LastPass Active Connector Directory The LastPass Active Directory Connector Client is a windows service that is run locally and can be downloaded from the Admin Dashboard. It connects to your Active Directory to support a variety of provisioning and management processes in LastPass. With this service, you can: 1. Feed relevant information from your user directory into LastPass. 2. Sync new user profiles to LastPass for automated provisioning of LastPass user accounts. 3. Sync disabled or deleted user profiles to LastPass for automated termination of LastPass user accounts. 4. Create nested groups to manage permissions at the group level. 5. Sync user groups to LastPass for policy designations, Shared Folders, and SAML application assignments. 6. Apply filters based on your groups so that only members of the relevant groups sync to LastPass. 7. Provisioning for a number of cloud-based applications including Google Apps and Salesforce.com. Add the user in AD, and let LastPass take it from there. No local provisioning necessary. Installing and Configuring the Client Recommended Specs 2 CPU cores Windows 8.1 (x64) or Windows Server 2012 R2 (x64) or newer 8GB of RAM.NET framework 4.5.2
500MB free disk space Throughput can be increased with more CPU cores Large AD with a lot of objects may require more RAM Please observe system requirements of the operating system System Requirements for the LastPass client / app can be found here: https://enterprise.lastpass.com/getting-started/sy stem-requirements/ Bandwidth Consumption Bandwidth consumption can vary according to the amount of changes, sharing feature and amount of syncs needed (this will depend on AD changes) Typically AD Connector consumes around a couple hundred megabytes per day User bandwidth Consumption will depend in the features used; can go from few KB to a few Mb (if using the file sharing feature) Installation Steps 1. Download the client from the Admin Dashboard -> Users -> Create New User -> LastPass Active Directory Sync Client 2. Run the MSI installer. Accept the prompts from User Account Control dialogs.
3. Once installed, the login page will appear. Login in with your LastPass credentials: Enterprise administrator login 4. After logging in, you will then be given an overview of each AD Connector sync option available and the settings that are currently in place. This is where you check the health status of the service and the connection as well as enable/disable user sync to LastPass. Note: Please make sure that you have set and saved all relevant configuration options before you enable syncing. Starting with partially configured AD Connector may
result in unexpected behavior.. 5. Start by configuring the connection between LastPass and your Active Directory. This is where you can set the details how to connect to your Active Directory.
Specify a domain (e.g.,lpadsync). Specify a particular domain controller to connect to instead of a domain (e.g., lpadsync-dc01.lpadsync.local) Credentials: you can connect in the name of the current user or use a specific user s credentials. BaseDN: The root node under which all your relevant user and group onjects are located. Be careful when narrowing the scope in AD. For proper operation, all relevant users and their embedding groups must be under the specified BaseDN.
6. After configuring your connection, click on Actions to configure the Account Provisioning and Deletion options. You can specify what action should be performed when certain events happen to users in the Active Directory. For delete/disable operations we recommend to use the more lightweight disable account option instead of delete/remove from company. In case the current settings lead to unwanted actions, these are easier to undo than deleted users. When a user profile is Created, choose one of the following: Add the user in the Enterprise dashboard,
but require approval This option will sync users between your AD and LastPass but will place them in LastPass under a pending status, rather than immediately creating an account for each user. Click here to learn more about creating an account for Pending Users. Automatically create user in LastPass When this option is enabled, LastPass will automatically create accounts for every new user, and send them an automated welcome email with a temporary password and instructions to create their individual Master Password. Do nothing When a user profile is Deleted, choose one of the following: Administratively disable the LastPass Account This will lock the Enterprise account, and free a license for other use; however, the account will still exist and be a part of the Enterprise Remove from the Enterprise account, but do not delete user This will remove the account from the Enterprise system, free up the license, and leave turn the account into a regular LastPass account. All data within the account will still be available for use to the user. Automatically delete their LastPass account This will completely delete the LastPass account and all data included in the account. The license applied to it will be available for use on another account. When a user profile is Disabled, choose one of the following: Administratively disable the LastPass
Account This will lock the Enterprise account, and free a license for other use; however the account will still exist and be a part of the Enterprise Automatically delete their LastPass account This will completely delete the LastPass account and all data included in the account. The license applied to it will be available for use on another account. Remove from the Enterprise account, but do not delete user This will remove the account from the Enterprise system, free up the license, and leave turn the account into a regular LastPass account. All data within the account will still be available for use to the user. When a user profile is removed from the group in filter, choose one of the following: Administratively disable the LastPass Account This will lock the Enterprise account, and free a license for other use; however the account will still exist and be a part of the Enterprise Automatically delete their LastPass account This will completely delete the LastPass account and all data included in the account. The license applied to it will be available for use on another account. Remove from the Enterprise account, but do not delete user This will remove the account from the Enterprise system, free up the license, and leave turn the account into a regular LastPass account. All data within the account will still be available for use to the user.
