Policy Setup

Policies

A policy is a set of options and restrictions applied to various objects: users, accounts, resources, or domains. For example, using configured policies, you can set forbidden SSH commands for the user, request reasons for opening a session, or restrict the operation of the clipboard between the workplace and the resource. You can assign only one policy for each object.

The default policy contains a set of parameters for all available sections and applies to all new objects, so it is advisable to start configuring there.

note

The default policy also applies to sessions opened on behalf of user accounts, unless other policies are explicitly applied to these users.

Open the policy page, set the desired parameters for the Accounts, Sessions, RDP sections, save settings.

Adding New Policy

caution

To add, view, edit and delete policies, you may need the appropriate claims from the POLICIES MANAGEMENT section (Policy.Create, Policy.Read, Policy.Update, Policy.Delete).

Click Add in the Policies section, fill in the Policy Name, Description, and Priority fields. The new policy will appear in the list.

General Information

Open the policy page, review the general information, edit Name, Description, or Priority if necessary by clicking the pencil icon

• Name — the name of the policy, it is set when creating a new policy. It can be changed at any time.
• Description — policy description.
• Priority — a number indicating the order in which a particular policy is applied. Zero priority is the default policy that is applied last.
• Created by — Axidian Privilege administrator name.
• Date created — date and time when the policy was created.
• Changed by — name of Axidian Privilege administrator who saved the policy settings.
• Date changed — date and time when the policy settings were saved.

To edit Name, Description and Priority click 

Sections

Go to the Sections and mark the sections which will be determined by the policy, save the changes. The corresponding sections will become available for setting up.

note

For unchecked sections, other policies will be applied by priority.

Scope

caution

To assign policies you may need the appropriate claims (User.SetPolicy, UsersGroup.SetPolicy, Account.SetPolicy, Resource.SetPolicy, Domain.SetPolicy).

Contains information about which users, user groups, accounts, resources, or domains the policy is applied to.

To apply a policy to an object, click Add, select the type of object to apply the policy, select the objects.

To remove the policy from objects, select the required objects and click Remove.

Creating a Copy of the Policy

Check the policy in the Policies section and click Create copy, fill in the Policy name, Description and Priority fields. The copied policy will appear in the list.

Removing Policy

Before removing a policy, make sure that it does not apply to any objects.

Check the required policies in the Policies section and click Remove.

note

The Default policy cannot be removed.

Changing the Priority of a Policy

Check one policy under Policies, click Change priority and enter a number for the policy priority value.

You can also change the priority by opening the required policy and in the General Information section click the pencil icon next to the priority value.

Policy Sections

---

Accounts

Credential privacy settings

Option	Description
Reset account password and SSH key after showing	If this option is enabled, the password and SSH key of the privileged account will be reset every time the user views it in his self service (User Console).
Reset password and SSH key after X minutes	After viewing, the password and SSH key will be reset to a random value after the specified number of minutes.
Require a reason of password and SSH key viewing	If this option is enabled, the directory user must provide a reason before viewing the password or SSH key of the privileged account.
Password and SSH key viewing must be confirmed by Axidian Privilege administrator	Before each credential is viewed by the user, it must be confirmed by the Axidian Privilege administrator
Password and SSH key confirmation timeout, min.	Timeout of waiting for confirmation of password and SSH key viewing, from 1 to 180 minutes.
Encrypt SSH key using generated password before showing to user	If this option is enabled, the SSH key will be shown in encrypted form, and the generated encryption password will be hidden. The encryption key and password is generated by Axidian Privilege every time the data is viewed.

Set credential settings

Option	Description
Allow Axidian Privilege users to set credentials for accounts if they are not set	If this option is enabled, Axidian Privilege users can set password/SSH keys for privileged account before connection.

