NETWRIX PASSWORD EXPIRATION NOTIFIER

Transcription

1 NETWRIX PASSWORD EXPIRATION NOTIFIER ADMINISTRATOR S GUIDE Product Version: 3.3 January 2013

2 Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment from NetWrix Corporation of any features or functions discussed. NetWrix Corporation assumes no responsibility or liability for the accuracy of the information presented, which is subject to change without notice. NetWrix is a registered trademark of NetWrix Corporation. The NetWrix logo and all other NetWrix product or service names and slogans are registered trademarks or trademarks of NetWrix Corporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners. Disclaimers This document may contain information regarding the use and installation of non-netwrix products. Please note that this information is provided as a courtesy to assist you. While NetWrix tries to ensure that this information accurately reflects the information provided by the supplier, please refer to the materials provided with any non-netwrix product and contact the supplier for confirmation. NetWrix Corporation assumes no responsibility or liability for incorrect or incomplete information provided about non-netwrix products NetWrix Corporation. All rights reserved. Page 2 of 31

3 Table of Contents 1. INTRODUCTION Overview How This Guide is Organized PRODUCT OVERVIEW NetWrix Password Expiration Notifier Workflow Licensing Information CONFIGURING MANAGED OBJECT Creating New Managed Object Modifying Managed Object CONFIGURING GLOBAL SETTINGS Configuring Report Delivery Schedule Configuring Settings DATA COLLECTION, NOTIFICATIONS AND REPORTS Running Data Collection Viewing Task Session Results Notifications On-demand Report ADDITIONAL CONFIGURATION Editing Report Delivery Schedule Including and Excluding Data from Reports A APPENDIX: RELATED DOCUMENTATION Page 3 of 31

4 1. INTRODUCTION 1.1. Overview This guide is intended for system administrators and integrators who are going to install and configure the Enterprise Edition of NetWrix Password Expiration Notifier. From this guide you will learn: What functionality NetWrix Password Expiration Notifier provides; How to configure options and settings available in NetWrix Password Expiration Notifier; How to start using NetWrix Password Expiration Notifier and view reports. Note: This document does not cover NetWrix Password Expiration Notifier installation. For product requirements and installation instructions, please refer to NetWrix Password Expiration Notifier Installation Guide How This Guide is Organized Chapter 1 Introduction: the current chapter. It explains the purpose of this document and its structure. Chapter 2 Product Overview: gives a description of the product key features and workflow, and provides license information. Chapter 3 Configuring Managed Object: provides instructions on how to create and modify Managed Objects to monitor accounts and/or passwords expiration. Chapter 4 Configuring Global Settings: provides instructions on how to configure the settings that will be applied to all existing Managed Objects and all NetWrix features enabled for these objects. Chapter 5 Data Collection, Notifications and Reports: provides a description of the data collection process, notifications and reports. Chapter 6 Additional Configuration: provides a description of the additional configuration options available in NetWrix Password Expiration Manager. Appendix: Related Documentation contains a list of all documentation published to support NetWrix Password Expiration Manager. Page 4 of 31

5 2. PRODUCT OVERVIEW NetWrix Password Expiration Notifier Administrator s Guide Password expiration is a common reason of many IT support queries. Passwords that are not changed in time can cause numerous help-desk calls and productivity losses. Windows automatically notifies users about impending password expiry on interactive logon, but in some scenarios (for example, when users have Active Directory accounts only for VPN, Outlook Web Access (OWA) and file shares) users never log on interactively, and, therefore, do not receive the standard Windows notification. NetWrix Password Expiration Notifier periodically checks which domain accounts and/or passwords are to expire in a specified number of days, and sends notifications to users via or text messages (SMS). It also generates summary reports that can be delivered to the system administrators and users managers. NetWrix Password Expiration Notifier monitors which domain accounts and/or passwords are to expire in a specified number of days, and sends notifications to users via or text messages (SMS). It also generates summary reports that can be delivered to the system administrators and users managers NetWrix Password Expiration Notifier Workflow NetWrix Password Expiration Notifier collection and reporting workflow is as follows: 1. The user runs the program and sets parameters for the automated data collection and reporting on: Password expiry Account expiry 2. A dedicated scheduled task which is launched periodically (daily at 3:00 AM by default; it can also be launched manually when needed) collects configuration snapshots and/or audit data, and sends s with summary reports to the specified recipients. 3. Additionally, you can generate and view the on-demand reports via NetWrix Management Console. The following figure illustrates the NetWrix Password Expiration Notifier workflow: Figure 1: The NetWrix Password Expiration Notifier Workflow Chart Page 5 of 31