Configure Groups and Filters When you are done configuring the Actions, click Sync to configure the fields, groups and users that you would like to sync between LastPass and your Active Directory: Sync user s full name from AD By default, LastPass only lists users by their username/email address. However, when this option is enabled, the client will sync users full name so that it appears in LastPass, as well. Sync user groups from AD When this option is enabled, the client will synchronize all groups from your AD into LastPass for the purpose of assigning policies. Create groups in LastPass If a group exists in the AD
but not in LastPass, enabling this will create these groups in LastPass. If you are creating groups in LastPass based on your Active Directory, any existing groups in LastPass will be removed and replaced with the specified AD Groups. Sync Search Interval in hours If the above is enabled, it will force the client to search for and update changes in a cycle according to the designated number of hours Filter Users With the AD Connector Client, you can click directly on Browser for a user-friendly view of your connected Active Directory s groups. Simply navigate your Active Directory using the dropdowns and select all desired groups that you would like to sync. You can limit what users are added to your Enterprise by specifying a sync filter within the AD sync client. This field should be populated with the DN string of the group you d like to filter on. A good source for an accurate DN string is through the use of the ADSI Edit tool. When adding multiple groups to sync filters, use the full DN strings separated by the pipe symbol. An example is as follows: CN=LastPass,OU=Groups,OU=USA,DC=yourdomain,DC=com C N=LastPass2,OU=Groups,OU=USA,DC=yourdomain,DC=com Nested groups are supported: adding GroupA includes the users in that group and also in its sub-groups recursively. (i.e. if you add Group A only, but it also contains GroupB, that in turn contains GroupC, users from GroupA, GroupB and GroupC will be included). This allows you to consolidate user accounts, remove duplicate access, and automatically give site or shared folder access to nested groups. Warning: Be careful with selecting filter groups! When a user in the Active Directory loses membership in all specified groups, a disable/delete action (specified on Actions tab) is triggered. Make sure you select a group set that covers all the users needed to sync. Failing to
do so can result in disabling or deleting of the missed users on the site. Note: Make sure that all relevant users, groups and subgroups are all located under the selected BaseDN specified on the Connection tab. Additional attributes: specify an AD user attribute name (i.e., samaccountname ) that you wish to sync to LastPass. When you have completed the configuration, click Sync to LastPass. The LastPass Client will continually listen for changes in your active directory and continue to add and remove users. The application window can be closed and the app will continue to run in the system tray. NOTE: Users must have an email address listed in Active Directory in order to sync. Configure Proxy Settings Proxy settings can be configured by per executable, for all.net apps or per user by using IE settings. The UI can use Kerberos auth with the credentials of the currently logged in user (has to be domain user), the service with the credentials of the machine (has to be domain joined). It s not enough to change the settings for just the currently logged in user, because only the UI runs as the currently logged in user and the sync service runs as NT AUTHORITY\SYSTEM. Validate Proxy Settings You can use a custom helper script to check connectivity.
1. Download on target machine: proxydebug 2. Extract contents to C:\proxydebug or in current user directory C:\users\currentuser\proxydebug 3. Open an administrator command prompt (windows key, type command, right click, run as administrator) 4. Navigate to extracted files using cd C:\proxydebug. 5. Type RunMeAsAdmin.cmd 6. You should see the text Testing local user and Proxy settings OK/Not OK 7. Press a key, and you should see the same text in a new window. ( Testing system user ) 8. If one or both are not ok then the proxy settings need to be changed, see next step. 9. What does this do? What can I do if I can not download files on the target machine? 10. Run this powerhsell script in PowerShell ISE to test connectivity. The downloadable script also runs this as NT AUTHORITY\SYSTEM user too try { $f= (New-Object System.Net.WebClient).DownloadString("https://www.lastpass.com/") "LastPass connection OK. Proxy settings OK" } catch { $_.Exception.Message "Proxy or Internet settings NOT OK" } Write-Host "Press any key to exit..." cmd /c pause out-null IE settings (recommended) The settings for the IE proxy are by default per user. This means that a user always has the ability to change his own proxy settings. Use Admin Proxy Settings
