You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you are operating at this forest functional level, you must create an OU in your directory where AMS can create the dynamic group objects. From the [[JIT Access Page|Jit-Access-Page]], select your forest, click `Set Dynamic Group OU` button. Choose an OU in your directory. Once you have done that, use the `Delegate dynamic group permission` script to grant the AMS service account rights to create groups in this OU.
24
+
If you are operating at this forest functional level, you must create an OU in your directory where AMS can create the dynamic group objects. From the [JIT Access Page](/app_pages/Jit-Access-Page), select your forest, click `Set Dynamic Group OU` button. Choose an OU in your directory. Once you have done that, use the `Delegate dynamic group permission` script to grant the AMS service account rights to create groups in this OU.
Select the OU that contains the computers you want to create JIT groups for and select a different OU where the JIT groups should be created.
52
52
@@ -65,19 +65,19 @@ Note, using AMS specifically to create JIT groups is not required for JIT to wor
65
65
Using the group policy editor, create a new group policy object and link it to the OU containing your computer objects. Open the policy and navigate to `Computer Configuration`, `Preferences`, `Control Panel Settings`, `Local Users and Groups`.
Right click the `Local users and groups` node, and select `New`, `Local group`. Click the drop down arrow on the `Group name` field, and select `Administrators (built-in)`.
If you are ready to enforce JIT access, select the `Delete all member users` tick box, as well as the `Delete all member groups`. This will ensure that only the built-in administrator, the JIT group and any members specified in this policy are in the local administrators group.
83
83
@@ -96,7 +96,7 @@ From the `Authorization` page, select `Add...` to create a new target. Select th
96
96
97
97
Select `Edit Permissions...` to open the ACL editor. Assign the appropriate users and groups permission to allow JIT access.
Copy file name to clipboardExpand all lines: docs/getting_started/Getting-started.rst
+27-16
Original file line number
Diff line number
Diff line change
@@ -10,30 +10,41 @@ The second component is an optional agent, called the Access Manager Agent (AMA)
10
10
11
11
This document will guide you through the process for configuring Lithnet Access Manager, and the features you want to use in your environment.
12
12
13
-
## Installation
13
+
Installation
14
+
************
14
15
You'll need to first install and configure the Access Manager Service application.
15
16
16
-
[[Installing the Access Manager Service]]
17
+
* :doc:`Installing the Access Manager Service</getting_started/Installing-the-Access-Manager-Service>`
17
18
18
-
## Choosing the services to use
19
+
20
+
Choosing the services to use
21
+
############################
19
22
Once you've installed AMS, you need to decide if you need to deploy the Microsoft LAPS agent, or the Lithnet Access Manager agent. Use the following table below to map the AMS features you want to use with the agent you need to deploy.
20
23
21
-
|Feature | Requires Microsoft LAPS Agent | Requires Lithnet Access Manager Agent |
22
-
|--- | --- | --- |
23
-
|Access Microsoft LAPS passwords | ✔ | ❌ |
24
-
|Encrypt local admin passwords in the directory | ❌ | ✔ |
25
-
|Store a history of previous local admin passwords in the directory | ❌ | ✔ |
AMS is fully compatible with Microsoft LAPS, but the Access Manager Agent provides advanced functionality not available with the Microsoft LAPS agent. To learn more, read the guide on [[Choosing a local admin password strategy]].
AMS is fully compatible with Microsoft LAPS, but the Access Manager Agent provides advanced functionality not available with the Microsoft LAP[S agent. To learn more, read the guide on :doc:`Choosing a local admin password strategy </planning/Choosing-a-local-admin-password-strategy>`
30
42
31
43
Note, that if the Microsoft LAPS agent is installed and enabled on a machine, the Lithnet LAPS agent will not take over password management. Either the Microsoft LAPS agent needs to be disabled by group policy, or uninstalled.
32
44
33
45
Once you've chosen the features to enable, follow the instructions in the relevant getting started guides.
34
-
- [Setting up Microsoft LAPS](/deploying_features/Setting-up-Microsoft-LAPS)
35
-
- [Setting up password encryption and history](/deploying_features/Setting-up-password-encryption-and-history)
36
-
- [Setting up JIT access](/deploying_features/Setting-up-JIT-access)
37
-
- [Setting up BitLocker access](/deploying_features/Setting-up-BitLocker-access)
38
46
39
-
{ref}`test link<Installing the Access Manager Agent>`
Copy file name to clipboardExpand all lines: docs/getting_started/Installing-the-Access-Manager-Service.md
+3-2
Original file line number
Diff line number
Diff line change
@@ -31,10 +31,10 @@ Click the `Select from store...` button and select the certificate you installed
31
31
32
32
Validate that the ports are correct, and click `File`, then `Save`.
33
33
34
-
[[More information on configuring the web host|WebHostingPage]]
34
+
[More information on configuring the web host](/app_pages/Web-Hosting-Page)
35
35
36
36
## Step 5: Configure your authentication provider
37
-
AMS supports several different authentication providers. Read the guide on [[configuring authentication|AuthenticationPage]] and choose an authentication provider. We strongly recommend using a modern authentication provider that supports strong authentication and can enforce multi-factor authentication. While integrated windows authentication is provided, we recommend you only use this for testing purposes.
