PBDeploy Guide Release 5.3

Transcription

1 August 17, 2012 PBDeploy Guide Release 5.3

2 Revision/Update Information: August 17, 2012 Software Version: 5.3 Document Revision: 0 COPYRIGHT NOTICE Copyright BeyondTrust Software, Inc. All rights reserved. Use of this software and/or document, as and when applicable, is also subject to the terms and conditions of the license between the licensee and BeyondTrust Software, Inc. ( BeyondTrust ) or BeyondTrust s authorized remarketer, if and when applicable. TRADE SECRET NOTICE This software and/or documentation, as and when applicable, and the information and know-how they contain constitute the proprietary, confidential and valuable trade secret information of BeyondTrust and/or of the respective manufacturer or author, and may not be disclosed to others without the prior written permission of BeyondTrust. This software and/or documentation, as and when applicable, have been provided pursuant to an agreement that contains prohibitions against and/or restrictions on copying, modification and use. DISCLAIMER BeyondTrust makes no representations or warranties with respect to the contents hereof. Other than, any limited warranties expressly provided pursuant to a license agreement, NO OTHER WARRANTY IS EXPRESSED AND NONE SHALL BE IMPLIED, INCLUDING WITHOUT LIMITATION THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR USE OR FOR A PARTICULAR PURPOSE. LIMITED RIGHTS FARS NOTICE (If Applicable) If provided pursuant to FARS, this software and/or documentation, as and when applicable, are submitted with limited rights. This software and/or documentation, as and when applicable, may be reproduced and used by the Government with the express limitation that it will not, without the permission of BeyondTrust, be used outside the Government for the following purposes: manufacture, duplication, distribution or disclosure. (FAR (g)(2)(Alternate II)) LIMITED RIGHTS DFARS NOTICE (If Applicable) If provided pursuant to DFARS, use, duplication, or disclosure of this software and/or documentation by the Government is subject to limited rights and other restrictions, as set forth in the Rights in Technical Data Noncommercial Items clause at DFARS TRADEMARK NOTICES PowerBroker, PowerPassword, and PowerKeeper are registered trademarks of BeyondTrust. PowerSeries, PowerADvantage, Password Safe, folder Integrator, PowerBroker Management Console, PowerBroker Desktops, PowerBroker for Virtualization, and PowerBroker Express are trademarks of BeyondTrust. SafeNet and SafeNet logo are registered trademarks of SafeNet, Inc. Copyright 2009, by SafeNet, Inc. All rights reserved. Product names of any third party remain the trademarks of such third party manufacturers and/or distributors, respectively. FICTITIOUS USE OF NAMES All names of persons mentioned in this document are used fictitiously. Any resemblance to actual persons, living or dead is entirely coincidental. OTHER NOTICES If and when applicable the following additional provisions are so noted: BeyondTrust is a registered trademark of BeyondTrust Software, Inc. This document is for informational purposes only. BeyondTrust offers no warranties, express or implied, in this document. Microsoft, Internet Explorer, Outlook, Windows, Windows Server, and Windows Vista are trademarks or registered trademarks of Microsoft Corporation. Other names mentioned herein may be trademarks of their respective owners. LIBRARY NOTICES cryptolib.lib Library Big Arithmetic routines coded by D. P. Mitchell and Jack Lacy December Copyright (c) 1991 AT&T Bell Laboratories. This is version 1.1 of CryptoLib. The authors of this software are Jack Lacy, Don Mitchell and Matt Blaze. Copyright 1991, 1992, 1993, 1994, 1995 by AT&T. Permission to use, copy, and modify this software without fee is hereby granted, provided that this entire notice is included in all copies of any software which is or includes a copy or modification of this software and in all copies of the supporting documentation for such software. NOTE: Some of the algorithms in cryptolib may be covered by patents. It is the responsibility of the user to ensure that any required licenses are obtained.