Check and Reset Credentials Settings

Option	Description
Periodically synchronize resources and accounts	If this option is enabled, then an automatic search for data and privileged accounts on resources will be performed.
Synchronize resources and accounts once in X days	Automatic search for resource data and privileged accounts will be performed once every specified number of days, from 1 to 10,000 days
Periodically check account password and SSH key	If this option is enabled, then passwords and SSH keys will be automatically checked for privileged accounts.
Check password and SSH key once in X days	Automatic check of the password and SSH key of privileged accounts will be performed once every specified number of days, from 1 to 10,000 days.
Reset password and SSH key if a mismatch is detected	If this option is enabled, then passwords and SSH keys will be automatically reset in case of mismatch between Axidian Privilege and resources.
Remove SSH keys unmanaged by Axidian Privilege	If there is no SSH key for the added account in Axidian Privilege, but there is one on the resource, then all discovered keys from the resource will be removed.
Check password and SSH key if it's set manually	If this option is enabled, a check will be performed when setting or changing a password or SSH key.
Periodically change account password and SSH key	If this option is enabled, the password or SSH key will be automatically changed to a random value for privileged accounts.
Change password and SSH key every X days	Automatic change of password or SSH key for privileged accounts will be performed once every specified number of days.

Password Generator Requirements

Option	Description
Generated password length	Total number of characters for automatically generated and manually entered passwords.
Lowercase letters	If this option is enabled, then automatically generated passwords will consist of lowercase letters. When combined with other settings, the password will contain at least one lowercase letter.
Uppercase letters	If this option is enabled, then automatically generated passwords will consist of capital letters. When combined with other settings, the password will contain at least one uppercase letter.
Digits	If this option is enabled, then automatically generated passwords will consist of digits. When combined with other settings, the password will contain at least one digit.
Special characters	If this option is enabled, then automatically generated passwords will consist of special characters. When combined with other settings, the password will contain at least one special character.
Prohibit the use of special characters at the beginning of the password	If this option is enabled, then the password will start with a letter or a number.
Maximum number of consecutive special characters	This parameter determines how many special characters are allowed to be used one after another. For example, if you specify a value of 1, then the password#! password will not be valid. But the passwor#d! password will be valid, because the special characters are not consecutive, they are separated by a letter. To allow any number of consecutive special characters, specify 0.
Prohibited characters	Characters that should not be used by the password generator when generating passwords. The field may be empty. In this case, no restrictions apply.
Required characters	Characters, at least one of which will definitely be used when generating a password. The field may be empty. In this case, no restrictions apply.
Number of passwords that should not be repeated	The number of previous passwords for the account with which the new password should not match.

Password Requirements for Manual input

Option	Description
Minimum password length	Minimum number of characters for manual password entry.
Limit characters for manual password entry	If the option is enabled, the settings described in this table are available for being set. If the option is disabled, any characters are allowed in passwords.
Lowercase letters	If this option is enabled, the password must contain at least one lowercase letter.
Uppercase letters	If this option is enabled, the password must contain at least one uppercase letter.
Digits	If this option is enabled, the password must contain at least one digit.
Special characters	If this option is enabled, the password must contain at least one special character.
Allow white space	If this setting is enabled, white spaces are allowed in the password, but are not required. You cannot enter a space in the Prohibited Characters and Required Characters fields.
Prohibit the use of special characters at the beginning of the password	If this option is enabled, the password must start with a letter or a digit.
Maximum number of consecutive special characters	This parameter determines how many special characters are allowed to be used one after another. For example, if you specify a value of 1, then the password#! password will not be valid. But the passwor#d! password will be valid, because the special characters are not consecutive, they are separated by a letter. To allow any number of consecutive special characters, specify 0.
Prohibited characters	Characters that should not be used in passwords. You cannot enter a white space in this field. The field may be empty. In this case, no restrictions apply.
Required characters	Characters, at least one of which must be used in passwords. You cannot enter a white space in this field. The field may be empty. In this case, no restrictions apply.
Number of passwords that should not be repeated	The number of previous passwords for the account with which the new password should not match.

