4.7. Administrator Guide

Transcription

1 4.7 Administrator Guide

2 2010 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Quest Software, Inc. If you have any questions regarding your potential use of this material, please contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA USA legal@quest.com Refer to our Web site for regional and international office information. TRADEMARKS Quest, Quest Software, the Quest Software logo, Aelita, Akonix, AppAssure, Benchmark Factory, Big Brother, ChangeAuditor, DataFactory, DeployDirector, ERDisk, Foglight, Funnel Web, GPOAdmin, I/Watch, Imceda, InLook, IntelliProfile, InTrust, Invertus, IT Dad, I/Watch, JClass, Jint, JProbe, LeccoTech, LiteSpeed, LiveReorg, MessageStats, NBSpool, NetBase, Npulse, NetPro, PassGo, PerformaSure, Quest Central, SharePlex, Sitraka, SmartAlarm, Spotlight, SQL LiteSpeed, SQL Navigator, SQL Watch, SQLab, Stat, StealthCollect, Tag and Follow, Toad, T.O.A.D., Toad World, vanalyzer, vautomator, vcontrol, vconverter, vessentials, vfoglight, vmigrator, voptimizer Pro, vpackager, vranger, vranger Pro, vreplicator, vspotlight, vtoad, Vintela, Virtual DBA, VizionCore, Vizioncore vautomation Suite, Vizioncore vessentials, Xaffire, and XRT are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. Other trademarks and registered trademarks used in this guide are property of their respective owners. Disclaimer The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. Quest Password Manager - Administrator Guide Updated - October, Software Version - 4.7

3 CONTENTS ABOUT THIS GUIDE INTENDED AUDIENCE CONVENTIONS ABOUT QUEST SOFTWARE CONTACTING QUEST SOFTWARE CONTACTING QUEST SUPPORT CHAPTER 1 WELCOME TO QUEST PASSWORD MANAGER QUEST PASSWORD MANAGER OVERVIEW DIFFERENT SITES FOR DIFFERENT ROLES CHAPTER 2 ADMINISTRATION SITE CHECKLIST: CONFIGURING PASSWORD MANAGER SPECIFYING GLOBAL SETTINGS ENABLING HTTPS CONFIGURING SELF-SERVICE SITE SETTINGS CONFIGURING ACCESS TO SELF-SERVICE SITE FROM WINDOWS LOGON SCREEN INTRODUCING SECURE PASSWORD EXTENSION DEPLOYING AND CONFIGURING SECURE PASSWORD EXTENSION UNINSTALLING SECURE PASSWORD EXTENSION TROUBLESHOOTING SECURE PASSWORD EXTENSION MANAGING DOMAINS CONFIGURING PERMISSIONS TO ACCESS A MANAGED DOMAIN ADDING A MANAGED DOMAIN MANAGING QUESTIONS AND ANSWERS PROFILES CONFIGURING PASSWORD POLICIES CONFIGURING LOGON SECURITY OPTIONS CONFIGURING REGISTRATION NOTIFICATION AND ENFORCEMENT DELEGATING HELP DESK AND ADMINISTRATIVE TASKS CONFIGURING ACCESS TO SELF-SERVICE SITE CHANGING ACCOUNT TO ACCESS A MANAGED DOMAIN REPORTING DIAGNOSTIC LOGGING BEST PRACTICES FOR CONFIGURING REPORTING SERVICES REPORTING SERVICES DEFAULT CONFIGURATION REPORTING SERVICES FIREWALL ISSUES THE PASSWORD MANAGER DATABASE IN SQL SERVER THE SCHEDULED TASKS IN PASSWORD MANAGER iii

4 Quest Password Manager CHAPTER 3 QUEST PASSWORD MANAGER INTEGRATION ACTIVEROLES QUICK CONNECT CONFIGURING CROSS-PLATFORM PASSWORD SYNCHRONIZATION USING ACTIVEROLES QUICK CONNECT MICROSOFT IDENTITY INTEGRATION SERVER CONFIGURING CROSS-PLATFORM PASSWORD SYNCHRONIZATION USING MIIS. 82 QUEST ACTIVEROLES SERVER WEB INTERFACE BASIC INTEGRATION REQUIREMENTS CUSTOMIZING ACTIVEROLES SERVER HOME PAGE PASSWORD MANAGER SELF-SERVICE SITE INTEGRATION PASSWORD MANAGER HELP DESK SITE INTEGRATION QUEST DEFENDER QUEST ENTERPRISE SINGLE SIGN-ON (QESSO) HP PROTECTTOOLS AUTHENTICATION SERVICES USING HP PROTECTTOOLS AUTHENTICATION SERVICES TO GENERATE PASSWORDS90 GLOSSARY iv

