins n all servers are blcked, if they d nt match these rules Cnfiguring a DMZ Server that is an AD Dmain Member Fr this deplyment scenari, perfrm the fllwing prcedures: Nte: Prcedure 11. Install Passwrd Manager Service n the back-end server It is nt recmmended t use a dmain cntrller as a back-end server. Install Web Applicatin n the frnt-end Test the cnfiguratin T install Passwrd Manager Service n the back-end server 1. Install the Passwrd Manager Applicatin using the /dmz cmmand-line parameter under a dmain accunt with the necessary permissins and rights (fr details n permissins, see Sectin 4.3 Cnfiguring Service Accunt Permissins). Nte: The /dmz key implies that IIS is nt required, and n web interface is installed n the back-end server. 2. Navigate t Start Cntrl Panel Administrative Tls Active Directry Users and Cmputers, and lcate the accunt fr the machine that yu want t act as a server in the DMZ. Select the Trust this cmputer fr delegatin ptin. 3. Create a new dmain accunt called IUSR_Netwrix_DMZ and include it in the fllwing lcal grups n the back-end server: Guests and Distributed COM Users. Page 21 f 53

22 4. T the Distributed COM Users grup, als add all users that are members f the Administratrs and Help-Desk Operatrs Rles (fr details n hw t assign rles t users, refer t Sectin 5.6 Assigning Rles). Nte: Users that belng t the Lcal Administratrs grup, already have all the necessary permissins and access rights, s yu d nt have t add them t the Distributed COM Users grup. 5. On the back-end server, navigate t Start Run and execute the dcmcnfg.exe cmmand t run Cmpnent Services. In the Cmpnent Services snap-in navigate t Cnsle Rt Cmpnent Services Cmputers My Cmputer, right-click it and select Prperties. Navigate t the Default Prtcls tab, and select Cnnectinriented TCP/IP. Click Prperties, the Add buttn and specify a range f at least fifty prts, e.g Figure 11: COM Internet Services 6. In the firewall settings between the DMZ and the internal netwrk, allw netwrk cnnectins frm the DMZ server t the backend server fr prt 135 (TCP) and the prt range cnfigured abve. 7. In the My Cmputer Prperties dialg, select the Default Prperties tab and make sure that everything is cnfigured as shwn in the figure belw: Page 22 f 53

23 Figure 12: My Cmputer Prperties 8. Restart the back-end server. Prcedure 12. T install Web Applicatin n the frnt-end (DMZ) 1. Install Netwrix Passwrd Manager as described in Sectin 0 Make sure that the end users cmputers have ne f the fllwing web brwsers installed: Micrsft Internet Explrer 6.0 r abve Mzilla Firefx 2.0 r abve Apple Safari 2.0 r abve Ggle Chrme 4.0 r abve 2. Installing Passwrd Manager Service and Web Applicatin under any dmain accunt. 3. Navigate t Start Cntrl Panel Administrative Tls Services, and stp the service named Netwrix Passwrd Manager. Then set its startup mde t Disabled. 4. Navigate t the prduct flder and remve the prmservice.exe file. This is dne since the lcal service may still be in use, and if the DMZ cnfiguratin is wrng, the lcal COM server may be started instead f the remte ne. 5. Navigate t Start Cntrl Panel Administrative Tls Cmpnent Services Cmputers My Cmputer DCOM Cnfig. Right-click Netwrix Passwrd Manager and select Prperties. G t the Lcatin tab and disable the Run applicatin n this cmputer check bx. Then enable the Run applicatin n the fllwing cmputer ptin, and enter the name f the back-end server yu have installed, click OK. 6. Run the IIS Manager snap-in (Start Cntrl Panel Administrative Tls Internet Infrmatin Services (IIS) Manager). D ne f the fllwing, depending n yur IIS versin: Fr IIS7: In the left pane, lcate the virtual directry created n installatin (nrmally named PM ). In the Actins pane n the right, click Basic Settings. In the dialg that pens, click the Cnnect as buttn, select the Specific user ptin and specify the dmain accunt in step three f Prcedure 11 T install Passwrd Manager Service n the back-end server in the dmain\accunt frmat. Enter the passwrd and click OK. Page 23 f 53

24 Figure 13: Edit Virtual Directry Fr IIS6: In the left pane, lcate the virtual directry created n installatin (nrmally named PM ), right-click it and select Prperties. Open the Directry Security tab, click Edit in the Authenticatin and access cntrl sectin. In the dialg that pens, enter the name f the dmain accunt created in step three f Prcedure 11 T install Passwrd Manager Service n the back-end server in the dmain\accunt frmat. Enter the current passwrd and click OK. Figure 14: Authenticatin Methds Annymus lgns will be nw impersnated as the specified user. Page 24 f 53