3 SOME PARTS OF CRYPTOLIB MAY BE RESTRICTED UNDER UNITED STATES EXPORT REGULATIONS. THIS SOFTWARE IS BEING PROVIDED AS IS, WITHOUT ANY EXPRESS OR IMPLIED WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. detours.lib Library Microsoft Research Detours Package, Professional Version 2.1 Build_216. DISCLAIMER AND LICENSE: ======================= The entire Detours package is covered by copyright law. Copyright Microsoft Corporation. All rights reserved. Portions may be covered by patents owned by Microsoft Corporation. libtomcrypt.lib Library Tom St Denis, ziputil.lib Library - Copyright Jean-loup Gailly and Mark Adler. xmlparse.lib Library - Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd. and Clark Cooper. Copyright 2001, 2002, 2003, 2004, 2005, 2006 Expat maintainers. Other names mentioned herein may be trademarks of their respective owners. IPAddressControlLib - Copyright 2007 Michael Chapman

4

5 Contents Contents Introduction...7 Conventions Used in This Guide...7 Where to Go Next?...8 Documentation Set for PowerBroker Desktops...8 Obtaining Support...8 Available Resources...8 Before Contacting Technical Support...9 Contacting Support...9 Product Components...11 Required Components...11 Features and Functions...11 Frequently Asked Questions...12 Creating PBDeploy Rules Prerequisites...14 Creating a Hash Rule for PBDeploy...14 Creating PBDeploy Rules...16 Deploying PBDeploy Rules...17 Usage and Examples...17 Syntax...17 Single Application Security File Example...18 Multiple Application Security Files Example...18 Computer Rules Example...19 User Rules Example...19 BeyondTrust August 17, 2012 Page 5

6 Contents BeyondTrust August 17, 2012 Page 6

7 Introduction Introduction This guide provides information about the PBDeploy application that is designed to be used with PowerBroker Desktops. For installation instructions and software requirements for PowerBroker Desktops, see the PowerBroker Desktops Installation Guide. For information about the PowerBroker Desktops features, benefits, functions, unique concepts, and basic procedures, see the PowerBroker Desktops User Guide. If you are upgrading from one version to a higher version, follow the instructions in the PowerBroker Desktops Upgrade Guide. The following sections include the document conventions, list of documentation for the product, and where to get additional product information and technical assistance. Conventions Used in This Guide Specific font and linespacing conventions are used in this book to ensure readability and to highlight important information such as commands, syntax, and examples. Font Conventions The font conventions used for this document are: Courier New Font is used for program names, commands, command arguments, folder paths, variable names, text input, text output, configuration file listings, and source code. For example: C:\Documents and Settings\All Users Courier New Bold Font is used for information that should be entered into the system exactly as shown. For example: pbdeploy.exe Courier New Italics Font is used for input variables that need to be replaced by actual values. In the following example, the variable MyServer, must be replaced by an actual environment server name and the variable MyFolder must be replaced by an actual folder name: \\MyServer\MyFolder\pbdcl32.msi Bold is used for Windows buttons. For example: Click OK. BeyondTrust August 17, 2012 Page 7

8 Introduction Linespacing Conventions The linespacing of commands, syntax, examples, and computer code in this manual may vary from actual Windows and Unix/Linux usage because of space limitations. For example, if the number of characters required for a single line does not fit within the text margins for this book, the text is displayed on two lines with the second line indented as shown in the following sample: C:\Windows\SYSVOL\domain\Policies\<GUID>\<MACHINE or USER> \PBDesktops Where to Go Next? For licensing information and installation instructions for PowerBroker Desktops, see the PowerBroker Desktops Installation Guide. For information about the PowerBroker Desktops features, benefits, functions, unique concepts, and basic procedures, see the PowerBroker Desktops User Guide. Documentation Set for PowerBroker Desktops The PowerBroker Desktops documentation set includes the following: PowerBroker Desktops Installation Guide PowerBroker Desktops User Guide PowerBroker Desktops Upgrade Guide: Upgrading from V5.x to V5.3 PowerBroker Desktops Upgrade Guide: Upgrading from V4.x to V5.3 PowerBroker Desktops PBDeploy Guide PowerBroker Desktops online help Obtaining Support BeyondTrust provides an online knowledge base, as well as telephone and web-based support. In addition, when working with any PowerBroker Desktops item, you can click the Help button to view detailed information about available options. Available Resources The PowerBroker Desktops Knowledge Base provides information and solutions to many known problems and issues. Registered users can access the Knowledge Base by logging onto the BeyondTrust Partner Portal on our website. To read about the other BeyondTrust products, see our corporate website at: BeyondTrust August 17, 2012 Page 8

