configuring windows assets that are DC

my specific question is:

is it possible to configure in safeguard some windows servers that are also Domain Controller (slave of a unique domain) and access on it with classic RDP session?

a customer has many sites and every site has the own windows server where there is a replica of the AD master

all the system administrators have to access on all these windows server in a classic way even if they are Domain Controller function.

Is it possible? in which way?

so, i configured in safeguard one asset like "Active Directory" (choosing under the "Product", in adding asset, Active Directory) to manage the users, and the directory accounts and so on and all other windows server (domain controller slave) i want to configure and want only be able to access on it in a classic way (RDP session) even if they have the domain controller service.

i tried to configure these like normal "windows server" but at the moment to try check connection i get this error.

"Asset RUMOSVMS009-PR is a Domain controller. A domain account is required to manage this asset"

if i try a check password i get this:

Asset CNHAKVMS009-PR is a Domain controller. The 'CheckPassword' operation cannot be run on a domain controller.

how can i solve it? i am going creazy

THANKS A LOT!!!

0 Cyril Chong over 2 years ago
Dario, there are few parts to onboard a Domain Controllers

they are just Windows Server, hence when you are onboarding it, you should be using "Windows Server" type with Authentication Type of Directory Account.

The Directory Account should be onboarded into the Active Directory Asset in Safeguard beforehand, refer to rights and requirements here --> How To: Configure Windows Assets in Safeguard (309238) (oneidentity.com)

When configuring the Access Request policy, under scope, Asset should be specified, refer to --> https://support.oneidentity.com/one-identity-safeguard-for-privileged-passwords/kb/238873/how-to-perform-a-rdp-session-to-a-windows-asset-with-a-directory-domain-account-238873

Linked account can also be considered in this scenario depending on your use case. https://support.oneidentity.com/one-identity-safeguard-for-privileged-passwords/kb/323376/how-to-perform-a-rdp-session-to-a-windows-asset-with-a-linked-directory-domain-account-323376
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 yousefsaber40 over 1 year ago

there are two assets there is AD, and to add them you have to make sure that your SPP can DNSlookup the domain name of the active directory with specifying the domain controllers for these active directories, and secondly there is adding the Domain controller servers themselves, to add a domain controller servers you have to make sure that you are choosing an Active directory account with enough privileges to sign into the domain controllers regular users won't be able to sign to domain controllers but workstations only.
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Endpoint Privilege Management

configuring windows assets that are DC