Quest Access Manager 1.6. Quick Start Guide

Transcription

1 Quest Access Manager 1.6 Quick Start Guide

2 2010 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Quest Software, Inc. The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA USA legal@quest.com Refer to our Web site for regional and international office information. Patents This product includes patent pending technology. TRADEMARKS Quest, Quest Software, the Quest Software logo, and ActiveRoles, are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. Other trademarks and registered trademarks used in this guide are property of their respective owners. Third Party Contributions Quest Access Manager contains some third party components (listed below). Copies of their licenses may be found on our website at COMPONENT LICENSE OR ACKNOWLEDGEMENT Agent and Server zlib Agent Boost Agent/Server/Client Windows Installer XML toolset (aka WIX) Server/Client Microsoft Enterprise Library 3.1 (May 2007) Contains software or other content adapted from Microsoft patterns & practices ObjectBuilder, 2006 Microsoft Corporation. All rights reserved. Access Manager Quick Start Guide Updated - November 2010 Software Version - 1.6

3 Contents CONTENTS About This Guide Quest Access Manager Overview Software, System, and Account Requirements Getting Started with Quest Access Manager Installing Access Manager Updating Quest Access Manager Deploying Access Manager Add a Forest Add a Domain Add a Computer (Managed Host) Add a Cluster (Managed Host) to the Deployment Add a Remote Agent to a Managed Host License a Domain Delegate Access to the Management Server Integrating Access Manager with Active Directory Users and Computers or Quest ActiveRoles Server Step-By-Step Walkthrough Investigating and Modifying Resource Access Gathering Group Membership Information About Quest Software, Inc Contacting Quest Software Contacting Quest Support i

4 Quest Access Manager ii

5 Quick Start Guide About This Guide This document has been prepared to assist you in becoming familiar with Quest Access Manager, an integral component of Quest Windows Management Suite. The Quick Start Guide contains the information required to install and use this product. This document is for network administrators, consultants, analysts, and any other IT professionals responsible for deploying Access Manager in their organization. It provides information about system requirements, licensing and installation, and includes scenarios with step-by step instructions to help you better understand Access Manager functionality. The Quick Start Guide is supplemented with the Quest Access Manager User Guide, which provides more detailed information about the Access Manager user interface and features, and includes instructions to help administrators perform day-to-day administrative activities. 1

6 Quest Access Manager Quest Access Manager Overview This document has been prepared to assist you in becoming familiar with Quest Access Manager, a Quest Windows Management Suite product. It is intended for network administrators, consultants, analysts, and any other IT professionals using the product. The management of computer resources is a complex and time-consuming process. There are numerous manual steps and disconnected management applications that must be leveraged before a resource can be safely deployed and made accessible to the appropriate users. Once deployed, there are concerns that granted access is neither increased nor removed inadvertently. To exacerbate this challenge in many organizations, the content owners have to rely on IT administrators to manage resource access without knowing the implications of their actions. Ultimately, this leaves an organization unable to maintain operational efficiency or sustain continuous compliance. Quest s Solution Quest Access Manager takes the following approach to meet the challenge: Unify resource management Access Manager allows you to view overall resource access both directly applied access and access obtained through group membership. Without this information, visibility is limited and could result in security breaches through inadvertent access. Evaluate resource access Access Manager provides a real-time view of network resource access and provides an immediate and ongoing ability to modify resource access. This helps enforce your corporate network access policy. 2

7 Quick Start Guide Software, System, and Account Requirements Access Manager consists of three main components: the Management Server, the Client, and the Agent. Figure 1: Access Manager Deployment For more information on Access Manager s key components and concepts, see Quest Access Manager User Guide. Review the following section to ensure that you meet all rights and permission requirements. Server Requirements To configure an Access Manager Management Server, the user must belong to the Administrators group of the computer hosting the Management Server. System Requirements: Windows Server 2003, Windows Server 2003 R2, Windows Server 2008 or Windows Server 2008 R2 (32 bit or non-itanium 64 bit) 1 Ghz+ Processor 1024 x768 screen resolution with 16-bit color 1 Gb free disk space 2 Gb RAM Quest provides both 32-bit and 64-bit servers for Quest Access Manager. Ensure that the server installed on a given computer uses the correct server to match the installed operating system. 3