25 Prcedure 13. T test the cnfiguratin 1. Navigate t Passwrd Manager Self-Service Prtal (running n the DMZ server) frm an utside netwrk. 2. Perfrm sme basic actins, such as enrlling and resetting a user s passwrd (fr instructins n hw t perfrm these peratins, refer t the Self-Service Prtal help) Cnfiguring a DMZ Server that is nt an AD Dmain Member Fr this deplyment scenari, perfrm the fllwing prcedures: Install Passwrd Manager Service n the back-end server Nte: It is nt recmmended t use a dmain cntrller as a back-end server. Install Web Applicatin n the frnt-end Test the cnfiguratin Prcedure 14. T install Passwrd Manager Service n the back-end server 1. Install Netwrix Passwrd Manager using the /dmz cmmand-line parameter under a dmain accunt with the necessary permissins and rights (fr details n permissins see Sectin 4.3 Cnfiguring Service Accunt Permissins). Nte: The /dmz key implies that IIS is nt required, and n web interface is installed n the back-end server. 2. Create a new lcal accunt called IUSR_Netwrix_DMZ and include it in the fllwing lcal grups n the back-end server: Guests and Distributed COM Users. 3. T the Distributed COM Users grup, als add all users that are members f the Administratrs and Help-Desk Operatrs Rles (fr details n hw t assign rles t users, refer t Sectin 5.6 Assigning Rles). Nte: Users that belng t the Lcal Administratrs grup, already have all the necessary permissins and access rights, s yu d nt have t add them t the Distributed COM Users grup. 4. On the back-end server, g t Start Run and execute the dcmcnfg.exe cmmand t run Cmpnent Services. In the Cmpnent Services snap-in g t Cnsle Rt Cmpnent Services Cmputers My Cmputer, right-click it and select Prperties. G t the Default Prtcls tab, and select Cnnectin-riented TCP/IP. Click Prperties, the Add buttn and specify a range f at least fifty prts, e.g Page 25 f 53

26 Figure 15: COM Internet Services 5. In the firewall settings between the DMZ and the internal netwrk allw netwrk cnnectins frm the DMZ server t the backend server fr prt 135 (TCP) and the prt range cnfigured abve. 6. In the My Cmputer Prperties dialg, select the Default Prperties tab and make sure that everything is cnfigured as shwn in the figure belw: Figure 16: My Cmputer Prperties 7. Open the Lcal Grup Plicy Editr (navigate t Start Run and execute the gpedit.msc cmmand). Expand the Windws Settings Security Settings Lcal Plicies Security Optins nde and lcate the Netwrk access: Sharing and security mdel fr lcal accunts plicy in the right pane: Page 26 f 53

27 Figure 17: Lcal Grup Plicy Editr 8. Duble-click this plicy and make sure that it is set t Classic lcal users authenticate as themselves. 9. Restart the back-end server. Prcedure 15. T install Web Applicatin n the frnt-end (DMZ) 1. Install the Passwrd Manager Applicatin as described in Sectin 0 Make sure that the end users cmputers have ne f the fllwing web brwsers installed: Micrsft Internet Explrer 6.0 r abve Mzilla Firefx 2.0 r abve Apple Safari 2.0 r abve Ggle Chrme 4.0 r abve 2. Installing Passwrd Manager Service and Web Applicatin under a Lcal Administratr accunt. 3. Navigate t Start Cntrl Panel Administrative Tls Services, and stp the service named Netwrix Passwrd Manager. Then set its startup mde t Disabled. 4. Navigate t the prduct flder and remve the prmservice.exe file. This is dne since the lcal service may still be in use, and if the DMZ cnfiguratin is wrng, the lcal COM server may be started instead f the remte ne. 5. Create a new lcal accunt called IUSR_Netwrix_DMZ (user name and passwrd must be identical t the nes yu have created n the back-end server), and include it in the fllwing lcal grups n the back-end server: Guests and Distributed COM Users. 6. Navigate t Start Cntrl Panel Administrative Tls Cmpnent Services Cmputers My Cmputer DCOM Cnfig. Right-click Netwrix Passwrd Manager and select Prperties. G t the Lcatin tab and disable the Run applicatin n this Page 27 f 53

