Managed systems

You can make any target system a managed system by selecting the Automatically create a Bravura Privilege managed system setting on the Target system information page.

The system is added as a managed system during the next auto discovery . The Privileged Access Manager Service uses parameters of the target system to determine which connector program to run and what credentials to use when it resets passwords for a managed system.

Click below to view a demonstration.

To manage systems on a domain:

See:

To download the installation package, from the Bravura Security Fabric main menu:

You can now install the Local Workstation Service installation package.

This section shows you how to install the Local Workstation Service on a Windows server or workstation by manually running the MSI installer that you downloaded in Downloading the installation package .

You can also install the software automatically. For example, use a software package distribution product like Microsoft’s System Center Configuration Manager and use the command line options or use group policy.

See Add-on installation command-line options for more information on the command-line options.

If you use workstation images you can install Local Workstation Service as described below. Disable the service by default and configure to Automatic after the image is placed on the workstation if you want to use the Local Workstation Service.

You can use a plugin to digitally sign files if required. See Digitally signing files for details.

To install the Local Workstation Service manually:

The Local Workstation Service can now contact the Bravura Privilege server to register the host system as a discovered object. Once the service has contacted the server, it sends its system data and registers itself as a discovered system. The default interval for this initial registration is 300 seconds. After registration, the service periodically polls the Bravura Security Fabric to determine whether any jobs, such as password change or attribute listing, are required on the host system. Depending on the task that has been assigned, the service will contact the server at different intervals. If no tasks are assigned, the service will wait the poll time, as defined by the RES POLL INTERVAL, until it rechecks the server for tasks.

If the Local Workstation Service is unable to contact the Bravura Privilege server using the proxy server, it will attempt to poll again without connecting to the proxy server.

In local service mode, a service running locally on the managed system, connects via TLS-encrypted communication over a single outgoing port, the one port made available by the IIS web server into the Bravura Privilege nodes, by default, that port is 443. Please ensure, through either firewall, switch, proxies, tunneling or other networking configuration, that the workstations on which the Local Workstation Service is installed can connect to the Bravura Privilege server IIS.

You can capture log data on local service mode managed systems using the logutil program which is installed with the service.

Custom attribute file

You can use custom system attributes to define requirements for import rules. For local service mode systems, computer information is not stored on the Bravura Privilege server, but locally on the system itself.

The local service installer can read a custom attribute file and send information back to the server to be used by import rules as discovered system attributes. The custom attribute file must be in KVGroup format:

# KVGROUP-V2.0 
"custom_attribute" "" = { 
  "<attribute1>" = "value1"; 
  "<attribute2>" = "value2"; 
  ... 
  "<multi-valued attribute1>" "" = { 
     "<mv1-value1>"; 
     "<mv1-value2>"; 
     ... 
  "<multi-valued attribute2>" "" = { 
     "<mv2-value1>"; 
     .... 
  }; 
}; 

For example:

# KVGROUP-V2.0 
"custom_attribute" "" = { 
  "location" = "calgary"; 
  "system_type" = "laptop"; 
 
  "departments" "" = { 
     "sales"; 
     "marketing"; 
  }; 
}; 

There are some restrictions on what names the custom attributes may use. If any of the custom attributes are using these values, they will invalidate the attribute file and any new attributes will not be sent to the Bravura Privilege server. The attribute names such as NETBIOS, dNSHostName and failedAttempts are some examples.

Custom discovered system object attributes can be removed by setting the cust-attr-file registry entry of the local service of the workstation to an empty string.

Custom discovered system object attributes can be added by setting the cust-attr-file registry entry of the local service of the workstation to the full path name of the custom attribute file.

The Local Workstation Service can send properties of its installation to the McAfee ePolicy Orchestrator (ePO) via McAfee Agent. These properties include the product version, the installation path, and language version.

The server or workstation on which the Local Workstation Service will be installed must be added as a system on the ePO. Consult the McAfee ePolicy Orchestrator documentation to learn how to do this.

Supported versions of ePO include v4.6 or greater.

To install and configure Local Workstation Service to be ePO aware:

To run the Local Workstation Service installation manually using ePO:

To run the Local Workstation Service installation immediately after adding a new system to the ePO:

To view the properties of the Local Workstation Service on ePO:

To uninstall the Local Workstation Service using ePO:

A managed system can also be removed or unbound from a managed system policy. In this case, if the managed system does not belong to any policy, it will be moved into the HISTORICAL_DATA_GRP policy where its passwords are stored. In this state, the passwords are still accessible, but no longer randomized.