8 Quest Access Manager Software Requirements:.Net 3.5 Service Pack 1 or later An SQL 2005, SQL 2008, or SQL Express database server that is contacted by the Management Server MMC 3.0 Account Requirements: The account used must be an administrator of the computer on which you are installing the Management Server The account used must have credentials to create a database on the SQL server used by the Management Server The account used must have the credentials to be used as a Service Account for your initial Managed Domain. Consult the Access Manager User Guide for more information on the rights required by this account. Client Requirements System Requirements: Windows XP, Vista, 2003, 2008, Windows 7 (32 bit or non-itanium 64 bit) 1 Ghz+ Processor 1024 x 768 screen resolution with 16-bit color 100 Mb free disk space 1 Gb RAM Quest provides both 32-bit and 64-bit clients for Quest Access Manager. Ensure that the client installed on a given computer uses the correct client to match the installed operating system. Software Requirements:.Net 3.5 Service Pack 1 or later MMC 3.0 Agent Requirements System Requirements: Update Rollup 1 for Windows Server 2000 with Service Pack 4, Windows Server 2003, Windows Server 2008 (32 bit or non-itanium 64 bit) 500 Mhz+ Processor 256 Mb RAM 100 Mb free disk space for every 1,000,000 files / folders scanned. 4

9 Quick Start Guide Quest ActiveRoles Server Web Integration Components Requirements Software Requirements: IIS 6.0 or IIS 7.0 ActiveRoles Server 6.1 or 6.5 Web Components.Net 3.5 Service Pack 1 or later Microsoft Internet Explorer 6.x or 7.x 5

10 Quest Access Manager Getting Started with Quest Access Manager To deploy Access Manager you must have the following in place: Server Installation The server is the central hub for communication and therefore should be installed on a reliable and secured computer. It is important that the Administrators group on the Management Server be very secure in order to ensure the protection of the encryption key. Server Configuration/Database Creation Before the server is operational, a SQL database must be created for its use. Domain Identification and Service Account Credentials Before you can start managing resources you must first identify the domains where those resources reside (Managed Domains), and provide credentials (Service Account) that can perform operations on those resources. You will be prompted to register a domain and Service Account with Access Manager when you initially configure an Access Manager deployment during the installation. Computer Identification Before you can start managing resources, you must add computers (Managed Hosts) to the deployment. Client Installation To use the Access Manager MMC client to access the application, the user must be delegated access through deployment security. For more information, see Delegate Access to the Management Server on page 13. Once the Client and Server are installed and configured, domains have been added, computers have been added, and access has been delegated, users can start gathering security information on the enterprise resources. Installing Access Manager To install Access Manager 1. From the Autorun, select the Quest Access Manager tab, click Quest Access Manager Server (32 bit) or Quest Access Manager Server (64 bit), and follow the installation instructions. 2. Click Next. 3. Read and accept the license information and click Next. 4. Enter a location for the install and click Next. 5. Click Install. 6. Click Finish. 6