9 Introduction Before Contacting Technical Support Be sure to read this section before contacting technical support. Tip: Is the PowerBroker Desktops client software running? A computer must have the PowerBroker Desktops client software installed and running to recognize rules. If a computer does not respond to a rule or a policy setting, make sure that the client software is installed and activated on the computer. Run the polmon.exe utility on the computer to check for client software activation and functionality. Obtain as much information about the problem as possible using PowerBroker Desktops troubleshooting tools, such as: Policy Monitor Trace options Event logging Resultant Set of Policy (RSoP) logging To expedite support, collect the following information: Image or the full text of any error messages Context of the problem, including affected platforms How to reproduce the problem For client problems: A copy of the XML configuration data that produces the problem, trace output, event log messages, and RSoP reporting data if available Contacting Support If you encounter problems that are not covered in the documentation, contact BeyondTrust technical support. When contacting technical support, provide the following information: Your company name Telephone and address where you can be contacted Description of the problem and the steps you have taken to resolve it You can contact BeyondTrust technical support by or through the BeyondTrust Web site. If you are located in the United States, you can also contact technical support by telephone. Technical Support is staffed 24 hours per day, seven days per week. Telephone: pbd-support@beyondtrust.com BeyondTrust August 17, 2012 Page 9

10 Introduction Web: To submit a support request online, do the following: 1. Browse to 2. Click Login and log into the BeyondTrust Support Web site using the password provided to you by BeyondTrust. 3. After reading the Welcome message, scroll to the top of the BeyondTrust Partner Portal pane and click Customer Support Center. 4. Scroll down the page to the Add/View Incidents section and click the + icon. 5. In the View Your Incidents pane, click Add Incident, enter the details requested, and click Submit Incident to file your request for technical support. BeyondTrust August 17, 2012 Page 10

11 Product Components Product Components BeyondTrust has developed the PBDeploy application to work with PowerBroker Desktops. This new application deploys rules to a computer that is part of a domain but does not currently have network connectivity to the domain (which means it is off-domain). These off-domain rules created by PBDeploy are referred to as PBDeploy rules. An example of a situation in which PBDeploy rules can be helpful is when salespeople cannot connect to the company domain while traveling, even though they are normally users within the domain. In that situation, PowerBroker Desktops rules cannot be deployed by a Group Policy Object (GPO). However, using PBDeploy, you can create PowerBroker Desktops rules that can be deployed by users when they cannot connect to their domain but still need to use a notebook computer or other portable device. Required Components The required components for using the PBDeploy application are the following: PBDeploy.exe License.xml ApplicationSecurity.xml (computer, user, or both) BTMessages.xml (required only if rules that you are deploying include Messages) Features and Functions The features and functions of PBDeploy include the following: The PBDeploy application requires a valid License.xml file for a domain GPO license. The License.xml file location is: C:\Users\All Users\BeyondTrust\license.xml The PBDeploy application requires an ApplicationSecurity.xml file containing deployment rules. The deployment rules are created from a domain-licensed GPO using the PowerBroker Desktops GPO snap-in. PBDeploy deploys both computer rules and user rules. The PowerBroker Desktops GPO snap-in generates two ApplicationSecurity.xml files: one for computer rules and one for user rules. To deploy each rule type, PBDeploy must be executed with each file separately. Note: Renaming the files may be necessary in this case. Although not recommended, it is possible to interchangeably deploy computer rules and user rules on the client computer. (For example, you should not create a computer rule in the snap-in and deploy it as a user rule.) User filters are honored with both. BeyondTrust August 17, 2012 Page 11