---

Sessions

General

Option	Description
User must specify the connection reason	If the option is enabled, then when connecting to the resource, the user must enter the reason for starting the session. Attention! If you use PostgreSQL Proxy, warn users that they will need to enter the reason in the same field as the account name. For more information, see Connection to the PostgreSQL Proxy section.
The message that the user will see when the reason is requested	If the User must specify the connection reason option is enabled, then the message is required to be filled in. Default value: "Specify the connection reason:". You can change the text of the message to tell the user what exactly the information to enter when connecting. For example, if you need to specify the task number in the ticket system to connect, then enter: "Specify the task number to perform the task on this resource:". Maximum allowed message length: 100 characters.
Maximum session duration	The option enables the session duration limit in hours and minutes, after which the session will end automatically.
Enforce exclusive usage of account	If the option is enabled, then only one active session can be opened for the account
Start of the session must be confirmed by Axidian Privilege administrator	If this option is enabled, then manual confirmation by the Axidian Privilege administrator is required for each opened session. Attention! Leave this option disabled if you use PostgreSQL Proxy, otherwise it will be impossible to open an SQL session.
Session confirmation timeout, min.	Timeout for confirmation by the Axidian Privilege administrator, in the range from 1 to 180 minutes
Terminate session when there is no user activity	If the option is enabled, then if the user is inactive for a specified period of time, their session is terminated. For existing policies this option is disabled by default, and for new ones it is enabled by default. User activity refers to user interaction with the screen or session terminal, as well as file transfer operations. This option only applies to sessions opened via SSH Proxy and RDP Proxy.
Session termination timeout, min.	Minimum value: 1 minute Default value: 30 minutes Maximum value: 720 minutes
Reset password and SSH key at the end of the session	If the option is enabled, the password and SSH key will be reset after each session.

Session Artifacts

Option	Description
Save session text logs	If the option is enabled, then after the session, a text log will be available for viewing and downloading
Proceed with the RDP session without logging if the text log could not be retrieved	When option is enabled: If connection with the PAM agent is lost, the session is not terminated, users can continue working in this session. The event "Lost connection with PAM Agent" is entered into the log once. The line "WARNING: Lost connection with PAM Agent" is written once into the text session log. When the connection with the PAM agent is restored, the event "Connection with PAM Agent restored" is entered into the log once, and the line "INFO: Connection with PAM Agent restored" is written once into the text session log. When option is disabled (by default): If connection with the PAM agent is lost, the session is terminated.
Text log rotation	If this option is enabled, text session logs are deleted based on the configured number of days.
Remove text logs older than	The storage period of the text logs of the session (in days). Specify a value from 1 to 3650.
Save video	If the option is enabled, then after the session is completed, video recording will be available
Frames per second	The setting determines the frame rate for video recording. Specify a value from 1 to 10.
Video resolution	The setting allows you to set the resolution for video recording. Available values: No change Reduce 1.5 times Reduce 2 times (recommend scaling for web sessions)
Video log rotation	If this option is enabled, video recordings are deleted based on the configured number of days.
Remove video older than	The storage period of the video recordings (in days). Specify a value from 1 to 3650.
Save screenshots	If this option is enabled, then screenshots of the session will be saved
Screenshots interval, sec.	Saving a screenshot after a specified number of seconds. Minimum interval is 60 seconds.
Screenshots resolution	Setting allows you to set the resolution of the screenshot. Available values: No change Reduce 1.5 times Reduce 2 times (recommend scaling for web sessions)
Screenshots log rotation	If this option is enabled, screenshots are deleted based on the configured number of days.
Remove screenshots older than	The storage period of the screenshots (in days). Specify a value from 1 to 3650.
Save transferred files	If the option is enabled, then files when transferred from the local machine to the resource will be duplicated in the specified network folder. Supported only for Windows resources with disk forwarding enabled.
Transferred files rotation	If this option is enabled, transferred files are deleted based on the configured number of days.
Remove transferred files older than	The storage period of the transferred files (in days). Specify a value from 1 to 3650.

Sending Text Log via Syslog

Option	Description
Send text logs via syslog	The text log lines will be sent via syslog using the specified keywords. A keyword can be a regular expression.

---

Connection settings

The connection settings allow you to override the proxy server parameters specified in the Configuration → System Settings section. If your infrastructure uses multiple proxy server instances, you can specify individual settings for each one.

How to apply the settings

To apply the settings when a session starts, assign the policy to a resource, account, or user.