6 2.2. Licensing Information NetWrix Password Expiration Notifier Administrator s Guide NetWrix Password Expiration Notifier is available in two editions: Freeware Edition and Enterprise Edition. The table below outlines the difference between them: Table 1: The NetWrix Password Expiration Notifier Editions Feature The Freeware Edition The Enterprise Edition Alerting users about upcoming password expiration Alerting managers of users about expiring passwords for their direct reports Alerting and reporting about expiring accounts (in addition to expiring passwords) 3 configurable reminders, such as 9 days, 7 days and 2 days before password expiration Supports Windows Server 2008 Fine Grained Password Policies customization No, template-based, with references to AD user account attributes, such as name, title, department and so on Daily summary reports sent to administrators by Plan & Test feature to see how many users will be affected by planned password reset tools, such as NetWrix Password Manager Integration with self-service password reset tools, such as NetWrix Password Manager Automatically runs in unattended mode on schedule to alert users and send reports Non-intrusive no changes in AD schema or system configuration are required No Scope of monitoring Single AD domain Multiple domains and/or OUs Works in a non-trusted AD domain environment Filtering capabilities By account name By account name, by AD organizational unit, by group SMTP Server authentication No Secure Sockets Layer encrypted connection (SSL) No User text message (SMS) notification No Enterprise-class scalability Limited Full, including the ability to create a separate Managed Object to OU Page 6 of 31

7 Integrated interface for all NetWrix products which provides centralized configuration and settings management Single installation handles multiple domains and OU, each with its own unique settings No No Technical support Support Forum, Knowledge Base Licensing Free of charge for up to 300 AD users Full range of options (phone, , submission of support tickets, Support Forum, Knowledge Base) Per AD account or volume license, please see our pricing information or request a quote The Freeware Edition can be used by companies and individuals for an unlimited period of time, at no charge. The Enterprise Edition can be evaluated free of charge for 20 days. Note: You are eligible for free technical support during the evaluation period of all NetWrix products. If you encounter any problem or would like to get assistance with installation, configuration or implementation of NetWrix Password Expiration Notifier, please contact NetWrix Technical Support. Page 7 of 31

8 3. CONFIGURING MANAGED OBJECT NetWrix Password Expiration Notifier Administrator s Guide In the full-featured Enterprise Edition all operations are performed via NetWrix Management Console (implemented as an MMC snap-in) which enables flexible configuration and management capabilities. With NetWrix Management Console, you can: Handle numerous Managed Objects with a single installation; Manage all NetWrix products configuration and settings via an integrated interface; Enable settings for Managed Objects in bulk, for example, specify report generation frequency. To launch NetWrix Password Expiration Notifier, navigate to Start All programs NetWrix Password Expiration Notifier (Enterprise Edition). The NetWrix Management Console main page will be displayed: Figure 2: NetWrix Management Console 3.1. Creating New Managed Object In NetWrix Password Expiration Notifier, Managed Object is an Active Directory domain or organizational unit (OU) that you monitor for expiring passwords and/or accounts. After you have installed NetWrix Password Expiration Notifier, you will need to create a new Managed Object and perform its initial configuration. Procedure 1. To create and configure new Managed Object 1. In NetWrix Management Console, select the Managed Objects node in the left pane. The Managed Objects page will be displayed on the right. 2. In the right pane, click Create New Managed Object. Alternatively, right-click the Managed Objects node on the left and select New Managed Object: Page 8 of 31