28 cmputer check bx. Then enable the Run applicatin n the fllwing cmputer ptin, and enter the name f the back-end server yu have installed. Then click OK. 7. Run the IIS Manager snap-in (Start Cntrl Panel Administrative Tls Internet Infrmatin Services (IIS) Manager). D ne f the fllwing, depending n yur IIS versin: Fr IIS7: In the left pane, lcate the virtual directry created n installatin (nrmally named PM ). In the Actins pane n the right, click Basic Settings. In the dialg that pens, press the Cnnect as buttn, select the Specific user ptin and specify the lcal accunt created in step 4 abve (withut the dmain name). Enter the passwrd and click OK. Figure 18: Edit Virtual Directry Dialg Fr IIS6: In the left pane, lcate the virtual directry created n installatin (nrmally named PM ), right-click it and select Prperties. Open the Directry Security tab, click Edit in the Authenticatin and access cntrl sectin. In the dialg windw that pens, enter the name f the lcal accunt created in step 4 abve (withut the dmain name). Enter the current passwrd and click OK. Page 28 f 53

29 Figure 19: Authenticatin Methds Dialg Windw Annymus lgns will be nw impersnated as the specified user. 8. Open the Lcal Grup Plicy Editr (navigate t Start Run and execute the gpedit.msc cmmand). Expand the Windws Settings Security Settings Lcal Plicies Security Optins nde and lcate the Netwrk access: Sharing and security mdel fr lcal accunts plicy in the right pane: Figure 20: Lcal Grup Plicy Editr Page 29 f 53

30 Prcedure Duble-click this plicy and make sure that it is set t Classic lcal users authenticate as themselves. 10. Restart the frnt-end server. T test the cnfiguratin 1. Navigate t the Passwrd Manager Self-Service Prtal (running n the DMZ server) frm an utside netwrk. 2. Perfrm sme basic actins, such as enrlling and resetting a user s passwrd (fr instructins n hw t perfrm these peratins, refer t Self-Service Prtal help) Clustering fr Enhanced Stability This chapter prvides tips n hw t imprve Netwrix Passwrd Manager perfrmance. Passwrd Manager Service and/r the frnt-end may be spread separately t clusters f multiple servers. While the frnt-end cluster represents a lad-balanced server netwrk, the service cluster is a failver ne. Several clustering ptins are pssible: One frnt-end (DMZ) server and tw (r mre) failver back-end servers with a cmmn cnfiguratin database strage. This cnfiguratin prvides nly service failver and is mre secure. Tw r mre lad-balanced frnt-end (DMZ) servers and ne back-end server. This cnfiguratin allws decreasing the lad n the web prtals, but des nt prvide any failver, as there is still ne service which prvides the cre functinality. Tw r mre lad-balanced frnt-end (DMZ) servers and tw r mre failver backend servers with a cmmn cnfiguratin database strage. This cnfiguratin prvides bth fr web prtals lad decrease and service failver. The figure belw illustrates the third deplyment ptin: Figure 21: Enhanced Stability Deplyment Page 30 f 53

31 4.6. Cnfiguring Passwrd Manager Client Security The Passwrd Manager Client (Windws Lgn Prmpt Extensin) cnnects t Passwrd Manager Service using the same mechanism as Micrsft Internet Explrer: the HTTPS prtcl. Therefre, the same security cnsideratins apply: make sure that yu specify an httpsprefixed Self-Service Prtal URL during installatin and cnfiguratin. The Passwrd Manager Client (Windws Lgn Prmpt Extensin) supprts a discnnected peratin mde, which means that n actual cnnectin t the dmain is required after a passwrd has been reset using the Passwrd Manager Client. Nte: After lgging int the system, users must initiate a netwrk cnnectin and change their passwrds again fr Active Directry and lcally stred passwrds t synchrnize. If there is cnnectin t the Self-Service Prtal, the passwrds will be synchrnized autmatically Cnfiguring Prfile Database Security The Prfile Database is maintained by Passwrd Manager Service. All users answers t verificatin questins are stred using a nn-reversible encryptin (MD5). Only the first and the last letter f each answer can be decrypted by Passwrd Manager Services t enable manual user verificatin by Help-Desk peratrs. The prfile database is stred in binary files named alinf.bin, inv_lgn.bin and secrets.bin lcated in the installatin flder. Yu can apply NTFS permissins and encryptin settings t these files fr additinal security. It is strngly recmmended t backup prfile database files regularly t avid ptential data lss. Database backups must be encrypted when cpied t a backup media. In the simplest case, use passwrd-prtected.zip files) Cnfiguring Built-In Security Plicies Netwrix Passwrd Manager prvides a number f built-in security plicies cnfigurable frm the Administrative Prtal. The fllwing settings are highly recmmended: Self-Service Rle: allw end users t perfrm passwrd resets and accunt unlcks in a self-service fashin (fr detailed instructins n hw t cnfigure rles, refer t Sectin 5.6 Assigning Rles). Nte: D nt assign this rle t dmain administratrs and ther sensitive users, since this can cmprmise their security (fr example, by answer-guessing r accunt hijacking attempts). Questins/Answers Plicy: cnfigure these settings t make sure that users prvide secure questin-answer pairs (enfrce minimum answer length, prhibit duplicates, etc.). Fr detailed instructins n hw t cnfigure these settings, refer t Sectin Questins Plicy. Prevent answer-guessing s that an accunt is lcked after a certain number f invalid answers entered during a self-service passwrd management peratin. Fr details refer t Sectin 5.3 Cnfiguring the Managed Dmains. Ntificatins: accunt wners and/r administratrs, whse s are listed in the alerts cnfiguratin sectin, are warned by if smene tries t perfrm a self-service peratin against their accunt. Fr detailed instructins n hw t cnfigure these settings, refer t Sectin Alerts. Page 31 f 53