11 Quick Start Guide The Quest Access Manager client will open. 7. Enter the name of the Management Server and confirm that the port number is Click Connect. The default port is 8722 and should not be changed. If you need to alter the port number, contact Quest Support for more information. A dialog box indicating that the Management Server is not configured will appear. 8. Click Yes The Configuration Wizard opens to guide you through the Management Server setup. 9. Specify a valid license and click Next. 10. Specify the database server, database name, enter the database access credentials, and click Next. These credentials are used both for database creation and subsequent access. 11. Enter the Deployment name and the required Deployment Key information, and click Next. 12. Enter the initial Managed Domain (a domain that has an associated Service Account, in which you can manage resources), the Service Account credentials, and click Next. The Service Account information is used by the server to take actions within the domain. The Service Account credentials should have Administrative access to the Managed Domain, and must have the rights to log on locally to the Management Server computer. 13. Review the Summary page, and click Finish. Updating Quest Access Manager The process of updating Quest Access Manager has been made as easy as possible. During the uninstallation of your current version, the option to retain database information regarding the current deployment allows you to simply update the Access Manager software without losing any data. SPECIAL UPGRADE CONSIDERATIONS You must uninstall previous installations of Quest Access Manager before installing Quest Access Manager 1.6. You must upgrade the client to version Upgrading directly from Quest Access Manager 1.0 to Quest Access Manager 1.6 is not supported. The supported upgrade paths are only 1.5+ to 1.6 (and 1.6.1). To update from Quest Access Manager 1. Remove Quest Access Manager from the server. (Select Add or Remove Programs from the Windows Control Panel.) 2. Select Quest Software Quest Access Manager, and follow the uninstall directions. 3. Select I am upgrading and want to leave my deployment intact. 4. When the previous version of Quest Access Manager has been uninstalled, insert the Quest Access Manager CD and allow the Autorun to run. 5. From the Autorun, select the Setup tab, click Quest Access Manager Server (32 bit) or Quest Access Manager Server (64 bit), and follow the installation instructions. The Quest Access Manager client will open. 7

12 Quest Access Manager 6. Enter the name of the Management Server, confirm that the port number is 8722, and click Connect. The default port is 8722 and should not be changed. If you need to alter the port number, contact Quest Support for more information. If you are installing to the same path, the update process is complete. If not, a dialog box indicating that the Management Server is not configured opens. 7. Click Yes. The Configuration Wizard opens to guide you through the Management Server setup. 8. Browse to the location of your license file, select it, and click Next. 9. Select the database server and specify the database to upgrade. 10. Supply the necessary credentials and click Next. 11. If the deployment key is not found in the new installation path (for example, you are installing the Management Server to a new location, or you are upgrading a previously 32 bit Management Server on a 64-bit OS), browse to find your backup deployment key, enter your passphrase, and click Next. As of version of Access Manager, it is possible to connect a server to an existing database without a backup of the deployment key information and its associated passphrase. However, when this operation is performed, all service account password information held in the Access Manager database is lost, and must be re-entered. You may be prompted to restart the Management Server during the configuration process. If you are prompted more than once to restart the server, click the drop-down button in the bottom-left of the dialog box to view an error report. 12. Review the summary information, and click Finish. Once the application has been upgraded, the agents scanning the managed hosts will no longer be able to communicate with the server. The agents must be updated to the same version as the application. Update Agents If the agent version that you are running is less than the current installed Management Server, you can update the agent quickly from the Access Manager console. When an upgrade is available for an agent, the status of the Managed Host will display as Agent Update Required. To update a locally managed host Right-click the Managed Host, and select Upgrade Agent. Repeat for each host in your deployment. OR Multi-select all the hosts whose agents need to be upgraded, right-click and select Upgrade Agent to upgrade all agents simultaneously. To update a remotely managed host 1. Right-click the Managed Host, and select Managed Host Properties. 8

13 Quick Start Guide 2. Select the Agents tab. 3. Select the agents which have upgrades available. 4. Right-click and select Upgrade Agent. 9

14 Quest Access Manager Deploying Access Manager Add a Forest When you add a Managed Domain and its forest is not already added, Access Manager will automatically register it using the Service Account provided for the domain. You also have the option of registering the forest and providing its own Service Account. To add a forest to the deployment 1. Expand Quest Access Manager, Configuration, and select the Managed Domains nodes. 2. Click in the right-pane, right-click the Managed Domain node, and select Add Forest. 3. Enter the DNS Name, select a Service Account, and select Add. OR Click New to create a new Service Account), and click Next. The Service Account must have sufficient access required to query group membership within the forest. You can right-click a Managed Forest in the right pane to view its properties and change the associated Service Account. 4. Click Finish. Add a Domain To add a domain for management An initial domain is configured during setup. If you would like to add more domains and their associated computers, you will need to register them with Access Manager. When a domain is brought under management, the following operation is performed to ensure Access Manager functions with resources from that domain: An Access Manager container is created in the domain s System container named Quest Access Manager. This container holds a set of Service Connection Point objects, which are used by the components of Access Manager to find one another. Agents and clients use this information to determine where the Management Server they should connect to exists. 1. Expand Quest Access Manager, Configuration, and select the Managed Domains nodes. 2. Click in the right-pane, right-click the Managed Domain node, and select Add Managed Domain. 3. Enter the domain DNS name, and select an existing Service Account to associate with the domain, and click Finish. OR 10