In order to force a specific proxy server for all users on a machine, the proxy settings can be made machine-wide. This means only users with administrative rights can change the proxy settings. In order to make the proxy settings machine-wide, the following registry key or GPO must be set, and proxy settings configured by running IE as Administrator. (Open IE Tools menu Connections Tab LAN setings) GPO: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Make proxy settings per-machine (rather than per user) OR Run regedit.exe as Administrator. Create new or set existing registry Key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Inte rnet Settings DWORD: ProxySettingsPerUser = 0 Alternatively the same registry keys can be used as for manually specifying the proxy server, but they have to be set in HKLM instead of HKCU. Non-Group Policy method This needs to be done both for the currently logged in user and NT AUTHORITY\SYSTEM (that is the user the service is running as). For the current user it can be configured in Internet Options. (Open IE Tools menu Connections Tab LAN setings) For SYSTEM:
download https://live.sysinternals.com/psexec64.exe From command line execute: PsExec64.exe -i -u nt Files\Internet Explorer \iexplore.exe authority\system C:\Program This allows to run IE as SYSTEM user and make changes to proxy settings. Alternatively use registry (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Internet Settings) For the local system user, it is more convoluted. The regisrty settings are stored under the path HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentV ersion\internet Settings. It in is actually the value Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings that is used. Since that is not easily modified, you can modify the proxy settings for a user, export the registry key, modify the path in the exported file to HKEY_USERS\S-1-5-18 and reimport it. https://serverfault.com/questions/34940/how-do-i-configure-p roxy-settings-for-local-system Per app settings (not recommended for long term solution, as updates will overwrite) You need to edit the.config files located under:
C:\Program Files (x86)\lastpass AD Connector Based on: https://msdn.microsoft.com/en-us/library/sa91de1e(v=vs.1 10).aspx.NET Framework settings Edit machine.config (http://stackoverflow.com/questions/2325473/where-is-machine -config) You can run this in powershell: [System.Runtime.InteropServices.RuntimeEnvironment]::SystemC onfigurationfile Which outputs this for.net 4: C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config Note however that this might change depending on whether.net is running as 32 or 64 bit which will result in \Framework\ or \Framework64\ respectively. These were tested using Fiddler. No proxy server requiring authentication or real proxy server was tested. If you have any problem with the connection to LastPass servers. (or you find a log entry Server is not operational message), the try the following: Open Services and look for ADService. Right click on it and select properties. Like in the picture here:
In the next window click on Log On tab and select This account. Like in the following picture: Here provide the username and credentials of the user who is logged in on windows. Then click apply.
Syncing Group Settings In AD Connector you have the option to sync the user membership in different ways. You can find these options on Sync tab as shown in the picture below. In the following examples the processing of the user s group membership will be explained trough the AD structure as show here: So basically the structure looks like this: There GROUP GROUP GROUP are 3 groups : GROUP A, GROUP B and GROUP C. A doesn t belong to any group. GROUP B is part of A. GROUP C is part of GROUP B, so it is also part of A. There are 3 users: User 1 is in GROUP and part of GROUP and therefore part User 1, User 2 and User 3. A directly. User 2 is in GROUP B directly A through GROUP B. User 3 is in GROUP C of GROUP B and also GROUP A. In the AD it looks like this: The group that is selected after clicking the edit button on sync tab is GROUP A. When selecting Sync all group membership option If you select this option the following will be sent to LastPass site: User 1 is part of GROUP A.
User 2 is part of GROUP A and GROUP B. User 3 is part of GROUP A, GROUP B and GROUP C. So GROUP A, GROUP B and GROUP C is created on LastPass site. Use whitelist to filter groups And GROUP A is selected in the whitelist option. If you select this option the following will be sent to LastPass site: User 1 is part of GROUP A. User 2 is part of GROUP B. User 3 is not part of any group. So in this case only GROUP A and GROUP B is created on LastPass site. Sync only the groups specified in the Filter users section If you select this option the following will be sent to LastPass site: User 1 is part of GROUP A. User 2 is not part of any group. User 3 is not part of any group. So in this case only GROUP A is created on LastPass site. Do no sync group membership If you select this option the following will be sent to LastPass site: User 1 is not part of any group. User 2 is not part of any group.
User 3 is not part of any group. So no group is created on LastPass site. Exclude Groups In this section you can blacklist any group name by regular expression.if there is a match for the given regular expression that the group and groups in the group won t be sent to LastPass site. In our example: If you select sync all group membership and in the textbox you use the following regular expression: GROUP A (in this case its the exact name of the GROUP A) The following will be sent to LastPass site: User 1 is part of not part of any group. User 2 is part of GROUP B. User 3 is part of GROUP B and GROUP C So in this case only GROUP B and GROUP C is created on LastPass site. Debug The debug tab is where you go to troubleshoot your AD Sync issues.