9 Figure 3: The Managed Objects Page Note: You can group Managed Objects into folders. To do this, right-click the Managed Objects node, select New Folder, specify the folder name, and then create a new Managed Object in this folder. You cannot move existing Managed Objects into the folders once they have been created. 3. The New Managed Object Wizard will open. On the Select Managed Object Type screen, select the type of your Managed Object. Select Domain to monitor a whole Active Directory domain, or Organizational Unit to monitor a single OU from your domain. Click Next. Figure 4: Select Managed Object Type Note: If you have already installed other NetWrix change reporting products, the list of the managed object types may contain several options. NetWrix Password Page 9 of 31

10 Expiration Notifier only monitors domains and organizational units as managed object types. 4. On the Default Data Processing Account screen, click the Specify Account button to set a default account (<domain name>\<account name>). This account will be used by NetWrix Password Expiration Notifier for data collection and reports generation: Figure 5: Default Data Processing Account When selecting the account, remember that it must be granted the local administrator role for tasks creation and saving the configuration changes and the domain user role for data gathering. You can change the default data processing account later if needed. To change the account for all Managed Objects in bulk, navigate to the Management Console tree, expand the Settings node and select Schedule. On the Report Delivery Schedule page on the right, click Change to open the Default Data Processing Account dialog and edit the account credentials: Figure 6: Default Data Processing Account To change the default data processing account for each Managed Object individually, select the required Managed Object in the Management Console tree, right-click it and select Properties. On the Managed Object Properties dialog, enter new credentials: Page 10 of 31

11 Figure 7: Managed Object Properties 5. On the Configure SMTP Server Settings screen, specify settings that will be used by the program to send reports: Figure 8: Configure SMTP Server Settings If you have already installed other NetWrix change reporting products, and specified the default account and settings during their configuration, these steps of the wizard will be omitted. The following SMTP Server settings are available: Parameter Server name Port Sender Use SMTP authentication User name Password Use Secure Sockets Layer Table 2: SMTP Server Settings Description Enter your SMTP server name. Specify your SMTP server port number. Enter the address that will appear in the From field of the s with summary reports Select this check box if your mail server requires SMTP authentication. Specify SMTP user name. Specify SMTP password. Select this check box if your SMTP server requires SSL to be Page 11 of 31

12 encrypted connection (SSL) Use Implicit SSL connection mode enabled. Select this check box if implicit SSL mode is used, which means that SSL connection is established before any data is sent. 6. On the next step, specify the domain or organizational unit name and select the Management Account for the Managed Object. You can leave the default account as Management Account (the one you have set as the default data processing account), or use a specified account: Figure 9: Specify Domain Name 7. On the Enable Features screen, select the Password Expiration Notifier feature to monitor your Managed Object: Figure 10: Enable Features Page 12 of 31

13 Note: The Installed Features list contains all features that can be used to monitor your Managed Object type. If you have other NetWrix change auditing products installed, the list may contain several items. The Available Features list contains all features which have not yet been installed but can be downloaded and configured for the selected Managed Object type. Select a feature to get additional information about it on the NetWrix website and download an available product version. 8. On the Configure Password Expiration Notifier Parameters screen, define the required settings: Figure 11: Configure Password Expiration Notifier Parameters The parameters you can select are listed in the table below: Parameter Table 3: Send report to administrators: Send report to the users managers List users whose accounts or passwords expire in <> days or less Notify users: Every day if their password expires in <> days or less Password Expiration Notifier Parameters Description Enable this option and specify one or several addresses for administrators to receive daily reports with a list of users whose accounts/passwords are going to expire in the specified number of days. Use period or semicolon to separate several addresses. NOTE: To check the correctness of the address, click Verify. The system will send a test message to the specified address and will inform you if any problems are detected. Enable this option for reports to be delivered to the users group managers. The managers are specified in the Managed By tab of the AD users group Properties dialog. NOTE: To edit the report template, click the Customize button. Specify the expiration period for accounts and/or passwords to be included in the administrators and managers reports. Select the option to notify users that their passwords and/or accounts are about to expire. Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days Page 13 of 31