15 Quick Start Guide Enter the domain DNS name, click New to create a new Service Account to associate with the domain, enter the account name and credential, and click Finish. If required at a later date, you can easily associate a different Service Account through the Managed Domains Properties. Add a Computer (Managed Host) Only computers in Managed Domains can be added as Managed Hosts. If you chose to deploy a remote agent to a Managed Host, the remote agent must be configured during the addition of the Managed Host. It is not possible to deploy a remote agent after the host has been added to your deployment. To add a computer for management and deploy an agent to gather information 1. Expand Quest Access Manager, right-click the Managed Hosts node, and select Add Managed Host. 2. Select a locally managed agent to be installed on the target host, and click Next. When you add a Managed Host, you can choose to automatically install an agent with Access Manager or manual installation to defer the agent installation to a later date. By default, these computers will be ready to have the agent installed and will be connected to the server immediately when this is done. If you do not want to automatically install an agent, select Manually Installation in the Agent Deployment box. Note that manual installation of remote agents is not supported. An agent must be configured for the computers to communicate with the server and gather resource information. Until this is done, no resource access will be reported for this computer. 3. Select the domain in which the host resides, select the host, and click Add. Only computers with Windows 2000 Server operating systems or later will be displayed while adding computers to be managed by Quest Access Manager. The agents will now be installed on the selected computers. To view the users and groups associated with the new Managed Host, you need to select the Refresh menu option. You can remove computers from the deployment, by selecting the Managed Host node, right-clicking the required computer, and selecting Remove. 11

16 Quest Access Manager Add a Cluster (Managed Host) to the Deployment Once installed, a managed cluster is functionally identical to a remotely Managed Host. However, the nature of clusters require that they only be managed remotely. Additionally, the remote agent must be configured after the cluster has been added to the deployment as a Managed Host. Only Windows failover cluster configurations are supported. To add a cluster 1. Right-click Managed Hosts, and select Add Cluster Host. 2. Select the Managed Domain containing the cluster from the list. Once the domain has been selected, the wizard will enumerate the clusters available in the domain. 3. Select the cluster to be added to the Managed Domain, and click Finish. The managed cluster has been added to the Managed Domain. However, no agents have been deployed to the managed cluster. Add a Remote Agent to a Managed Host More than one remote agent may be used to scan a Managed Host. This is particularly useful if the host has a large set of data roots. Multiple agents may not scan the same data root, however. The following is for remotely Managed Hosts only: 1. Expand Quest Access Manager and select Managed Hosts. 2. Right-click the Managed Host to which you want to add the remote agent and select Add Agent. 3. Select a host computer from within the same forest as the target computer. 4. Select a service account with sufficient permissions to access the target computer. 5. Define a schedule for the agent to scan the target computer and click Next. 6. To ensure that data remains correct and up to date, select the file system update options. For more information, see Remote Agent Settings in the Access Manager User Guide. 7. Select the data roots that will be indexed by this agent and click Finish. 8. Click Finish. The agent will now be installed on the selected computers. To view the users and groups associated with the Managed Host, you need to select the Refresh menu option. 12