32 Audit Trail: the prduct creates full audit trail reprts n all user accunt activities. It is recmmended t review these reprts regularly. Fr mre infrmatin, refer t the Help-Desk Prtal help. Page 32 f 53

33 5. CONFIGURING PASSWORD MANAGER SETTINGS Netwrix Passwrd Manager is installed with the default cnfiguratin ptins (such as the dmain name, passwrd security settings, ptins available t end users, verificatin questins plicies, and s n). Hwever, yu can always mdify the default cnfiguratin settings when needed thrugh the Administrative Prtal Accessing the Administrative Prtal T access the Administrative Prtal, g t Start All Prgrams Netwrix Passwrd Manager Administrative Prtal n the cmputer where Netwrix Passwrd Manager is installed. The Administrative Prtal web applicatin will pen in the default web brwser: Figure 22: Administrative Prtal Nte: If the web page cannt be displayed due t authenticatin prblems, add the Passwrd Manager site t the Lcal Intranet zne: navigate t Start Cntrl Panel Internet Optins. In the Internet Prperties dialg select the Security tab. Select Lcal Intranet, click the Sites buttn and add the Administrative Prtal URL t the list Cnfiguratin Optins Overview The Administrative Prtal supprts the fllwing cnfiguratin ptins: Dmains: allws adding, remving r mdifying dmains in the managed dmains list. Fr details, refer t Sectin 5.3 Cnfiguring the Managed Dmains. Settings: allws cnfiguring the Self-Service Prtal. Administratrs can define settings fr the fllwing: Branding (cmpany name and lg, supprt cntacts, and thers); User Optins (passwrd management ptins available t end users); Predefined Questins used fr verificatin; Questins Plicy (questin and answer length, the minimum number f questins required fr verificatin, and s n); Passwrd Plicy (passwrd length); Alerts (alert triggers and alert recipients); Prduct updates. Page 33 f 53

34 Fr details n the cnfiguratin settings, refer t Sectin 5.5 Custmizing the Self- Service Prtal. Rles: allws assigning different rles t users (Administratrs / Help-Desk Operatrs / Self-Service Access). Fr details, refer t Sectin 5.6 Assigning Rles. License: allws managing prduct licenses. Fr details, refer t Sectin 2.4 Licensing Infrmatin. Batch Enrllment: allws administratrs t enrll users by imprting their accunt infrmatin frm a file. Fr details, refer t Sectin 6.3 Batch Enrllment. Batch Remval: allws administratrs t remve users in a batch by imprting their accunt infrmatin frm a file. Fr details, refer t Sectin 6.4 Batch Remval Cnfiguring the Managed Dmains T cnfigure the managed dmains, click Dmains n the Administrative Prtal main page. The fllwing page will be displayed: Figure 23: Managed Dmains Yu can d the fllwing: Add a dmain t the list f managed dmains Edit the settings fr an existing dmain Remve a dmain frm the list f managed dmains Prcedure 17. T add a dmain 1. Click the Add link n tp f the Managed Dmains page. The Add Managed Dmain page will be displayed: Page 34 f 53

35 Figure 24: Add Managed Dmain 2. Specify the fllwing parameters: Table 3: Managed Dmain Parameters Dmain name Parameter Use AD passwrd plicy settings Target dmain NETBIOS name Descriptin Select this check bx if yu want Passwrd Manager t apply the effective Active Directry passwrd plicy settings instead f its custm plicy. NOTE: If the custm plicy is stricter than the AD passwrd plicy, it will verride the AD settings. Page 35 f 53