14 before the expiration date. NOTE: To edit the report template, click the Customize button. First time when their password expires in <> days Notify users by every day if their account expires in: Filter users by organizational unit Filter users by group Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. NOTE: To edit the report template, click the Customize button. Select this option for users to be notified daily that their account is going to expire, and specify the number of days before the expiration date. To monitor users for expiring accounts/passwords that belong to certain organizational units within your Active Directory domain, select this option and click the Select OUs button. In the dialog that opens, specify the OUs that you want to monitor. Only users belonging to these OUs will be notified and included in the administrators and managers reports. To monitor users for expiring accounts/passwords that belong to certain groups within your Active Directory domain, select this option and click the Select OUs button. In the dialog that opens, specify the groups that you want to monitor. Only users belonging to these groups will be notified and included in the administrators and managers reports. 9. On the Completing the New Managed Object Wizard screen, check the details and click Finish. Figure 12: Completing the New Managed Object Wizard As a result, you will be presented with the message informing you about the successful configuration completion: Page 14 of 31

15 Figure 13: NetWrix Management Console Message The Managed Object you have created will appear under the Managed Objects node in the left pane of NetWrix Management Console. The Managed Object details will be displayed in the right pane: Figure 14: The New Managed Object Page The Managed Object page displays the following options: Add/Remove Features: Click this button to add or remove some particular feature for this Managed Object. Run: Click this button to manually launch the data collection task. Stop: Click this button to stop the data collection process Modifying Managed Object You can modify a Managed Object in the following ways: By adding or removing a feature for the Managed Object. To do this, click the Add/Remove Features button on the Managed Object page and follow the Managed Object wizard steps. By modifying NetWrix Password Expiration Notifier settings for the Managed Object. To do this follow the procedure below: Procedure 2. To configure NetWrix Password Expiration Notifier Advanced Settings Page 15 of 31

16 1. In the left pane of NetWrix Management Console, expand the Managed Objects node, expand the node of the required Managed Object and select Password Expiration Notifier. The page with general feature settings will be displayed on the right: Figure 15: Password Expiration Notifier Advanced Settings 2. Modify the required settings. The settings are described in the Table 3: of Procedure 1 To create and configure new Managed Object. 3. On the Password Expiration Notifier page, you can modify advanced settings of the product. Click the Configure bottom button to access the advanced settings: Figure 16: Advanced Settings Page 16 of 31

17 4. The following parameters are available: Parameter Customize the report template Include data on expiring accounts in reports Ignore users with Change password at next logon option enabled Ignore users with Password never expires option enabled Ignore users who do not have accounts Ignore users whose passwords have already expired Filter by account name Specify the account that will be used for data collection from the managed domain User name Password Only report on users with Fine Grained Policy settings Table 4: 5. Click OK to save the changes. NetWrix Password Expiration Notifier Administrator s Guide Advanced Settings Description To modify the administrator report template, click the Edit button next to this option. Select this option for the administrator and manager reports to contain information not only on expiring passwords, but also on expiring accounts. Select this option to exclude users with the Change password at next logon option enabled from the administrator and manager reports. Select this option to exclude users with the Password never expires option enabled from the administrator and manager reports. Select this option to exclude users who have no accounts from the administrator and manager reports. Select this option to exclude users whose passwords have already expired from the administrator and manager reports. Select this option to filter users included in the administrator and manager reports by their account names. Select this option to use a specific account to access data from this domain (other than the domain you have specified as the default account in step 4 of Procedure 1 To create and configure new Managed Object). Enter the Access Account name. Enter the Access Account password. Select this option to exclude all users from the administrator and manager reports except for the users with Fine Grained Policy Settings. Page 17 of 31