5 About This Guide Intended Audience Conventions About Quest Software Contacting Quest Software Contacting Quest Support

6 Quest Password Manager Intended Audience This document has been prepared to assist you in becoming familiar with Quest Password Manager. Administrator Guide contains the information required to install and use Quest Password Manager. It is intended for network administrators, consultants, analysts, and any other professionals using the product. Conventions In order to help you get the most out of this guide, we have used specific formatting conventions. These conventions apply to procedures, icons, keystrokes and cross-references. ELEMENT Select Bolded text Italic text Bold Italic text Blue text CONVENTION This word refers to actions such as choosing or highlighting various interface elements, such as files and radio buttons. Interface elements that appear in Quest Software products, such as menus and commands. Used for comments. Used for emphasis. Indicates a cross-reference. When viewed in Adobe Reader, this format can be used as a hyperlink. Used to highlight additional information pertinent to the process being described. Used to provide Best Practice information. A best practice details the recommended course of action for the best result. Used to highlight processes that should be performed with care. + A plus sign between two keystrokes means that you must press them at the same time. A pipe sign between elements means that you must select the elements in that particular sequence. 6

7 Administrator Guide About Quest Software Quest Software simplifies and reduces the cost of managing IT for more than 100,000 customers worldwide. Our innovative solutions make solving the toughest IT management problems easier, enabling customers to save time and money across physical, virtual and cloud environments. For more information about Quest go to Contacting Quest Software Mail Web site Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA USA Refer to our Web site for regional and international office information. Contacting Quest Support Quest Support is available to customers who have a trial version of a Quest product or who have purchased a Quest product and have a valid maintenance contract. Quest Support provides unlimited 24x7 access to SupportLink, our self-service portal. Visit SupportLink at From SupportLink, you can do the following: Retrieve thousands of solutions from our online Knowledgebase Download the latest releases and service packs "Create, update and review Support cases View the Global Support Guide for a detailed explanation of support programs, online services, contact information, and policy and procedures. The guide is available at 7

8 Quest Password Manager 8

9 1 Welcome to Quest Password Manager Quest Password Manager Overview Different Sites for Different Roles

10 Quest Password Manager Quest Password Manager Overview Quest Password Manager is a Web-based application that provides an easy-to-implement and use, yet highly secure, password management solution. Users can connect to Password Manager by using their favorite browser and perform password self-management tasks, thus eliminating the need for assistance from high-level administrators and reducing help desk workload. The solution offers a powerful and flexible password policy control mechanism that allows the Password Manager administrator to ensure that all passwords in the organization comply with the established policies. Password Manager works with Windows domains, including domains operating in mixed mode. Integration with Microsoft Identity Integration Server facilitates cross-platform password synchronization that enables Password Manager to change user passwords across multiple connected data sources. The key features and benefits of Quest Password Manager include: Global access. Quest Password Manager provides 24x7x365 access to the Self-Service site from intranet computers as well as via Internet from any most common browser. The solution supports flexible access modes and logon options. Strong data encryption and secure communication. The solution relies on industry-leading technologies for enhanced communication security and data encryption. Cross-platform password synchronization. Quest Password Manager has been designed for use with Microsoft Identity Integration Server and Quest Quick Connect, which makes it possible to automatically synchronize users' passwords across multiple connected data sources. Web interface for help desk service. Password Manager features Help Desk site which allows administrators to delegate help desk tasks to dedicated operators. These tasks include resetting user passwords, managing users' Questions and Answers profiles, and assigning temporary passcodes to users. x64 version of Password Policy Manager. An x64 version of Password Policy Manager module has been designed for use on domain controllers running an x64 Microsoft Windows Server operating system. event notifications. Administrators can configure event notifications which are sent by to designated personnel when specified events occur. Seamless OS integration. Quest Password Manager relies on intrinsic security databases only and is capable of managing domains across trust boundaries (no trust relationship required). Powerful password policies. Quest Password Manager ensures that only passwords that meet administrator-defined policies are accepted. Unsuccessful authentication attempts are logged and the corresponding accounts are locked if necessary. Granular policy enforcement. Password policies are applied on a per-group or per OU basis. Questions and Answers authentication mechanism. To reset passwords or unlock accounts, users are prompted to answer a series of questions for which users provide their secret answers when registering with Quest Password Manager. Enhanced user name search options. Users can be allowed to view their account attributes, such as user logon name, first name, display name, and SMTP address, when searching for their forgotten user names. A more specific search query returns the most relevant search results. Fault tolerance and scalability. Quest Password Manager is designed to work with network load balancing clusters and in a Web farm environment. 10