36 Prevent answer guessing Stre users passwrd hash in a specific AD user bject attribute Enable Ggle Apps accunt management Send passwrd t Ggle Apps as hash Use the fllwing AD user bject attribute as Ggle Apps accunt name Enable Salesfrce accunt management Use the fllwing AD user bject attribute as Salesfrce accunt name Select this check bx t enfrce limitatins n invalid attempts t answer the verificatin questins: Invalid answers threshld: determines hw many invalid answers are allwed befre the accunt is blcked. Invalid answers blck duratin: determines the perid f time during which the user wh failed t answer the authenticatin questins cannt reset r unlck their accunt. Reset invalid answers cunter after: determines the perid f time after which the invalid answers cunter will be reset. Select this check bx if yu want Ggle Apps passwrds t be stred securely in ne f the user bject attributes. Hash algrithm Attribute Select this check bx t allw users t manage their Ggle Apps accunts tgether with their dmain accunts (all passwrd resets will be applied t bth accunts). Specify the fllwing parameters: Dmain name as defined in Ggle settings. Accunt Name: Ggle Apps admin accunt name. NOTE: Just the admin accunt name must be specified, fr example, administratr. Passwrd f the Ggle Apps admin accunt. Fr the Ggle Apps accunt management ptin, additinal cnfiguratin is required. Fr details refer t Sectin Cnfiguring Ggle Apps Settings. NOTE: Ggle Apps accunts cannt be mnitred separately, withut having the crrespnding AD accunts. Select this check bx t send passwrd t Ggle Apps as hash. Select this check bx if yu want the specified attribute value t act as Ggle accunt name. Select this check bx t allw users t manage their Salesfrce accunts tgether with their dmain accunts (all passwrd resets will be applied t bth accunts). Specify the fllwing Salesfrce accunt parameters: Accunt Name Passwrd Tken Select this check bx if yu want the specified attribute value t act as Salesfrce accunt name. 3. Click OK. The new dmain will appear in the managed dmains list. Prcedure 18. T edit a dmain 1. Select the dmain yu want t edit in the Managed Dmains page and click Edit. A page will be displayed shwing the selected dmain s parameters. 2. Mdify the necessary parameters and click OK. Page 36 f 53

37 Prcedure 19. T remve a dmain Select the dmain yu want t remve in the Managed Dmains page and click Remve. The selected dmain will be remved frm the list f managed dmains Cnfiguring Ggle Apps Settings Fr the Ggle Apps accunt management feature t functin prperly, sme additinal cnfiguratin f Ggle Apps is required. Please perfrm the fllwing prcedure if yu have enabled this ptin: Prcedure 20. T cnfigure Ggle Apps 1. Open Ggle Apps and select Organizatins & users frm the tp menu. 2. Click the admin accunt name yu entered in the Passwrd Manager Administrative Prtal when adding a managed dmain. 3. Select Privileges and make sure the Super Admin check bx is selected: Figure 25: Ggle Apps Administratr Privileges 4. Select Dmain settings frm the tp menu. Navigate t User settings and make sure that the Enable prvisining API ptin is selected: Figure 26: Ggle Apps Dmain Settings 5. Click Save changes. Page 37 f 53

38 5.4. Editing Ntificatin Templates Prcedure 21. T edit ntificatin template 1. Navigate t the Templates flder with all prduct templates, which is by default stred in the prgram installatin flder: C:\PrgramFiles(x86)\Netwrix Passwrd Manager. 2. Select the required template name basing n the fllwing criteria: Which peratin this ntificatin is fr: Actin: a ntificatin is sent fr additinal user s authenticatin if the Enable additinal authenticatin using the user check bx is selected n the Authenticatin Plicy tab f the Administrative prtal. Change: a ntificatin is sent n an accunt passwrd change. Enrll: a ntificatin is sent when an accunt has been enrlled with Netwrix Passwrd Manager t enable self-service accunt management. Reset: the ntificatin is sent n a successful r failed accunt reset attempt. The attempt result is shwn in the Result field f the ntificatin. Unlck: the ntificatin is sent n f a successful r failed accunt unlck attempt. The result f this attempt is shwn in the Result field f the ntificatin. Verificatin: the ntificatin is sent in case f a failed self-service peratin attempt with the failure reasn specified as Invalid verificatin answers. Which part f the ntificatin yu want t edit - subject r bdy: t edit an subject, select a template cntaining subject in its name t edit an bdy, select a template cntaining bdy in its name Wh the ntificatin recipients are - administratrs r users: fr the ntificatin sent t administratrs, select the required template with the _adm ending in its name fr the ntificatin sent t the users whse actin triggered an delivery, select the required template withut the _adm ending in its name Finally, select a template fr the required language: English: this is the default language, templates d nt have any special labels in their names. German: templates in German have names ending with de French: templates in French have names ending with fr Japanese: templates in Japanese have names ending with jp Krean: templates in Krean have names ending with k Russian: templates in Russian have names ending with ru Chinese: templates in Chinese have names ending with zh Example: the template name: reset_bdy_template_adm 3. Edit the required template in Ntepad and save the changes. Page 38 f 53