17 Quick Start Guide License a Domain Once a domain is added to the deployment, it is automatically licensed for use and only users, groups, and computers within these domains are available to manage. When a forest is added all domains in the forest are automatically licensed. When the number of enabled users in registered domains exceeds the number of licensed users, you will be notified of the license violation. To correct this violation, contact Quest Sales, and purchase additional licenses, or remove domains from being licensed. Because the license agreement is calculated on the number of licensed users, you can choose to remove the license on those domains that you do not want to query for access information. Only domains that are not managed (for example, external domains that do not have agents deployed or Managed Hosts) can be unlicensed. To remove the license for a specific domain 1. Expand Quest Access Manager, Configuration, and select the Managed Domains node. 2. Right-click the required domain, and select Remove from Management. 3. Select the domain and select Remove License. To license a domain Expand the Managed Domains node, select an unlicensed domain, right-click and select License. Delegate Access to the Management Server When you install Quest Access Manager, only the built-in administrator s group on the computer where the Management Server is installed will have full access default. Before other users can take advantage of Access Manager functionality, they will need to be delegated permission. PERMISSION Application Access Manage Configuration Bypass Active Directory Delegation Allow Directory Browsing Manage Resource Auditing Settings Self-Service Access DESCRIPTION Allows basic read access to Quest Access Manager. This is the base permission required to use Quest Access Manager. Allows users to modify the configuration of Access Manager. Allows users to bypass all Active Directory delegation and grants full access to the application. This includes querying trustee access and local group management features. Permits users to browse licensed domains for trustees to be added to machine local groups. This permission is required for client users to make changes to the SACLs of resources. This permission allows trustees to use Quest Access Manager Self-Service functionality. 13

18 Quest Access Manager Active Directory Permissions When a domain is marked as integrated, Access Manager adds extended right objects to the forest to which the domain belongs. This allows the delegation of rights over various Access Manager operations using native Active Directory delegation. If a user has the "Bypass Active Directory Delegation" permission, then they will not be subjected to any Active Directory access checks any access delegations made in Active Directory are ignored. The following rights are added to each domain in an integrated forest: PERMISSION QAM Query Trustee Access QAM Manage Machine Local Group QAM Read Local Groups QAM Manage Machine Local Admins Group DESCRIPTION This permission is available to users, INetOrgPerson, groups, and computers. If a user has this permission with respect to a user, group, or InetOrgPerson, they will be permitted to see the full access information related to that user or group. This permission is available on computers. Access Manager users are permitted to manage the machine local groups of any computer over which they have been granted this permission. This permission is available on Computers. Access Manager users are permitted to enumerate and view the memberships of computers over which they have been granted this right without being able to natively view those groups. The Manage Machine Local Groups permission allows management of all local groups on the computer except the Administrators group. To manage the Administrators group, the Manage Machine Local Admins Group permission is required. For ActiveRoles Server integration you must have Read access in Access Manager and the running account must have the proper rights in ActiveRoles Server. No actual changes are made within Access Manager for the integration; all changes are made within ActiveRoles Server. To set the level of access 1. From the Access Manager client, right-click the Access Manager node and select Deployment Security. 2. Add and remove users and groups as required, and click OK. Integrating Access Manager with Active Directory Users and Computers or Quest ActiveRoles Server You can manage resources from the Access Manager console, from Active Directory Users and Computers and from Quest ActiveRoles Server once they have been integrated. To access Access Manager functionality from Active Directory Users and Computers, you must have the Access Manager client installed on the computer and register the computer s Active Directory forest. Only forests that are added to the Managed Domains can be registered for Active Directory integration. For details on adding a forest, see To add a forest to the deployment on page 10. When integrating with Active Directory, the credentials of the user running the client are used. The user must have the required permission to modify the contents of the Display Specifiers container in the forest s configuration partition. This is usually only the Enterprise Administrators account. 14