11 Administrator Guide Different Sites for Different Roles The Web Interface allows multiple Web sites to be installed with individual, customizable configurations. The following is a list of configuration templates that are available out-of-the box. Administration Site is for individuals who are responsible for implementing password self-management through performing administrative tasks, such as configuring site-specific settings and enforcing password policies, to suit the specific needs of their organization. Help Desk Site handles typical tasks performed by Help Desk operators, such as resetting passwords, unlocking user accounts, assigning temporary passcodes, and managing users' Questions and Answers profiles. Self-Service Site provides users with the ability to easily and securely manage their passwords, thus eliminating the need for assistance from high-level administrators and reducing helpdesk workload. 11

12 Quest Password Manager 12

13 2 Administration Site Checklist: Configuring Password Manager Changing User Interface Language Specifying Global Settings Configuring Access to Self-Service Site from Windows Logon Screen Managing Domains Reporting

14 Quest Password Manager Checklist: Configuring Password Manager When you have installed Password Manager, follow this checklist to configure the solution to implement automated and secure password management in an Active Directory domain STEP It is strongly recommended that you enable HTTPS on the server where Password Manager is installed. Prepare the account under which Password Manager will access the managed domain. REFERENCE Enabling HTTPS on page 16 Configuring Permissions to Access a Managed Domain on page 39 Register the managed domain with Password Manager. Adding a Managed Domain on page 40 Create language-specific question lists, and configure the Questions and Answers Policy if required. If you want to provide the access to the Self-Service site from the Windows logon screen, install the Secure Password Extension. Configure settings that apply to all domains managed with Password Manager (such as site-specific defaults, notification settings, and profile update policy). Grant the access permissions for the Help Desk site to help desk operators. You can also delegate access for the Administrative site to trusted Password Manager administrators. Managing Questions and Answers Profiles on page 41 Configuring Access to Self-Service Site from Windows Logon Screen on page 28 Specifying Global Settings on page 15 Delegating Help Desk and Administrative Tasks on page 62 Ensure that the screen resolution on client-side computers used to access the Web sites of Password Manager is set to a minimum of 800x600 pixels. The recommended screen resolution is 1024x768 pixels. Ensure that all Password Manager users have JavaScript enabled in Microsoft Internet Explorer settings. Ensure that the users know the Self-Service site URL and can access the site to register and perform password self-management tasks. If required, configure options for user registration notification and enforcement by specifying a registration schedule and enabling registration notification. To allow users access the Self-Service site, explicitly specify the groups which are granted access to the Self-Service site. By default, no managed domain user can access the Self-Service site. If you want to use Password Manager to enforce password policies, you first install Password Policy Manager (PPM) on all domain controllers in the domain. Then, create password policies and configure password policy rules. If you want to use Password Manager for cross-platform password synchronization, install Quest Quick Connect and configure the product to integrate with Password Manager. Configuring Registration Notification and Enforcement on page 59 Configuring Access to Self-Service Site on page 64 Installing Password Policy Manager on page 45 Creating and Configuring a Password Policy on page 46 Configuring Password Policy Rules on page 47 Configuring Cross-Platform Password Synchronization using ActiveRoles Quick Connect on page 80 14

15 Administrator Guide Specifying Global Settings This section outlines the procedures required to configure site-specific settings that affect users and helpdesk operators in all domains registered with Password Manager. 15