39 5.5. Custmizing the Self-Service Prtal The Self-Service Prtal allws users t perfrm passwrd management peratins, such as passwrd reset, accunt unlck, and s n. T custmize the Self-Service Prtal, click Settings n the Administrative Prtal main page. The fllwing page will be displayed: Figure 27: Custmizatin Tabs Administratrs can cnfigure the fllwing settings fr the Self-Service Prtal: Branding User Optins Questins Questins Plicy Authenticatin Plicy Passwrd Plicy Alerts SMTP Settings Updates Page 39 f 53

40 Branding This ptin allws custmizing the appearance f the Self-Service Prtal and persnalizing its interface by adding cmpany-specific infrmatin (such as cmpany lg, supprt infrmatin and link t a web-page with passwrd plicies). Prcedure 22. T cnfigure branding 1. Select the Branding tab in the Self-Service Prtal custmizatin page. The fllwing page will be displayed: Figure 28: Branding Tab 2. Select the Enable Custmer Branding ptin and specify the fllwing parameters: Table 4: Branding Parameters Parameter Title Supprt Passwrd requirements URL Lg Descriptin Specify yur cmpany name as it shuld appear in the Self- Service Prtal. Enter the phne number r a hyperlink t reach yur cmpany s technical supprt. Specify the URL f the web page where yur cmpany s passwrd plicies are explained. Uplad a file with yur cmpany s lg that will be displayed in the Self-Service Prtal. 3. Click Apply t save the changes. Nte: In rder t avid any issues with adding the custm lg, disable UAC (User Accunt Cntrl) via lcal security plicy User Optins This ptin allws enabling r disabling certain features available t end users frm the Self- Service Prtal r the Passwrd Manager Client (Windws Lgn Prmpt Extensin). Page 40 f 53

41 Prcedure 23. T cnfigure user ptins 1. Select the User Optins tab in the Custmizatin sectin f the Administrative prtal. The fllwing page will be displayed: Figure 29: User Optins Tab 2. Select r clear the fllwing user ptins: Table 5: User Optins Parameter Enable passwrd reset Enable the Ask me t change my passwrd n next lgn user ptin Enable the Passwrd never expires user ptin Enable accunt unlck Enable passwrd change Instructin Select this check bx t allw users t reset their passwrds in the Self-Service Prtal. Select this check bx if yu want t allw users t select this ptin when resetting their passwrds. Select this check bx t allw users t decide if they want their passwrds t be valid fr an unlimited perid f time. Select this check bx t allw users t unlck their accunts in the Self-Service Prtal. Select this check bx t allw users t change their passwrds in the Self-Service Prtal. 3. Click Apply t save the changes Predefined Questins The reset passwrd and unlck accunt self-service peratins require answering identity verificatin questins as a secure authenticatin mechanism. When enrlling int the system, users must answer a set f verificatin questins. When a user has crrectly answered these questins, they receive an with a link t the passwrd reset peratin. The answers are stred separately fr each user in the accunt database. Administratrs can cnfigure which verificatin questins a user will be asked. A set f questins can be applied t a single dmain, r t all managed dmains. Prcedure 24. T cnfigure questins 1. Select the Questins tab in the Self-Service Prtal custmizatin page. The fllwing page will be displayed: Page 41 f 53

42 Figure 30: Questins Tab 2. If necessary, select the language frm the drp-dwn list. 3. Select the dmain t which this set f predefined questins will be applied. If yu want t apply the selected questins t all managed dmains, select All. 4. Select the questins that users will be asked by ticking the crrespnding check bxes. 5. Yu can edit a questin by clicking n it, r remve a questin frm the list by selecting the crrespnding bx and clicking Remve. 6. T add a new custm questin t the list, type it in the Add a questin entry field, and click Add. 7. Click OK t save the changes Questins Plicy This ptin allws applying cnstraints t verificatin questins and answers. Prcedure 25. T cnfigure questins plicy 1. Select the Questins Plicy tab in the Custmizatin sectin f the Administrative prtal. The fllwing page will be displayed: Figure 31: Questins Plicy Tab Page 42 f 53

43 2. Specify the fllwing parameters: Table 6: Questins Plicy Parameters Parameter Minimum custm questin length Minimum answer length Number f questins required fr enrllment Number f answers required fr passwrd reset Number f answers required fr accunt unlck Prhibit identical answers t different questins D nt allw answers that are substrings f the questins Prhibit custm questins Descriptin Specify the minimum number f characters a custm user-defined questin must cntain. Specify the minimum number f characters an answer must cntain. Specify the number f questins a user must answer during the enrllment prcedure. Specify the number f crrect answers that a user must give t perfrm the passwrd reset peratin. Specify the number f crrect answers that a user must give t perfrm the accunt unlck peratin. Select this ptin t prevent users frm prviding the same answers t different questins. This ptin is recmmended fr security reasns. Select this ptin t prevent users frm prviding answers that are identical t the questin r its part. This ptin is recmmended fr security reasns. Select this ptin if yu want t prhibit users t create their wn custm questins n enrllment. 3. Click Apply t save the changes Authenticatin Plicy The Authenticatin Plicy ptin allws yu t strengthen the passwrd reset plicy by adding an additinal verificatin step via a link ed t users. Prcedure 26. T enable authenticatin plicy 1. Open the Authenticatin Plicy tab in the Self-Service Prtal custmizatin page. The fllwing page will be displayed: Figure 32: Authenticatin Plicy Tab 2. Select the Enable additinal authenticatin using the user check bx t enable the ptin Passwrd Plicy This ptin allws applying limitatins n passwrd length. Page 43 f 53