To unbind a managed system from a managed system policy:

An alternative method for deleting a managed system is through the target system menu.

To delete a managed system that is configured as a target system:

If you added managed systems on an Active Directory domain automatically via auto discovery , and you removed a computer from the domain, the managed system associated is not removed during the next update, but is instead flagged as deleted. Import rules should be configured for system resolution and HISTORICAL_DATA_GRP policy assignment.

When the Local Workstation Service is installed on the system, it first attempts to register with the Bravura Privilege server. After it has contacted the Bravura Privilege server for the first time, it retrieves configuration settings from the Bravura Privilege server. The service saves the settings in a configuration file, hipamlwsinst.dat, in the hipamlws directory.

For more information about configuration files, see Configuration files .

Bravura Privilege uses a key to ensure secure communication between client and server. The key allows the Bravura Privilege server to verify the identity of a local service mode managed system, and to check whether the managed system is allowed to interact with the server. It also allows the Bravura Privilege service to confirm the identity of the Bravura Privilege server. This key is negotiated and set during the installation process of the Local Workstation Service.

Bravura Privilege also uses a key to encrypt sensitive data, such as passwords, passed to the Local Workstation Service. This key is changed periodically. The number of days this key is valid for is controlled by the RESOURCE KEY CHANGE INTERVAL setting.

If this encryption key is mismatched, the Bravura Privilege will renegotiate a new key to the Local Workstation Service and the data will be resent using the new key.

Set the RESOURCE KEY CHANGE INTERVAL to control the interval, in days, after which workstation keys are changed. The default is 30 days.

You can set options for each managed system policy in the Options tab. Product administrators with all administrative privileges (superuser) can set it globally in the Manage the system > Privileged access > Options menu. Group level settings override global settings. See Privileged access management options for more information.

Changes made to user attributes on a local service mode managed system are updated on the next poll of the Local Workstation Service. You can configure this so that some user attributes are updated less frequently than the default poll time of the Local Workstation Service.

Using a separate time interval RES ATTRIBUTE UPDATE DELAY, you can control the delay in which the user attributes will be updated. By default, the delay is set to 1440 minutes (once a day).

Only user attributes specified in RES DELAY UPDATE ATTRIBUTES are updated according to this time interval, otherwise they are updated after every poll. By default, the pwda (password age) and llogon user attributes are updated using the RES ATTRIBUTE UPDATE DELAY.

When adding local service mode systems using import rules, Bravura Privilege can create new credentials on the systems in order to connect.

Connection credentials are not required. Bravura Privilege can also use no credentials.

If the administrator account creation fails, Bravura Privilege logs an appropriate error message, and retries at the interval specified by RES ADMIN CREATE RETRY INTERVAL .

By default, this interval is configured for 1440 minutes. Product administrators with all administrative privileges (superuser) can set the RES ADMIN CREATE RETRY INTERVAL system variable in the Manage the system > Privileged access > Options > Managed system policies menu.

This setting allows for minimal intervention when the failure is caused by an issue on the workstation, such as a random password that fails to meet local password policy requirements. In these cases, the issue may be resolved with subsequent attempts.

If an import rule is misconfigured, for example, with an invalid security group, before attempting to create an administrator account for the first time, you may need to recreate the import rule. Some settings, such as security group, can only be set once per import rule.

See Privileged access management options for more information about global managed system policy options.

Registered local service mode systems resynchronize themselves by regularly re-sending their system details to the Bravura Privilege instance server. Details sent include:

Resynchronization is a recovery mechanism in case the Bravura Privilege instance server is missing or has conflicting data compared to the local service mode system. Resynchronization will often be sufficient in correcting any discrepancies. In the event that resynchronization does not immediately correct discrepancies, such as database errors, it can reset the data once the source issue has been corrected.

Resynchronization is automatically triggered as configured by the RES RESYNC INTERVAL. However, you may occasionally need to resynchronize manually. To do this:

Resynchronization and transaction failures

The Bravura Privilege instance server will request a resynchronization when a data transaction from the local service mode system fails. Resynchronization retries will occur as required.

Resynchronization and replication failures

In a replicated environment, only one node communicates directly with local service mode systems. Resynchronization will take place as scheduled automatically or manually, and the resulting state will be replicated to other nodes.