Option	Description
Override Gateway settings	If this option is enabled, the Gateway component parameters used when connecting to the RDS Access Server are overridden according to the policy. Settings and limitations RDCB address — IP address or DNS name of the server with the Remote Desktop Connection Broker role. RDCB collection name — name of the Remote Desktop Connection Broker collection. The collection is used for load balancing when connecting through Axidian Privilege Gateway. Use RDGW — allows the RDP client to connect to Axidian Privilege Gateway through the Remote Desktop Gateway. RDGW address — IP address or DNS name of the Remote Desktop Gateway server. RDP file parameters — parameters that are automatically added when the RDP file is generated in the User Console. The specified parameters are used when connecting to the RDS Access Server. # Example screen mode id:i:2 authentication level:i:2 Limitations The following parameters cannot be overridden through a policy: full address redirectprinters redirectcomports redirectsmartcards redirectposdevices drivestoredirect gatewayhostname gatewayusagemethod gatewayprofileusagemethod loadbalanceinfo shell working directory alternate shell remoteapplicationprogram remoteapplicationcmdline
Override SSH Proxy settings	If this option is enabled, the SSH Proxy component address is overridden according to the policy. In the New address field, enter the IP address or DNS name of the SSH Proxy server. This address is automatically added to the command used to connect to the resource.
Override RDP Proxy settings	If this option is enabled, the RDP Proxy component parameters are overridden according to the policy. Settings and limitations New address — IP address or DNS name of the RDP Proxy server. This address is added to the RDP file. RDP file parameters — parameters that are automatically added when the RDP file is generated in the User Console. The specified parameters are used when connecting to the RDP Proxy server. # Example screen mode id:i:2 authentication level:i:2 Limitations The following parameters cannot be overridden through a policy: full address redirectprinters redirectcomports redirectsmartcards redirectposdevices drivestoredirect gatewayhostname gatewayusagemethod gatewayprofileusagemethod loadbalanceinfo shell working directory alternate shell remoteapplicationprogram remoteapplicationcmdline
Override Web Proxy settings	If this option is enabled, the Web Proxy component address is overridden according to the policy. In the New address field, enter the IP address or DNS name of the Web Proxy server. This address is automatically substituted when a web session starts.
Override PostgreSQL Proxy settings	If this option is enabled, the PostgreSQL Proxy component address is overridden according to the policy. In the New address field, enter the IP address or DNS name of the PostgreSQL Proxy server. This address is automatically added to the command used to connect to the resource.
Override MSSQL Proxy settings	If this option is enabled, the MSSQL Proxy component address is overridden according to the policy. In the New address field, enter the IP address or DNS name of the MSSQL Proxy server. This address is automatically added to the command used to connect to the resource.

---

RDP

Connection parameters

info

The settings are added to the RDP file and are applied by the RDP client—the Remote Desktop Connection application or the Web Terminal—when the session is started.

Option	Description
Printers	If this option is enabled, the user can redirect a printer from their workplace to the Windows resource. This setting applies when connecting through Gateway and RDP Proxy.
Clipboard	If this option is enabled, the user can: use the clipboard between their workplace and the resource drag and drop files between the workstation and the resource when the RDP session is opened through the Web terminal This setting applies when connecting through Gateway and RDP Proxy.
Smart cards	If this option is enabled, the user can redirect a smart card from their workplace to the Windows resource. This setting applies when connecting through Gateway and RDP Proxy.
Ports	If this option is enabled, the user can redirect COM ports from their workplace to the Windows resource. This setting applies when connecting through Gateway and RDP Proxy.
Local drives	If this option is enabled, the user can: redirect local drives from their workplace to the resource exchange files between the resource and their workplace through the forwarded drives in RDP sessions opened through the Web terminal This setting applies when connecting through Gateway and RDP Proxy.
Require a trusted resource certificate to open an RDP session	The certificate is verified by the user's local RDP client when the RDP file is opened: If this option is enabled and the resource certificate is invalid, the session does not open. If this option is disabled, the session will open with any certificate. This setting applies when connecting through Gateway and RDP Proxy.
RDP file parameters	Parameters that are added when the RDP file is generated. This setting applies when connecting through Gateway and RDP Proxy. # Example screen mode id:i:2 use multimon:i:1 Limitations The following parameters cannot be overridden through a policy: full address password redirectprinters redirectcomports redirectsmartcards redirectclipboard redirectposdevices server port drivestoredirect username authentication level

Activity control

Activity control allows you to track user actions within an RDP session and respond to them. For example, you can block a user in Axidian Privilege if they launch a specific application, switch to another window, or type a specific word on the keyboard.