44 Nte: These settings apply t all managed dmains. Fr details n hw t apply AD passwrd settings t a single dmain, refer t Sectin 5.3 Cnfiguring the Managed Dmains. Nte that if the AD passwrd plicy is less strict than the passwrd settings specified in the Passwrd Manager Administrative Prtal, it will be verriden. Prcedure 27. T cnfigure passwrd plicy 1. Select the Passwrd Plicy tab in the Self-Service Prtal custmizatin page. The fllwing page will be displayed: Figure 33: Passwrd Plicy Tab 2. Specify the minimum and maximum allwed passwrd length and click Apply t save the changes Alerts This ptin allws cnfiguring Passwrd Manager t send ntificatins triggered by certain events related t user accunts. Prcedure 28. T cnfigure alerts 1. Select the Alerts tab in the Custmizatin sectin f the Administrative prtal. The fllwing page will be displayed: Figure 34: Alerts Tab 2. Specify the fllwing parameters: Page 44 f 53

45 Table 7: Alerts Parameters Parameter Enable alerts Alert accunt wners when Alert administratrs when Administratr s Descriptin Select this ptin t enable ntificatins. Select the events that yu want accunt wners t be ntified abut. Select the events that yu want administratrs t be ntified abut. Enter administratr(s) addresses that yu want ntificatins t be sent t. Addresses must be separated by a cmma. 3. Click Apply t save the changes SMTP Settings This ptin allws cnfiguring the SMTP settings fr delivery. Prcedure 29. T cnfigure SMTP Settings 1. Select the SMTP Settings tab in the Custmizatin sectin f the Administrative prtal. The fllwing page will be displayed: Figure 35: SMTP Settings Tab 2. Specify the fllwing parameters: Table 8: SMTP Settings Server name Prt Sender address Parameter Specify the SMTP server name. Specify the SMTP server prt. Descriptin Specify the address that will appear in the frm field in the ntificatins. 3. Click Apply t save the changes Updates This ptin allws checking if yur Netwrix Passwrd Manager versin is the latest ne, r if a mre recent prduct versin is available. Prcedure 30. T check fr updates Page 45 f 53

46 1. Select the Updates tab in the Custmizatin sectin f the Administrative prtal. The fllwing page will be displayed: Figure 36: Updates 2. Click the Check buttn t see if updates are available Assigning Rles This cnfiguratin ptin allws assigning different rles (Administratrs, Help-Desk Operatrs, Self-Service Access) t accunt wners. Prcedure 31. T assign rles t users 1. Click Rles in the Administrative Prtal main page. The fllwing page will be displayed: Figure 37: Rles 2. Click Edit t mdify the list f accunt wners t whm a rle is assigned. Accunt names must be separated by a semi-cln. T verify if the accunt names yu specified are valid, click Check. 3. Click OK t save the changes. Page 46 f 53