37
+
AMS supports several different authentication providers. Read the guide on [configuring authentication](/app_pages/Authentication-Page) and choose an authentication provider. We strongly recommend using a modern authentication provider that supports strong authentication and can enforce multi-factor authentication. While integrated windows authentication is provided, we recommend you only use this for testing purposes.
38
38
39
39
The following pages will guide you through the process of configuring the relevant authentication provider for use with Access Manager.
40
40
@@ -66,6 +66,7 @@ In order to ensure that your service is not used inappropriately, you can place
If you put AMS behind a reverse proxy or load balancer, you'll need to configure IP address detection. This is to ensure that AMS logs the correct IP address in audit logs, and applies rate limiting correctly.
70
71
71
72
[More information on IP address detection](/app_pages/IP-Address-Detection-Page)
Copy file name to clipboardExpand all lines: docs/help/Getting-support.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -9,6 +9,6 @@ Search through these help pages, and read the [Frequently asked questions](Frequ
9
9
10
10
If you're unable to find an answer to your problem, then we ask that you raise a new issue here on Github. This helps us keep track of requests and to triage problems appropriately.
11
11
12
-
Please describe the problem in as much detail as possible. If you can, provide screen shots of the issue. Ensure you have captured the [log files](Troubleshooting)) from the time of the event. These logs may contain sensitive information about your environment, so don't upload them to the issue unless you are confident of their contents. If we need to see the log files, we will provide you an email address to send them to once your issue has been triaged.
12
+
Please describe the problem in as much detail as possible. If you can, provide screen shots of the issue. Ensure you have captured the [log files](Troubleshooting) from the time of the event. These logs may contain sensitive information about your environment, so don't upload them to the issue unless you are confident of their contents. If we need to see the log files, we will provide you an email address to send them to once your issue has been triaged.
13
13
14
14
[Create a new issue](https://github.com/lithnet/access-manager/issues/new)
Copy file name to clipboardExpand all lines: docs/planning/Preventing-lateral-movement-with-Access-Manager.md
+6-2
Original file line number
Diff line number
Diff line change
@@ -37,10 +37,14 @@ One of the simplest to achieve technically, that has a high degree of effectiven
37
37
38
38
While this sounds scary, Access Manager takes the technical complexity away from making such a change. Your administrators of course, will need to adapt to a new way of working, so getting appropriate buy-in from senior management is important. Like the other mitigations, it's not foolproof, and it's not perfect. It is however a relatively low complexity solution, that offers a high value.
39
39
40
-
The theory behind this approach, quite simply, is that if a computer is compromised, and the user is a local admin on that computer but no where else, then lateral movement with that account becomes very difficult. So instead of having all your admins as members of the local administrators group, you assign them 'just-in-time access' (JIT) rights in Access Manager. When they need to access a computer, they visit the Access Manager web site, request JIT access to the computer, and Access Manager will grant them the appropriate rights for the length of time you allow. They can then logon to the server, and perform whatever work they need to, just as they did before. You can read more about exactly[how Access Manager performs just-in-time access](/deploying_features/Setting-up-JIT-access).
40
+
The theory behind this approach, quite simply, is that if a computer is compromised, and the user is a local admin on that computer but no where else, then lateral movement with that account becomes very difficult. So instead of having all your admins as members of the local administrators group, you assign them 'just-in-time access' (JIT) rights in Access Manager. When they need to access a computer, they visit the Access Manager web site, request JIT access to the computer, and Access Manager will grant them the appropriate rights for the length of time you allow. They can then logon to the server, and perform whatever work they need to, just as they did before. You can read more about exactly[how Access Manager performs just-in-time access](/deploying_features/Setting-up-JIT-access).
41
41
42
42
The difference here is that they are entitled to be an administrator of the computers you specify in the Access Manager configuration tool, but they only get promoted to administrator when they need and request it.
43
43
44
44
This means that at any single point in time, you have relatively few users with admin rights across your fleet of computers, drastically reducing the ability for an attacker to spread across the fleet.
45
45
46
-
It is important to note at this point, that Access Manager is not a fully-fledged Privileged Access Management (PAM) tool. There are no approval workflows. You determine in advance who can access which computer, and they can self-grant those privileges at any time. There are plenty of commercial PAM solutions out there if you want to control who and when people can access certain resources. We're not trying to fix that problem. We just want our admins to be admins only when they need to do admin work.
46
+
It is important to note at this point, that Access Manager is not a fully-fledged Privileged Access Management (PAM) tool. There are no approval workflows. You determine in advance who can access which computer, and they can self-grant those privileges at any time. There are plenty of commercial PAM solutions out there if you want to control who and when people can access certain resources.
47
+
48
+
We're not trying to fix that problem.
49
+
50
+
We just want our admins to be admins only when they need to do admin work.
0 commit comments