18 4. CONFIGURING GLOBAL SETTINGS NetWrix Password Expiration Notifier Administrator s Guide NetWrix Management Console provides a convenient interface for configuring the settings that will be applied to all existing Managed Objects and all NetWrix features enabled for these objects. This chapter provides detailed instructions on how to configure the global settings. To access the global settings configuration options, expand the Settings node in the left pane. The Settings page with available options will be displayed on the right: Figure 17: Settings Page The following global settings are available in NetWrix Password Expiration Notifier: Report Delivery Schedule Settings The Repository and Reporting option labels are displayed on the Settings page; however the options are only available if you have other NetWrix change auditing products installed Configuring Report Delivery Schedule To access the schedule settings, click Schedule on the Settings page or select the Schedule node under the Settings node in the left pane: Page 18 of 31

19 Figure 18: The Report Delivery Schedule Settings Page By default, data collection and report delivery is scheduled to run daily at 3:00 AM. To edit or add a new scheduled task, click Change. If you want the task to run from a specific account, modify the Default Processing Account by clicking the corresponding Change button Configuring Settings The Settings option allows configuring the SMTP settings used to deliver reports to the specified recipients. Procedure 3. To configure Settings 1. In NetWrix Management Console, select Settings under the Settings node, or click Settings on the Settings page in the right pane. The following page will be displayed showing the current settings: Figure 19: The Settings Page Page 19 of 31

20 2. Click the Configure button in the right pane. The following dialog will be displayed: Figure 20: SMTP Settings Dialog 3. In the Configure SMTP Settings dialog you can modify the following settings: Page 20 of 31

21 Server name Port Sender Parameter Use SMTP authentication User name Password Use Secure Sockets Layer encrypted connection (SSL) Use Implicit SSL connection mode Table 5: Settings Description Enter your SMTP server name. Specify your SMTP server port number. Enter the address that will appear in the From field of the messages with reports and notifications. Select this check box if your mail server requires SMTP authentication. Enter the user name for SMTP authentication. Enter the password for SMTP authentication. Select this check box if your SMTP server requires SSL to be enabled. Select this check box if implicit SSL mode is used, which means that SSL connection is established before any data is sent. 4. Click OK to save the changes. Page 21 of 31

22 5. DATA COLLECTION, NOTIFICATIONS AND REPORTS This chapter provides instructions on how to perform data collection and generate reports using NetWrix Management Console Running Data Collection By default, NetWrix Password Expiration Notifier performs data collection (scans the monitored objects for expiring accounts and/or passwords) and generates reports daily at 3:00 AM. To modify the data collection and report generation schedule, refer to Section 4.1 Configuring Report Delivery Schedule. To start the data collection task manually, expand the Managed Objects node in NetWrix Management Console, select your Managed Object and click Run on the Managed Object page in the right pane: Figure 21: The Managed Object Page Then the audit data will be collected and reports will be sent by to the specified recipients. The task session information can be examined using NetWrix Management Console, as described in Section 5.2 Viewing Task Session Results Viewing Task Session Results All task operation information is shown in NetWrix Management Console under the Sessions node. To view the session details, expand the Managed Object node in the Console left pane, then navigate to <your Managed Object> node Password Expiration Notifier Sessions and pick a particular session. The Session page will be displayed with the details and options available: Page 22 of 31

23 Figure 22: Session Details For each selected session, you can review the following information: Session status: Success, Warning, or Error. Error occurs if data collection failed to start due to an incorrect account or other reason specified in the Error Text grid on the Session page. Description: the name of the feature that processed data during the selected session, Password Expiration Notifier. Managed Object: the Managed Object name. Error Text: the text of an error if occurred Notifications After each data collection, NetWrix Password Expiration Notifier sends notifications to the users whose passwords and/or accounts are about to expire. Below is an example of a user notification: Figure 23: Notification Example Page 23 of 31