User actions are tracked by analyzing text logs—when data appears in the logs, PAM reacts according to the configured rules.

How to enable log collection

For PAM to collect and analyze session logs, in the policy, go to Sessions → Session Artifacts section and enable the Save session text logs option.

If the Proceed with the RDP session without logging if the text log could not be retrieved option is enabled, the session is not interrupted, but activity control is paused until log collection is restored.

Add rule

Add the necessary rules before the user connects to the resource. New rules apply only to sessions opened after the rules are added.

To add a new rule:

1. In the policy, in the RDP section, click Add.

2. Select the monitored action and fill in the additional parameters.

   How to select and configure the action type

   Process launch

   With the selected action type, PAM tracks what the user launches. This can be applications, browsers, or system utilities.

   1. In the Executable path field, enter a regular expression to match the executable file path. In the log, the file path follows Executable path.

   2. (Optional) In the Command line arguments field, enter a regular expression to match the file startup parameters. In the log, the arguments follow command line.

      info

      Regular expressions are case-insensitive.

      The Command line arguments field is intended for startup parameters only. If the log duplicates the executable path after command line, do not include the path in this field.

      Examples

      Launching Google Chrome

      To track Google Chrome launches, fill in the following fields:

      • In the Executable path field, specify .*\\chrome\.exe.
      • In the Command line arguments field, specify .*.

      Text log example

      2026-05-25 00:52:09 Executable path: C:\Program Files\Google\Chrome\Application\chrome.exe, command line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --time-ticks-at-unix-epoch=-1763427056801309 --launch-time-ticks=16232471832426 --metrics-shmem-handle=3048,i,5665439599788436001,8804099441798368138,2097152 --field-trial-handle=1900,i,6741951583612309079,9546513817746230192,262144 --variations-seed-version=20260524-030033.420000-production --pseudonymization-salt-handle=1904,i,9758245334007145095,8031267275877605306,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=6232 /prefetch:1

      Detecting a PowerShell execution policy bypass

      To detect a PowerShell execution policy bypass, fill in the following fields:

      • In the Executable path field, specify .*\\powershell\.exe.
      • In the Command line arguments field, specify .*-ExecutionPolicy\s+Bypass.*.

      Text log example

      2026-05-25 10:14:32 Executable path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, command line: "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Temp\install.ps1

   Active window change

   With the selected action type, PAM tracks which windows the user switches to, for example, Task Manager or a browser window.

   In the Active window title field, enter a regular expression to match the window title that you want to track. In the log, the window title follows Active window changed to.

   info

   Regular expressions are case-insensitive.

   Example

   Switching to a Google Chrome browser window

   To track switching to the Google Chrome browser window, in the Active window title field, specify [^']*Google Chrome.

   Text log example

   2026-05-25 00:30:27 Active window changed to 'New Tab - Google Chrome' 2026-05-25 00:30:27 Executable path: C:\Windows\system32\TSTheme.exe, command line: C:\Windows\system32\TSTheme.exe -Embedding

   Keyboard input

   With the selected action type, PAM tracks the text the user types on the keyboard. The rule does not apply to password input, because that field is masked.

   In the Entered text field, enter a regular expression to match the text the user types on the keyboard. In the log, keyboard input follows Keyboard.

   info

   Regular expressions are case-insensitive.

   Limitations

   The rule applies to the sequence of keystrokes from the log, not to the final text the user entered.

   When the rule will not trigger

   The rule will not trigger in the following cases:

   • Executing a command from history with the Up+Enter shortcut. The log contains only [Up][Enter] without the command text.
   • Editing text with the Backspace, Delete, Home keys, or the Left and Right arrow keys.
   • Entering characters with the Shift key. For example, entering the path C:\Temp appears in the log as [Shift+c][Shift+;]\[Shift+t]emp.
   • Tracking text pasted from the clipboard.
   • Selecting or replacing already entered text.
   • Switching between input fields with the mouse.

