Page Comparison

Before utilizing computers can be used for Privileged Session Management ( PSM), you must enable those machines for either they must be configured to allow RDP or SSH in EmpowerID.

...

connections. Follow these steps to enable your computers for PSM:

Procedure

1. Navigate to the Computer Details Page for the target computer

   • On the navbar, expand Privileged Access and click Computers.

   • Select the Computers tab and search for the computer

   that

   • you want to enable for PSM.

   • Click the Display Name link

   for

   • of the desired computer to access its details.
     

     Image Modified

2. Edit Computer Settings

   • On the Computer Details page that appears, click the Edit link to put the computer in edit mode.
     

     Image Modified

3. Configure Connection Settings

   • Scroll down on the Edit One page

   for the computers and

   • to the connection settings section.

   • For Windows computers, select Allows RDP Connections

   for Windows or

   • ; for Linux computers, select Allows SSH Connections

   for Linux

   • .

   Image Removed

   • Enter the address of your Privileged Session Manager gateway in the

   Privileged Session Manager Gateway

   • corresponding field and

   then click

   • select the

   tile for that gateway to select it

   • appropriate gateway tile.
     

   Image Removed

4. Click Save.

...

1. • Image Added

2. Adjust Just-in-Time Access Settings

   • Further down, locate the Just-in-Time Access settings and adjust them as necessary:

     • Enable Just in Time Account Provisioning: Toggle this setting on to have EmpowerID automatically create a user account when a PSM session is established. Note: This setting applies only if the computer is cataloged as a Local Windows Server account store. When enabled and the machine is a Local Windows Server account store, EmpowerID will create an account using the naming convention "EmpowerID Login_Random Number" (for example, joe.kewl_1234567).
       Please note that For JIT to work properly, any group used for JIT needs to have Remote Desktop Permissions to the computer.

     • Use Existing Account if Applicable: Enable this feature if you want EmpowerID to log users in using their existing Windows server account (assuming it grants them the necessary access) instead of creating a new just-in-time account.

     • Delete JIT-Created Account on Check-In: Activate this setting to have EmpowerID remove the just-in-time user account upon session completion.

     • Allow Select Access Levels on Connect: Enable this to allow users to select from configured IAM Shop Permission Levels when they connect. Refer to the Assign IAM Shop Permission Levels to Computerstopic for configuration guidance.

3. Save Your Changes

   • Click the Save button to preserve your adjustments.

By following these steps, the computer will be fully configured for PSM, enabling users to request sessions as needed.

Local Windows Servers Connector

Assign IAM Shop Permission Levels to Computers

Request Computer Sessions

...

Disconnect Computer Sessions