12 Product Components A signed version of ApplicationSecurity.xml is located in the following location: C:\Windows\SYSVOL\domain\Policies\<GUID>\<MACHINE or USER> \PBDesktops The security signature of an off-domain rule can be verified by viewing the ApplicationSecurity.xml file after creating the off-domain rule. An AppSecSig attribute with encrypted data is located in the ApplicationSecurity.xml file under the ApplicationSecuritySettings node. After running PBDeploy, any existing computer or user rules are replaced depending on the option. After reconnecting the client computer to the domain, the off-domain rules (computer or user) are replaced with the existing domain rules. If no existing domain rules exist, the off-domain rules are not replaced. If you want to remove the off-domain rules, just create a domain rule. Rule sets contained in multiple ApplicationSecurity.xml files may be deployed using the -d folder option. If the rules being deployed include User Messages, using the -d option is required. When using the -d option, files are processed in alphanumerical order. If the same rule (with the same or different options) exists in multiple ApplicationSecurity.xml files, the duplicate rule processed in the last.xml file is the rule that is applied by the client. Therefore, the last rule processed takes precedence. Frequently Asked Questions The following are frequently asked questions with their answers: When working with off-network clients and deploying the policy settings using your management system, will all the policy settings still show up if you were to do a gpresult of that device or when it is reconnected, do a RSoP? When the device is reconnected to the domain, the applied off-domain rules are replaced with the existing domain GPO rules. Therefore, you should not see off-domain rules in the RSoP. If you apply multiple policy settings to an off-network device, will they conflict at all? Also, how can you remove a policy setting from the off-network client? You are able to apply one set of computer rules and one set of user rules. Any existing GPO domain rules on the computer are replaced with the rule set located in the off-domain rule ApplicationSecurity.xml file. If you apply a different set of off-domain rules to a computer that already has off-domain rules, then the existing off-domain rules are replaced with the new ones. BeyondTrust August 17, 2012 Page 12

13 Product Components When reconnecting to the domain, what happens to the created off-domain rules? When the client computer reconnects to the domain, the off-domain rules (computer or user) are replaced by the domain rules. If there are no existing domain rules, the off domain rules are not replaced and will continue to function. If it is desired to remove the off-domain rules, just create a domain rule (for a computer or user). Can I deploy rules with PBDeploy.exe if the client computer does not have a pre-existing rule for PBDeploy.exe? The answer is yes. If using PBDepoy.exe with the Administrator login, there is no need for a rule for PBDeploy.exe. If however, you wish to deploy as a standard user, then you will need to have a Hash rule in place for PBDeploy.exe before hand as outlined above. Note: You can deploy the rule for PBDeploy.exe using PBDeploy.exe when logged in as an administrator and off the domain. In this case, there is no need to connect the off domain computer to the domain to receive the PBDeploy.exe Hash rule. BeyondTrust August 17, 2012 Page 13