16 Quest Password Manager Enabling HTTPS We strongly recommend that you use HTTPS with Quest Password Manager. The secure hypertext transfer protocol (HTTPS) is a communications protocol designed to transfer encrypted information between computers over the World Wide Web. To enable HTTPS for your Web server you may need to obtain a Server Certificate. For step-by-step instructions on how to configure a Web server for SSL in order to support HTTPS connections from client applications, see the MSDN article "How To: Set Up SSL on a Web Server" at 16

17 Administrator Guide Configuring Self-Service Site Settings You can customize the behavior of the Self-Service site by specifying what password management tasks are allowed to users and configuring user notification. Configuring Security Settings By configuring the security settings, you define whether you want to let users do the following: Hide their security answers on the screen. See the domain name on the Self-Service site pages. See which of the personal questions users have answered incorrectly when authenticating. To configure security settings for the Self-Service site 1. Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is 2. On the menu bar, click Settings, and then click the Self-Service Site tab. 3. Under Security settings, configure the following options as required: OPTION Hide users answers by default Allow users to hide their answers Prevent users from seeing whether questions are answered correctly Hide tools not available for user Use a security CAPTCHA image to prevent bot attacks Domain display options DESCRIPTION Select this check box to have Password Manager display users' security answers as asterisks while they are typing in their answers. Select this check box to allow users to hide their answers on the screen, so that answer entry fields will look like a series of asterisks. Select this check box to prevent users from seeing to which of their private questions they have provided incorrect answers when performing password self-management tasks using the Self-Service site. Select this check box to prevent users from seeing the tools which are not available for them. Select this check box to have the Self-Service site display a picture with characters and require the user to enter the characters on the picture. This feature provides enhanced protection against automated attacks. Use this section to specify whether Self-Service Site should show the managed domain name to the user. If you select the "Show domain list" option, the Self-Service site user will be able to see the list of the managed domains registered with Password Manager. By selecting the "Hide domain list" option you will prevent users from seeing the list of domains. 17

18 Quest Password Manager OPTION Users must agree that Password Manager will store their personal information DESCRIPTION Depending on the legislation requirements, organizations may be required to explicitly obtain users consent to store their personal information which is available in Question and Answers profile. Select this check box to have the Self-Service site ask users to agree that Password Manager will store their personal information. 4. Click Save. Configuring Allowed Self-Service Site Tasks You can granularly configure the set of the tasks available for the Password Manager end-users on the Self-Service site. To configure the tasks available for the Self-Service site users: 1. Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is 2. On the menu bar, click Settings, and then click the Self-Service Site tab. 3. Click Allowed self-service tasks to expand this section, and then configure the following options as required: OPTION Allow users to register with Password Manager Allow users to unlock their accounts Allow users to reset their passwords Allow users to change their passwords Allow users to change Q&A profile Allow users to change their alert settings Allow users to use passcode DESCRIPTION Select this check box to allow users to register with Password Manager by using the Self-Service site. Select this check box to allow users to unlock their domain accounts by using the Self-Service site. Select this check box to allow users to reset passwords for their domain accounts by using the Self-Service site. Select this check box to allow users to manage passwords for their accounts in managed domains, and in connected data sources, by using the Self-Service site. Select this check box to allow users to manage Questions and Answers profiles for their accounts in managed domains by using the Self-Service site. Select this check box to allow users to specify events upon which they want to receive alerts. Select this check box to allow users to use passcode for creating Questions and Answers profile. 4. Click Save. 18

19 Administrator Guide Configuring Account Search Options To configure account search options: 1. Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is 2. On the menu bar, click Settings, and then click the Self-Service Site tab. 3. Click Account search options to expand this section, and then configure the following options as required: EVENT Allow users to locate their accounts DESCRIPTION Select the checkbox to allow users to perform account search by using the Locate Account functionality of the Self-Service site. By selecting this option, you can specify the number of user accounts that are displayed in search results. To do this, specify the required number in the "Number of users to display in search results in the Locate Account page" field. User properties to display in search results Select check boxes next to the user account attributes that you want users to view in search results. You can select any of the following attributes: First name Initials Last name Display name Name Full name User logon name 4. Click Save. Configuring User Notification You can configure a list of events upon which you want all registered users to receive notifications. For each of the events below, you can specify whether users may decide for themselves if they want to receive a specific notification of not. User's Q&A profile is updated User's Alert settings are updated User's account is unlocked User's password is reset User's password is changed User's Q&A profile requires update User's Q&A profile is locked User's password is expired 19