   Example

   Entering a specific word

   To track the entry of a word, for example confidential, in the Entered text field, specify confidential.

   Text log example

   2026-05-25 00:41:44 Keyboard: confidential[Enter]

   Using the clipboard with Ctrl+V

   To track when the user presses Ctrl+V, in the Entered text field, specify \[Control\+v\].

   Text log example

   2026-05-25 09:15:02 Keyboard: [Control+v]

   Opening print with Ctrl+P

   To track when the user presses Ctrl+P, in the Entered text field, specify \[Control\+p\].

   Text log example

   2026-05-25 09:16:20 Keyboard: [Control+p]

3. Select how PAM reacts when the user performs the tracked action.

   Reactions and their priorities

   Reaction priority

   If multiple rules apply to a single log entry, the rule with the higher priority is applied.

   PAM reaction	Priority	Description
   Log event only	1	The user action is recorded in the log The current RDP session is not aborted The user is not blocked in PAM
   Abort session	2	The user action is recorded in the log The current RDP session is aborted The user is not blocked in PAM
   Block user in PAM	3	The user action is recorded in the log All user sessions are aborted The user is blocked in PAM

4. (Optional) Fill in the Description field. We recommend describing what the rule is for.

5. Click Create.

Edit rule

info

The changes will take effect when the user ends the current session and starts a new one.

To edit an existing rule:

1. Select a rule from the list and click Edit.
2. Make the necessary changes and click Save.

Remove rule

If you remove a rule, PAM no longer reacts to the previously tracked action in the RDP session. A removed rule cannot be restored.

To remove a rule, select one or more rules and click Remove.

---

SSH

Session Parameters

Option	Description
Use PTY	Requests a pseudo-terminal (PTY) for the session. When disabled, only non-interactive commands are available.
Allow local port forwarding	Users can forward local ports in sessions opened via SSH Proxy. This allows using the SSH session to connect to other systems available on the target resource's network. When disabled, port forwarding is not allowed in the session. Dynamic and remote forwarding aren't supported in SSH Proxy sessions.

Privilege Elevation

Option	Description
Allow run pamsu	Support for executing commands with root privileges on resources with the PamSu component installed.

info

Allowing to use PamSu while creating the permission takes priority over the setting in the policy.

Allowed and Forbidden Commands

Option	Description
Prompt	Regular expression to correctly recognize command input. When entering a regular expression, note that you do not need to escape the < and > characters, as they are not included in the list of special characters: .[{}()*+?\|^$. The ] character is also special, but only when entered after [. For more information about the Boost regular expression syntax, see the Boost documentation.
Reaction to forbidden command	Terminal behavior in response to a forbidden command: CTRL + C (cancel execution) or Abort the session.
SSH commands	List of commands allowed or prohibited to execute in an SSH session.

Creating a list of controlled commands:

1. Click the Add button.

2. Enter the command or regular expression.

   When entering a regular expression, note that you do not need to escape the < and > characters, as they are not included in the list of special characters: .[{}()\*+?|^$. The ] character is also special, but only when entered after [.

   For more information about the Boost regular expression syntax, see the Boost documentation.

3. Select the status Allowed or Forbidden.

info

Restricting command execution takes priority over permission.

Without explicit permission, commands will be considered forbidden, so it is not recommended to remove the last rule that allows command execution.

To allow or prohibit several commands at once, select them with the check boxes and click the appropriate button.

When working with the list of commands, as well as when trying to execute a prohibited command, the corresponding events are recorded in the Events section.

Data Transfer

Option	Description
SCP	SCP file transfer settings. Available values Allowed in both directions — files can be transferred both from and to the resource Allowed to the resource only — files can be transferred only to the resource Allowed from the resource only — files can be transferred only to the user's workplace Forbidden — file transfer between the resource and the user's workplace is not available
SFTP	SFTP file transfer settings. Available values Allowed in both directions — files can be transferred both from and to the resource Allowed to the resource only — files can be transferred only to the resource Allowed from the resource only — files can be transferred only to the user's workplace Forbidden — file transfer between the resource and the user's workplace is not available
Maximum file size, MB	If the file size exceeds the specified value, the user cannot transfer the file during the session.