14 Creating PBDeploy Rules Creating PBDeploy Rules This section provides the instructions for creating PBDeploy rules and lists the prerequisites for PBDeploy. Prerequisites The following prerequisites are required for creating PBDeploy rules to be deployed by a standard user without administrative rights: Valid domain license. PowerBroker Desktops must be installed. The rule set being deployed must include a rule that provides user with Administrative privileges when running PBDeploy. See Creating a Hash Rule for PBDeploy, page 14, for an example of how to create such a rule. Creating a Hash Rule for PBDeploy This procedure is required for standard user deployment. To create a Hash rule to support PBDeploy, do the following: 1. When the PowerBroker Desktops client software is installed on a computer, PBDeploy.exe is installed at the following location by default: C:\Windows\System32\PBDeploy.exe If the PowerBroker Desktops client software is not installed on the computer used to create domain GPOs, copy PBDeploy.exe from a computer on which the PowerBroker Desktops client software has been installed to a location that is accessible by the computer used to create domain GPOs. 2. On the computer that is used to create domain GPOs, create or edit a GPO in the Group Policy Management Console (GPMC). For more information, see Creating or Editing a GPO in the PowerBroker Desktops User Guide. 3. Create a new PowerBroker Desktops rule. For more information, see Creating or Editing a Rule with the Properties Dialog in the PowerBroker Desktops User Guide. 4. On the Application tab, for the rule type, select HASH RULE. a. Click the Hash browse button. b. Click Select a file. c. Select the PBDeploy.exe file to create the hash. 5. For Action, select Run application(s) with custom token. 6. Click the Token tab. 7. In the Permissions box, click Add, and then click OK in the Group dialog to add the BUILTIN\Administrators group. BeyondTrust August 17, 2012 Page 14

15 Creating PBDeploy Rules 8. In the Privileges box, do the following: a. Select Enable all granted privileges. b. Click Change. c. Select each of the following privileges and click Grant: Create a token object Take ownership of files or other objects d. Click OK in the Privileges dialog. 9. After you have configured the permissions and privileges, the Token tab for the rule should look like the following: 10. Click OK to close the Properties dialog and save the rule. 11. If an Unchanged Security Context message is displayed, click Yes. 12. In the Group Policy Management Editor, name the rule PBDeploy.exe. BeyondTrust August 17, 2012 Page 15

16 Creating PBDeploy Rules Creating PBDeploy Rules To create PBDeploy rules, do the following: 1. On the computer that is used to create domain GPOs, create or edit a GPO in the Group Policy Management Console (GPMC). For more information, see Creating or Editing a GPO in the PowerBroker Desktops User Guide. 2. Create rules to be deployed by using PBDeploy. For instructions about creating PowerBroker Desktops rules, see the PowerBroker Desktops User Guide. 3. Copy the ApplicationSecurity.xml and BTMessages.xml files containing the PBDeploy rules that were created. To find the signed ApplicationSecurity.xml and BTMessages.xml files: Navigate to the backup folder (GPOBackupData) and find the Application Security.xml file by searching for the GPO type, computer or user, or GPO name. Example of an Application Security.xml file name: AppSecComp_GPONAME.xml From the right PowerBroker Desktops snap-in pane, select the GPO rules. Then copy and paste the ApplicationSecurity.xml and BTMessages.xml files, or drag and drop them to a folder on the computer. After making your edits, you must close the GPO and then re-open the GPO before copying the XML files. Find the ApplicationSecurity.xml and BTMessages.xml files in the SYSVOL folder. Use the timestamps to find the appropriate files. ApplicationSecurity.xml file location: C:\Windows\SYSVOL\domain\Policies\<GUID>\ <MACHINE or USER>\PBDesktops BTMessages.xml file location: C:\Windows\SYSVOL\domain\Policies\<GUID>\ <MACHINE or USER>\PBDesktops\Messages 4. Verify the AppSecSig attribute with the encrypted data under the ApplicationSecuritySettings node in the ApplicationSecurity.xml file. 5. Find the PBDeploy.exe application and the required license.xml file. The License.xml file location: C:\Users\All Users\BeyondTrust\license.xml BeyondTrust August 17, 2012 Page 16