Logging options: For troubleshooting you may need to increase log levels or space occupied by log files. Clear Local Cache: The relevant parts of group and user data is cached locally. Under normal circumstances you are unlikely to need to delete these caches manually. If you had to restore your AD from a backup, the local cache should be cleared. Migrating from the legacy AD/LDAP client to AD Connector If you have been running the LastPass AD/LDAP Sync Client, you can follow these steps to transition to the
LastPass AD Connector client. With support for nested groups and whitelisting as well as enhanced performance, we recommend the use of our AD Connector for syncing with Active Directory. To start the transition: Login to the LastPass AD Sync tool. 1. Go to configuration and make sure you record the following (you could create a note in the LastPass vault): 1. O n C o n n e c t i o n t a b, t h e o p t i o n s s e l e c t e d for Connection Configuration, Credentials and Base DN. 2. On Actions tab, all options selected. 3. On Sync tab, all the options (including the filter group name(s)). 2. Next, make a backup of C:\ProgramData\LastPass folder, then delete this folder. 3. Go to Control Panel\Programs\Programs and Features and uninstall the adsync tool. 4. Install the new AD Connector with the MSI downloaded from the Directory Integrations tab in the LastPass admin dashboard. 5. Log in to the AD Connector with the same LastPass account as you used in the previous AD Sync tool. 1. On Connection tab, set the same Connection Configuration, Credentials and Base DN options that you used previously. 2. On Actions tab, select all the provisioning and de-provisioning options you used before. 3. On Sync tab, check the first two options according to your selections in the previous AD sync client. To set the filter group, click on the Edit button where you will see the tree view of your AD group objects. Select the same group(s) specified in the previous AD sync client; you can select any or all
groups you want to sync. Note that it is not a text field, so you cannot type or copy-paste the string here. For user group membership, you have different options with AD Connector. See the explanation in the Syncing Group Settings section above. If you want to sync additional attributes to LastPass for user accounts, you can explicitly type them in the last field separated with a comma sign. As a last step, go to the Home tab and check the Enable sync checkbox, and synchronization of your AD will begin. Active Directory FAQs Do I need a designated admin account used for AD Sync? There is no need for such account. You only need to enter your credentials on LastPass AD Sync Configuration window to authenticate your right as an admin to modify the configuration. The actual syncing authentication takes place using a token that is handled separately. It is not bound to the account you used to setup the configuration in any way. If I add a new person to my AD directory, how will that update in LP and how often does it check for changes? Once started, the AD sync client will register itself with your AD server. When a change occurs, such as when a user is added, updated, or deleted, then the sync client will immediately re-check for changes. If I had previous users not added via AD, what happens to those users?
And any previous users that were added (manually or via another provisioning tool), will be cross-checked with what is listed in AD. If the user is not listed in AD, the sync client will ignore the existing users. If the user is listed and there are any changes (ex: disabled), the client will update the account in LastPass with the changes it finds in AD. Can I manually sync, automatically sync AD, both? Both. To automatically sync, simply leave the AD sync client running and it will detect changes and sync when needed. To manually sync changes, simply start the AD sync client on an as-needed basis. Does it work with other LDAP directories? No, the beta client does not. does. However, the legacy client I have thousands of names in my AD, will it time out while sending to LastPass? The AD sync client has been successfully tested with AD servers having more than 10,000 users. If I have admin accounts built into our AD directory how do I make sure that they don t import into LastPass? You can control what users are imported in two ways: a) By specifying a sync filter within the AD sync client to include only certain groups. and/or b) By specifying within the AD sync client that users be added as pending and then later having an admin manually approve users from within the Enterprise Administration dashboard.
How do I keep the name of the group from my AD directory in line with the LastPass groups? On the AD sync client configuration screen, there is an option labeled Sync user groups from AD that can be enabled. AD provisioning didn t work, what do I do? Find the debug log as indicated here https://lastpass.com/support.php?cmd=showfaq&id=7376 and attach the log file to the ticket for us to investigate. Do groups sync and work with Shared Folders, or just policies? Yes, groups can be mapped to both Shared Folders and policies. When a new user is added to a group, all policies and folders already assigned to the group will be automatically assigned to the new user. The folder will become available to the new user as soon as there is login activity by another sharee. Is any functionality of grouping lost when syncing them via AD? No, the functionality is still available. Does Active Directory Sync run as a service? Yes. Once you setup and run the AD Connector client it will run as a persistent service. If you restart your computer, the AD Sync client will automatically restart on reboot. What exactly is accessed and how is it transferred? Username, name, group membership, email and account status, it s transferred via SSL to LastPass. Will accounts created without AD sync be affected by the
sync client? No, accounts created via other means will not be synced with the client except for groups created by the AD. The domain we log into is different than our email address. Will users be able to log into LastPass using their AD credentials? No we create accounts based on the value stored as their email address in AD. How I can make sure AD passwords and LastPass master passwords are in sync? See this FAQ here: https://lastpass.com/support.php?cmd=showfaq&id=9532. I m having issues with the client, is there a debug I can send you? Yes you can. The client will generally produce a debug automatically, and can be found by following the steps here https://lastpass.com/support.php?cmd=showfaq&id=7376.