19 Quick Start Guide To integrate with Active Directory Users and Computers 1. Expand Quest Access Manager, Configuration, and select the Managed Domains node. 2. Right-click the forest where the Access Manager extensions will be registered, select Integrate with Active Directory, and click Finish. To integrate Access Manager with ActiveRoles Server MMC Console and Web Client When extending the ActiveRoles Server Web Interface, the Access Manager Web Integration package, ARSWebIntegration.msi, must be installed on all IIS servers hosting the ActiveRoles Server Web Interface. The ARS Web Interface must be run with basic authentication. Integrated authentication is not supported by Quest Access Manager. For ActiveRoles Server integration you must have Read access in Access Manager and the running account must have the proper rights in ActiveRoles Server. No actual changes are made within Access Manager for the integration; all changes are made within ActiveRoles Server. For more information, see Delegate Access to the Management Server on page 13. After upgrading your ActiveRoles Server web components, you must uninstall and re-install the Quest Access Manager Web Integration Package on all upgraded web servers. 1. Expand Quest Access Manager and select the Applications node. 2. Right-click ActiveRoles Server, and select ActiveRoles Server Integration. You have the option of integrating Access Manager capabilities with both the ActiveRoles Server MMC Console and the Web Client. 3. Check the appropriate options and click Apply. For the Access Manager management options to display in the MMC Console, you must have the Access Manager client installed and you will need to restart the Quest ActiveRoles Server service. To view access through the ActiveRoles Server MMC, simply right-click a resource and choose Show Access. For the Access Manager options to display in the Web Client, you will need to select Customization Reload from within the Web Client. To view user and group access through the ActiveRoles Server Web Client 1. Select the Directory Management option in the ActiveRoles Server web client. 2. Select the Menu tab, and the required user or group. 3. Select Show Access. You will see the resources to which the selected user or group has access. As you browse through the access, you will see all the specifics such as whether the access is obtained directly through the ACL or indirectly through group membership, the resource and trustee name, the rights over the resource, and how inheritance has been applied. 4. Right-click to filter the results to remove common built-ins (built-in Administrators and Users groups) and those resources where access is obtained indirectly through group membership. You have the option of customizing the way in which the web client displays and sorts the information. Specifically, you can change the order in which the information is displayed, select the columns to display, and group the information by the column that suits your needs. 15

20 Quest Access Manager Self-Service Request Client The Access Manager Self-Service Request client allows users to request access to resources while maintaining the approval process included in ActiveRoles Server. To allow users to use the Self-Service Access Request client, the Access Manager Self-Service package (QuestAccessManager_SelfServiceClient_x86.msi or QuestAccessManager_SelfServiceClient_x64.msi) must be deployed. You must also configure its options, and delegate the Self-Service Access right.for information on delegating access, see Delegate Access to the Management Server on page 13. For a user to make use of the Access Manager Self-Service functionality, they must be from a forest which is registered in the Managed Domains view, in addition to being granted the right to access self-service on the deployment. To configure the Self Service Client 1. Expand Quest Access Manager, and select the Applications node. 2. Right-click ActiveRoles Server, and select Access Manager Self-Service Configuration. 3. Select to allow users to request access to resources, and enter the ActiveRoles server that will be used to satisfy self-service requests. 4. Select to allow groups that have not been published on the ActiveRoles server. Allowing non-published groups If this option is selected, groups which have not been marked as published within ActiveRoles Server can be included in the list of groups to which a user can request access. When these groups are encountered, the requesting users rights are checked, and the group is only included in their list of available selections if one of the following two criteria is met: The requesting user has the ability to modify the membership of the group. The requesting user has the right to add themselves to the membership of the group granted through ActiveRoles Server. If either of these two rights is held by the user, the group will be presented as a valid option for requesting access. For groups meeting this criteria, if the user has the right through ActiveRoles Server to add themselves to the group, the operation will be attempted, and subjected to any membership modification workflows specified by ActiveRoles Server. If no workflows have been defined, and the user is permitted to modify the membership of the group, they will be automatically added to its membership list. 5. Enter the Help Desk Information that will be displayed to the users. (Help message, Help Desk phone number and address, subject, and body.) 6. Click Apply. To use the Self-Service feature 1. Right-click a folder and selects Request Access. 2. Select either Read or Contribute access. A list of groups, which will grant the user the requested access to the resource, will be displayed. Quest Access Manager uses a variety of criteria to determine suitability for group selection, based on Microsoft s best practices for setting file and folder security in a distributed environment. Under certain conditions, a security group that would give users their requested access may be deemed to be inappropriate and therefore the group will not be displayed as an available option. Please consult Microsoft s documentation for more information. 16