20 Quest Password Manager To configure user notification 1. Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is 2. Ensure that you have configured the outgoing mail server settings. To specify the SMTP server settings, use the procedure outlined in Configuring Outgoing Mail Servers Settings on page On the menu bar, click Settings, and then click the Self-Service Site tab. 4. Click User notification settings to expand this area. 5. Specify events upon which you want users to receive notifications, and whether you want users to be able to change your settings for each of the events, by doing the following: Click the link next to a notification event, and then select one of the following options: OPTION Disabled. Users can change this setting. Enabled. Users can change this setting. Permanently disabled. Permanently enabled. DESCRIPTION Select this option to disable user notification for the relevant event while allowing users to override this setting on a per-user basis. Select this option to have users notified about the relevant event, and allow to override this setting on a per-user basis. Select this option to disable user notification for the relevant event, and prevent users from changing this setting. Select this option to enable user notification for the relevant event, and prevent users from changing this setting. Under Days to notify a user before their password expires, optionally set the number of days during which you want users to receive password expiration notifications, before their passwords expire. 6. Click Save. If you enable the password expiration notification, then Password Manager will send password expiration notifications only to those users from all managed domains, who have registered with Password Manager by creating their personal Questions and Answers profiles. Configuring Help Desk Site Settings You can define what password management tasks the help desk operators are allowed or required to perform. The settings described in this section are applied throughout all Active Directory domains managed by Password Manager. To specify settings for the Help Desk site 1. Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is 2. On the menu bar, click Settings, and then select the Help Desk Site tab. 20

21 Administrator Guide 3. In the Allow helpdesk operators to section, configure the following options as required: OPTION verify user identity assign passcodes DESCRIPTION Select this option to allow helpdesk operators to verify user identity by using the Help Desk site. Select Yes to allow helpdesk operators to assign temporary passcodes for users who forgot their passwords while not being registered with Password Manager. Then, below this option you can specify the Passcode lifetime in minutes value, i.e. the period within which the passcode is valid. reset user passwords Select this option to allow helpdesk operators to reset user passwords by using the Help Desk site. Select the "only after user identity verification" option to force helpdesk operators to check user identity before resetting user s password. unlock user accounts Select this option to allow helpdesk operators to unlock user accounts by using the Help Desk site. Select the "only after user identity verification" option to force helpdesk operators to check user identity before unlocking user account. require users to update their Q&A profiles Passcode lifetime, in minutes unlock users' Q&A profiles Select this option to allow helpdesk operators to invalidate users' Questions and Answers profiles and to set a deadline for a user to update their Q&A profile. Specify how long a passcode issued by helpdesk operators to users is valid for users to create their Questions and Answers profile. Select this option to allow helpdesk operators to unlock users' Question and Answers profiles that are locked as a result of a sequence of failed attempts to provide the correct answers. 21

22 Quest Password Manager 4. Configure the following options as required: OPTION Helpdesk operators must verify user identity by DESCRIPTION Defines that helpdesk operators must verify a user's identity before resetting the user's password, or unlocking their account. To configure this option, select how you want operators to authenticate users: Answer to randomly selected mandatory question (user s answer is hidden). In this mode, the operator will ask a user for their complete answer to one of the mandatory questions specified in the user's Q&A profile. Answer to authentication question (user s answer is hidden). In this mode, the operator will ask a user for their complete answers to the Help Desk authentication questions, and enter the answers on the identity verification page. Answer to authentication question (user s answer is visible). In this mode, the operator will ask a user for their complete answers to the Help Desk authentication questions, and then compare them to the answers displayed on the identity verification page. Random characters of an answer to authentication question. In this mode, the operator will ask a user to tell the specified number of characters in the user's answers to the Help Desk authentication questions, and then type in those characters in the appropriate positions on the identity verification page. Allow helpdesk operators to require users to change their passwords at next logon Select this option to allow helpdesk operators to force users to change their passwords at next logon. 5. Click Save. Configuring Outgoing Mail Servers Settings You can configure one or more outgoing mail servers. If there are several servers, Password Manager will first attempt to use the top one in the list. To add outgoing mail servers (SMTP) 1. Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is 2. On the menu bar, click Settings, and then click the Notifications tab. 3. Select the Enable notifications option. 4. In the Mail Servers area, click Add. 22