24 You can modify notification settings and templates of the Notify users section via the Password Expiration Notifier page of the required Managed Object. Figure 24: The Password Expiration Notifier Settings For details, refer to Procedure 2 To configure NetWrix Password Expiration Notifier Advanced Settings On-demand Report You can run an on-demand report at any time to receive information on the users whose passwords and/or accounts are about to expire. Procedure 4. To run an on-demand report 1. In NetWrix Management Console, expand the Managed Objects node <your_managed_object_name> Password Expiration Notifier Ad-hoc Reports. The following page will be displayed: Page 24 of 31

25 Figure 25: The Ad-hoc Report Page 2. Click the Run button. The following dialog will be displayed where you can specify maximum password age to filter the report data: Figure 26: Maximum Password Age Settings 3. Select one of the following options: Use the domain policy settings. The report will contain data on the users whose passwords and/or accounts are about to expire in accordance with the domain policy settings. Specify the maximum password age. The report will contain data on the users whose passwords and/or accounts are about to expire after a period specified in the dialog. 4. Click OK. After the report has been generated, it will be shown in your default web browser: Page 25 of 31

26 Figure 27: Ad-hoc Report Page 26 of 31

27 6 ADDITIONAL CONFIGURATION The following additional configuration options are available: Editing Report Delivery Schedule Including and Excluding Data From Reports 6.1 Editing Report Delivery Schedule NetWrix Password Expiration Notifier Administrator s Guide You can set a particular task schedule for all Managed Objects in bulk, or fine-tune scheduled tasks for each Managed Object individually. For details on how to set a task schedule for all Managed Objects, refer to Section 4.1 Configuring Report Delivery Schedule. To edit a scheduled task for your Managed Object in Windows 2008, follow the procedure below. NetWrix Password Expiration Notifier uses a standard Windows scheduled task called NetWrix Management Console - Password Expiration Notifier domain/ou. Procedure 5. To edit scheduled task in Windows Navigate to the Start menu Administrative Tools Task Scheduler and select the required NetWrix Management Console task. Figure 28: Task Scheduler 6. Double-click the task, and go to the Triggers tab on the displayed Properties form. Click the Edit button. Page 27 of 31

28 Figure 29: Task Properties 7. On the Edit Trigger form, define the required settings to fine-tune your task schedule. Figure 30: Edit Trigger Procedure 6. To edit scheduled task in Windows Navigate to the Start menu Settings Control Panel Scheduled Tasks and select the NetWrix Management Console task. The scheduled task dialog will appear: Page 28 of 31

29 Figure 31: NetWrix Scheduled Task 9. Go to the Schedule tab to define the required task period and time settings. Figure 32: NetWrix Scheduled Task 10. Click Advanced to access the advanced schedule options. Page 29 of 31

30 Figure 33: Advanced Schedule Options 11. Click OK to apply the changes and close the form. Configuration via global Settings will affect all Managed Objects. 6.2 Including and Excluding Data from Reports To fine-tune data collection and reporting, you can change the omitoulist.txt configuration file located in the product installation folder. To exclude some particular organizational units from your reports, add their names to the file. Add one name entry per line, wildcards are allowed. Page 30 of 31

31 A APPENDIX: RELATED DOCUMENTATION NetWrix Password Expiration Notifier Administrator s Guide The table below lists all documents available to support NetWrix Password Expiration Notifier: Table 6: Document Name NetWrix Password Expiration Notifier Administrator s Guide NetWrix Password Expiration Notifier Installation Guide NetWrix Password Expiration Notifier Quick-Start Guide Product Documentation Overview The current document provides detailed instructions on how to configure and use NetWrix Password Expiration Notifier. The guide provides system requirements and installation instructions. The guide provides instructions on how to start working with the program quickly and easily. Page 31 of 31