21 Quick Start Guide 3. The user simply clicks the required group, enters a reason to join the group, and clicks OK to send a request to join the group. Should any questions or issues arise, users have the ability to contact the Help Desk for support if an application has been configured on the client. 17

22 Quest Access Manager Step-By-Step Walkthrough Investigating and Modifying Resource Access As people join, depart, and shuffle throughout your organization, you will need to change their access to resources. With Access Manager, you can validate that users and groups have been granted access to all the resources they need, ensure they do not have access to excess resources, and remove their access when required. The following scenario shows how you can locate and remove the access for a particular user who is no longer with your organization. Scenario: Your company has had a contract employee, Joan Bloggins, working within your organization for the last 6 months and the project is now over. While she was on the project, she was granted access to various financial resources located on several servers throughout your network. As the work progressed, so did her access to various files. Access was incremental and not always granted by the same administrator. This resulted in both access being granted through groups and access being granted by placing Joan s account directly in the Access Control List (ACL) of the resource. Now that Joan s work is done, it is your job as the administrator to ensure that her account is removed from the network resources to which she had been granted access. Figure 2: Access Details Joan was working out of the Calgary office and has a series of folders and a share created on the Calgary Server. She has full access to the share and the associated folders. Joan was performing a financial audit and analysis; therefore, she was added to the Financials Reader group in the Canada domain so she could review current financial records stored on the Canada Server. At a corporate level, Joan's account was created and added to the Finance Global Resource Group at the root Acme domain. 18

23 Quick Start Guide To view and manage access 1. Select Start Programs Quest Software Access Manager Quest Access Manager Client. From the Access Manager node you can view the status of current Access Manager deployments within your organization. 2. Enter Joan Bloggins in the Quick Search, and select Start Search. 3. Right-click Joan Bloggins, and select Manage Access. Because user and group access may be the result of several layers of nested groups, the Access Manager console displays group membership, the computers, and resource types where the user or group has both direct access and indirect access by means of group membership. 19

24 Quest Access Manager You can now view the access by selecting the Resource Type in the upper-right pane. With Active Directory native tools (Members of property), you cannot see all domain local group membership in your enterprise and therefore, you are not getting an appreciation for the account s real access. You will also not be able to ascertain access that has been granted explicitly to this specific user. 4. To edit the rights to the selected resource, right-click the resource in the lower pane, select Edit Security, and make the required changes. In this example, we will: Right-click the Financial Analysis share in the Resource Security Editor, and select Remove Selected Permissions to remove Joan from this share. If required, you can also multi-select numerous files, folders, and shares from within the Resource Security Editor at once, right-click and select to remove the user or group access. Select Folders in the top-right pane, to view Joan s access. Through the console we will see that she has access through "Canada-Finance Readers" and "Canada-Finance Full Control" to the Financials folder. This highlights the fact that she was erroneously added to Acme\Finance, as it was not clear that this group had full control to Canada\Financials. Through the Access Manager console, we will also see that Joan has full access to Calgary\Financial Analysis. This type of direct access is sometimes desired when a single user needs access to specific files and shares. However, single user access is difficult to maintain and their visibility may be lost. Access Manager overcomes this limitation. Remove Joan s access from the groups and directly from the ACL. (If the account was simply deleted, unresolved SID in ACLs may result, significantly increasing the time it takes to resolve whether a trustee can gain access to a resource.) 20