47 6. ENROLLING USERS FOR SELF-SERVICE Befre users can perfrm any passwrd management peratins in the self-service mde, they must enrll int the system. Netwrix Passwrd Manager supprts the fllwing three enrllment ptins: Manual enrllment: users must g t the Self-Service Prtal and perfrm the enrllment prcedure. Fr details, see sectin 6.1 Manual Enrllment. Autmatic enrllment: users are autmatically prmpted t enrll int the system at lgn. Fr details, see Sectin 6.2 Autmatic Enrllment. Batch enrllment: administratrs can pre-enrll users based n existing accunt and verificatin data (fr example, taken frm the HR database). Fr details, see Sectin 6.3 Batch Enrllment Manual Enrllment Manual enrllment is perfrmed by users in the Self-Service Prtal. After yu have deplyed and cnfigured Netwrix Passwrd Manager, yu must send an intrductry message t end users explaining the purpse f the system and cntaining brief instructins n hw t use it and the Self-Service Prtal URL. Yu must instruct users t fllw the link and perfrm the enrllment prcedure befre they can perfrm any passwrd management peratins. The main advantage f this enrllment ptin is that n client sftware deplyment is required. Hwever, many users will nt fllw the link (they may be t busy, r may nt understand the imprtance f this actin), which will result in additinal help-desk calls when they face accunt issues Autmatic Enrllment Autmatic enrllment takes place if the Passwrd Manager Client Applicatin has been deplyed n end users cmputers. The first time users lg n t their cmputers after the deplyment, an Enrllment Wizard will pp up autmatically, frcing them t enrll int the system. The main advantage f this enrllment ptin is that it will minimize the number f help-desk calls. If yu d nt want t deply Passwrd Manager Client n end users cmputers, yu can still enfrce autmatic enrllment thrugh Grup Plicy scripts. T d this, perfrm the fllwing prcedure: Prcedure 32. T enfrce autmatic enrllment thrugh Grup Plicy 1. Temprarily install the Passwrd Manager Client n any cmputer. 2. Cpy the prmmain.exe file (lcated in the installatin flder) and the.dll language files that yu are ging t use t a file server share that can be accessed by all users, fr example, \\pmserver\enrll\prmmain.exe. 3. Open the Default Dmain Plicy r create a new Grup Plicy bject using the standard Micrsft tls - GPMC r ADUC (Active Directry Users and Cmputers). 4. Navigate t User Cnfiguratin Windws Settings Scripts (Lgn/Lgff) and add a new lgn script that starts prmmain.exe withut any arguments. Page 47 f 53

48 5. Thrugh GPO, set the fllwing Windws registry value n the client machines: 6. HKLM\SOFTWARE\Plicies\Netwrix\PasswrdManager PRM_Server=<Self_Service_Prtal_URL>, fr example Nte: Make sure that this URL is accessible frm the client machines. 7. Alternatively, yu can use the Netwrixpm.adm file t distribute this value. T d this, execute the fllwing steps: Start the GPMC by ging t Start Cntrl Panel Administrative Tls Grup Plicy Management. Lcate the OU (r the entire dmain) that yur client machines belng t and the Passwrd Manager GPO (if yu have nt created it previusly, yu can d it nw by right-clicking the OU and selecting the Create and Link a GPO Here ptin). Right-click the GPO and select Edit t start the Grup Plicy Object Editr. Navigate t the Cmputer Cnfiguratin Administrative Templates nde, rightclick it and select the Add/Remve Templates ptin. Click Add and brwse t the Netwrixpm.adm file (by default installed t C:\PrgramFiles\Netwrix Passwrd Manager). Navigate t the Cmputer Cnfiguratin Administrative Templates Netwrix Passwrd Manager nde and duble-click Installatin URL in the right pane. Select the Enabled ptin, and enter the Self-Service Prtal URL Batch Enrllment If yur rganizatin has an HR database with user-specific data, such as Scial Security numbers, birth places, and s n, yu can prelad the existing verificatin data in a batch, s that users can perfrm self-service passwrd management peratins withut having t take any extra steps. This way yu can ensure that all users are enrlled fr self-service, which minimizes the lad n the help-desk. T imprt user accunt data frm a file fr batch enrllment, perfrm the fllwing prcedure: Prcedure 33. T enrll users by imprting their accunt data 1. Click Batch Enrllment n the Administrative Prtal main page. The fllwing page will be displayed: Page 48 f 53

49 Figure 38: Batch Enrllment Page 2. Select the file that yu want t imprt accunt data frm, and click Next. Nte: Plain-text Unicde.csv files are accepted cntaining user names and keyvalue pairs. Fr example: ACME\jde, Scial Security= , Mther's Maiden Name=Parker ACME\msmith, Scial Security= , Mther's Maiden Name=Camern 3. The results f the peratin will be displayed: Figure 39: Batch Enrllment Results 4. Select ne f the fllwing ptins: Overwrite all existing prfiles with new data if the data yu imprted cntains mre relevant and up-t-date infrmatin than the existing recrds. Lad prfiles as expired and frce users t enrll (the self-service peratins are still available). This ptin is recmmended fr security reasns. 5. Click Apply t save the changes. Page 49 f 53

50 6.4. Batch Remval This feature enables administratrs t imprt a file with a list f users t be remved, instead f remving each separate user manually. Prcedure 34. T remve users by imprting their accunt data 1. Click Batch Remval n the Administrative Prtal main page. The fllwing page will be displayed: Figure 40: Batch Remval 2. Select the file with the list f accunts t be remved, and click Next. Nte: Plain-text files are accepted cntaining user accunt data in the <dmain>\<accunt_name> r <accunt_sid> frmat. Fr example: ACME\jde ACME\msmith S On the next step, preview the uplad results: Figure 41: Uplad Results Page 50 f 53

51 4. T prceed with batch remval, click Apply. Review the results f the peratin, and click OK: Figure 42: Batch Remval Results Page 51 f 53