Skip to main content
Version: Axidian Privilege 3.0

Accounts

The section allows to manage local and domain accounts.

Adding an account​

To add an account to PAM, please follow these steps:

  1. Go to the Accounts section and click Add.
  2. Select the location of the account (resource or domain).
  3. Enter an account name (required) and description (optional).
  4. Set a password. Maximum password length is 4096 characters.
  5. Check the entered data and save the account.

The search is performed in the Accounts section.

Enter Account name in whole or in part in the search bar.

Click Extended search and enter one or more criteria, Account name in whole or in part.
Select account state:

  • Pending
  • Ignored
  • Managed
  • Blocked
  • Removed

Select account location:

  1. Local account To search, enter the Resource name or DNS name/IP address in whole or in part.
  2. Domain account To search, enter NetBIOS name or DNS name in whole or in part.

Account Page​

The profile displays the data specified while adding the account:

  • Name — is the account name
  • Location — the name of the resource or domain, where the account resides
  • Description — this can be an arbitrary text
  • Policy — is the set of rules applied to sessions started with the account
  • Password (or a Key) checking date — is date and time when the account password or SSH key was last checked
  • Synchronization date — date and time of the last data synchronization
  • Date added — is the date and time when the account was added to Axidian Privilege
  • Last change — is the date and time when the account was last edited
  • Last password change date — is the date and time when the account password was last changed in Axidian Privilege database
  • Last password change date on resource/domain — is the date and time when the account password was last changed at the Axidian Privilege database and at the resource
  • Last SSH key change date — the date and time of the SSH key change in the Axidian Privilege database
  • Last SSH key change date on resource — the date and time of the SSH key change in the Axidian Privilege database and on the resource

Permissions​

All permissions where the account is used are displayed in the Permissions tab. The following data is displayed for every permission:

  • # — permission number.
  • User — the Active Directory user, the permission is given to
  • Organizational unit — OU's name that the resource belongs to
  • Resources — the resources that RDP, SSH or web session can be started with the account specified in the permission

Sessions​

All active and finished sessions for the account are available at the Sessions tab. The following data is displayed for every session:

  • User — the Active Directory user who initiated the session
  • Account — the account used to start RDP, SSH or web session
  • Organizational unit — OU's name that the resource belongs to
  • Resource — the resource that RDP, SSH or web session is started at under the account
  • Connection address — the actual address used when opening the session
  • Duration — is the session duration
  • Connection — remote connection type (RDP, SSH, user types)
  • Connected to Axidian Privilege — date and time when the session was started
  • Finished — date and time when the session was finished
  • State — this displays the current status of the session (active or finished)

To view detailed information about the session, click on it. To display all sessions for a given account, click Show all.

Events​

The account events are displayed in the Events tab. The following data is displayed for every event:

  • Creation time — date and time when the event was created
  • Code — is the event code
  • Event — is the event description
  • Component — is the Axidian Privilege component that generated the event. Initiator is the account that initiated the event generation
  • Initiator — the account that initiated the generation of the event

To view detailed information about the event, click on it. To display all events for a given account, click the Show all.

Security Groups​

The Security groups tab displays a list of groups to which the account has been added. 

note

Built-in security groups are not displayed for domain accounts.

Services​

caution

For local accounts, this tab is only displayed if the associated resource has a Windows service connection configured.

All added services are displayed on the Services tab.

For each service the following information is displayed:

  • Service name — the value specified when the service was created. It matches the value of the Service name field of the Services snap-in on the resource.
  • Account — the service runs on behalf of this account.
  • Description — custom text.

Also on this tab you can add a service for this account, to do this click Add.

Setting a Policy for an Account​

  1. Open the account's profile.
  2. Click to add or change a policy.