25 Quick Start Guide Computer Investigation: Who has Access to a Specific Resource To ensure a computer is secured in a way that meets your business requirements, you must be able to identify who has been given access to resources, and correct any errors. With Access Manager, you can quickly: Determine where users have access and remove it if required Determine access for a user in a particular role within the organization in order to assist you in granting the same access to a new hire Perform a spot check on a particular user to ensure they have the correct access to resources Investigate who appears in the security settings on a specific computer to ensure that corporate policy is being followed Look for computers with high numbers of users, low numbers of groups Locate non-authorized users on a specific computer Remove unresolved SIDs to improve performance and security To view and modify computer access 1. In Active Directory Users and Computers, right-click a computer, and select Manage Access. OR From the Access Manager console, expand a Managed Host. The Access Manager console with Trustee View selected displays the available users and groups who have access to resources on the selected computer. From here, you can view other computers where the selected user or group has access and manage specific access points by right-clicking the user or group, and selecting Manage Access. 21

26 Quest Access Manager From the Manage Access dialog box, you can choose to open the Resource Security Editor (through Edit Security) and alter the permissions as required, or multi-select access and clone, replace, or remove access en masse. You can also right-click a Managed Host and select the Resource View which allows you to view the file system and shares on the selected host. You can then browse through the resources, and modify their security through the Resource Security Editor. 2. For the purpose of this example, we will right-click the resource from the Trustee View, and select Edit Security. From here you can easily edit the share and folder permission, select the auditing options, and alter the resource owner if required. You can also right-click and select to further manage the user or group access, view group membership information, run group membership and trustee access reports, and add or remove users and groups to the resource ACL. 3. Make the required edits and close the Resource Security Editor. 22

27 Quick Start Guide Gathering Group Membership Information When examining and managing the access settings of a user or group, it is necessary to know to which groups they belong. Access Manager provides a comprehensive group membership visualization system to provide the information required to manage user or group access on the network. The Access Manager group membership tree is displayed as an integral part of the information gathered during access queries. The membership tree allows you to see a list of all groups to which a trustee belongs, taking into account group nesting. While similar to the Member Of information maintained in Active Directory for users and groups (which can be seen using the Active Directory Users and Computers MMC snap-in), the information presented in the Access Manager group membership tree is much more complete. In addition to showing group nesting information, it shows domain group membership information, cross-forest group membership, and machine local group memberships of Managed Hosts. Figure 3: Group Membership treeview Detailed View of Group Members Access Manager now provides a hierarchical view of group membership and the recursive list of who is contained in the group. It eliminates the need to navigate through group nesting to identify all group members which ultimately have access to a specific shares, folders, and files. Enterprise group membership information allows you to identify all the groups to which a user belongs and all the members of a particular group. This allows you to quickly see network access to resources and alter it where required. To view group membership for a specific trustee 1. From the Access Manager console, find the required group, right-click, and select Group Members. You will see a hierarchical view of group membership and the recursive list of who is contained in the group. OR 23

28 Quest Access Manager From the Access Manager console, find the required user or group, right-click, and select Manage Access. You will see all the groups that the selected user or group is a member of (both explicitly and indirectly) and the associated access obtained through this group membership. OR From the Access Manager console, find the required group, right-click, and select Group Member of. You will see all the groups that the selected user or group is a member of (both explicitly and indirectly). 2. You can now choose to manage the access where required or run reports that detail the access and membership for the selected group or trustee. 24

29 Quick Start Guide About Quest Software, Inc. Now more than ever, organizations need to work smart and improve efficiency. Quest Software creates and supports smart systems management products helping our customers solve everyday IT challenges easier and faster. Visit for more information. Contacting Quest Software Mail Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA USA Web site Refer to our Web site for regional and international office information. Contacting Quest Support Quest Support is available to customers who have a trial version of a Quest product or who have purchased a Quest product and have a valid maintenance contract. Quest Support provides unlimited 24x7 access to SupportLink, our self-service portal. Visit SupportLink at From SupportLink, you can do the following: Retrieve thousands of solutions from our online Knowledgebase Download the latest releases and service packs Create, update and review Support cases View the Global Support Guide for a detailed explanation of support programs, online services, contact information, and policy and procedures. The guide is available at 25