17 Creating PBDeploy Rules Deploying PBDeploy Rules Note: To deploy PBDeploy rules, either you must be a Local Administrator on your computer or the rule set that you are deploying must include a rule that gives you Administrative privileges when running PBDeploy. To deploy the PBDeploy rules to a client computer, do the following: 1. Package the required files (PBDeploy.exe, ApplicationSecurity.xml, BTMessages.xml, and License.xml) and or deploy the files to the required clients. 2. Ensure that the client computer is not connected to the domain. 3. From a command prompt, on the client computer run PBDeploy.exe using the command line parameters defined in Usage and Examples, page 17. Note: If deploying user rules, the -u argument option must be included in the command line arguments. 4. If the execution of PBDeploy.exe fails, see the event viewer and trace logs for details. For more information about troubleshooting, see the PowerBroker Desktops User Guide. Note: If rules have been applied to a client computer by PBDeploy, when the end-user reconnects to the domain and Group Policy is updated, the rules are not deleted from the registry if there are no user rules configured in the PowerBroker Desktops snap-in. To overwrite existing user rules deployed by PBDeploy in this situation, create and deploy a user rule. Usage and Examples The section contains PBDeploy usage and examples. The first two examples are general examples. Caution! The PBDeploy will not execute if the computer is connected to the domain. The computer must be a part of the domain but not connected for PBDeploy to function. Syntax The syntax for PBDeploy commands is described in this section. When the optional file paths are not provided, the ApplicationSecurity.xml, BTMessages.xml, and License.xml files must be located in the current folder. Usage PBDeploy.exe -f<filename> -d<foldername> -l<license.xml> -u BeyondTrust August 17, 2012 Page 17

18 Creating PBDeploy Rules Options The options for PBDeploy are optional except as noted. -f<filename> Optional. The file name in the current folder or the full path and file name to ApplicationSecurity.xml. If you are using the Message option in rules, you must use the use the d option instead of f option. -d<foldername> Required if you are using the Message option in rules so that the BTMessages.xml file will be processed. Optional if no Messages are configured. For more about User Messages, see the PowerBroker Desktops User Guide. The path to ApplicationSecurity.xml and BTMessages.xml files. The current folder is used if the path is blank. -l<license.xml> Optional. The license.xml in the current folder or the full path and file name to license.xml. -u Optional for computer rules. This option is required for the user rules. Single Application Security File Example Running as an Administrator, use the following syntax to apply rules for this user: Note: If you are using the Message option in rules, you must use the use the d option instead of f option when you run PBDeploy. See Multiple Application Security Files Example, page 18. PBDeploy.exe fapplicationsecurity.xml llicense.xml u Multiple Application Security Files Example To deploy multiple ApplicationSecurity.xml files or if Messages have been configured in the rules to be deployed, use the d option instead of f option as shown in the following example. (For information about Messages, see the PowerBroker Desktops User Guide.) The syntax for ApplicationSecurity.xml files is: <App*.xml> where files must start with App and end with.xml. PBDeploy.exe d<folder_applicationsecurity.xml_files> where Folder_ApplicationSecurity.xml_files is the folder containing ApplicationSecurity.xml files. BeyondTrust August 17, 2012 Page 18

19 Creating PBDeploy Rules Computer Rules Example To deploy rules to a computer, use the following syntax: Note: If you are using the Message option in rules, you must use the use the d option instead of f option when you run PBDeploy. See Multiple Application Security Files Example, page 18. PBDeploy.exe fapplicationsecurity.xml llicense.xml where ApplicationSecurity.xml contains the rules to be deployed to this computer and License.xml is the license file for this domain. The License.xml file ensures that PowerBroker Desktops is a licensed product. User Rules Example To deploy rules for a user, use the following syntax: Note: If you are using the Message option in rules, you must use the use the d option instead of f option when you run PBDeploy. See Multiple Application Security Files Example, page 18. PBDeploy.exe fapplicationsecurity.xml llicense.xml -u where ApplicationSecurity.xml contains the rules to be deployed to this computer. License.xml is the license file for this particular domain. This file ensures that PowerBroker Desktops is a licensed product. The u option applies rules for this user. BeyondTrust August 17, 2012 Page 19