Secret Server User Guide - Documentation

Table of Contents

I. Getting Started ............................................................................................................................................................................ 10

1. Installation ................................................................................................................................................................................................... 10

2. Terminology ................................................................................................................................................................................................ 10

II. Dashboard .................................................................................................................................................................................... 11

1. Advanced and Basic Views .................................................................................................................................................................... 11

2. Browse Tab .................................................................................................................................................................................................. 12

3. Search / Browse Widget ......................................................................................................................................................................... 12

4. Widgets .......................................................................................................................................................................................................... 13

5. Managing Widgets ..................................................................................................................................................................................... 14

6. Custom Tabs ................................................................................................................................................................................................ 14

7. Bulk Operations ......................................................................................................................................................................................... 14

III. Secrets ........................................................................................................................................................................................... 15

1. Creating a Secret ........................................................................................................................................................................................ 15

2. New Secret Page ......................................................................................................................................................................................... 15

3. Viewing a Secret ......................................................................................................................................................................................... 16 a. Common Configuration Options ..................................................................................................................................................... 16

b. Advanced Options ................................................................................................................................................................................ 17

4. Secret View Tabs ........................................................................................................................................................................................ 17 a. Personalize Tab ..................................................................................................................................................................................... 17

b. Expiration Tab ....................................................................................................................................................................................... 18 c. Security Tab ............................................................................................................................................................................................ 18

d. Launcher Tab .......................................................................................................................................................................................... 19 e. Remote Password Changing Tab .................................................................................................................................................... 19

f. Dependencies Tab ................................................................................................................................................................................ 20

5. Editing and Deleting a Secret................................................................................................................................................................ 20

6. Sharing a Secret .......................................................................................................................................................................................... 20

7. Copying a Secret ......................................................................................................................................................................................... 21

IV. Folders ........................................................................................................................................................................................... 22

1. Creating a Folder ....................................................................................................................................................................................... 22

2. Folder Tree View ....................................................................................................................................................................................... 23

Page 1

Last Updated: August 25, 2014

a. Folder Sharing and Permissions..................................................................................................................................................... 23

3. Editing Folder Permissions ................................................................................................................................................................... 24

4. Adding and Moving Secrets ................................................................................................................................................................... 25

5. Creating, Deleting and Moving Folders ............................................................................................................................................ 25

6. Secret Policy ................................................................................................................................................................................................ 25

7. Personal Folders ........................................................................................................................................................................................ 27

V. Secret Templates ....................................................................................................................................................................... 27

1. Creating or Editing a Secret Template .............................................................................................................................................. 27

2. Secret Template Fields ............................................................................................................................................................................ 27

a. Secret Template Field Settings ........................................................................................................................................................ 28 b. Secret Template Field Types ............................................................................................................................................................ 28

3. Additional Changes to a Template ...................................................................................................................................................... 29

4. Activating and Inactivating Templates ............................................................................................................................................. 29

5. Character Sets ............................................................................................................................................................................................. 30

6. Password Requirements ........................................................................................................................................................................ 30

7. Naming Patterns ........................................................................................................................................................................................ 32

8. Convert to New Template ...................................................................................................................................................................... 32

VI. Launcher ....................................................................................................................................................................................... 32

1. Built-In Launcher Types ......................................................................................................................................................................... 32

2. Enabling the Launcher ............................................................................................................................................................................ 33

3. Remote Desktop Launcher .................................................................................................................................................................... 33 a. Browser Configuration ....................................................................................................................................................................... 33 b. Setting Up the Secret Template ...................................................................................................................................................... 33

c. Session Recording ................................................................................................................................................................................ 34

d. Custom Launcher .................................................................................................................................................................................. 35

e. Launching a Session............................................................................................................................................................................. 37

4. SSH Proxy ...................................................................................................................................................................................................... 38

5. Web Password Filler ................................................................................................................................................................................ 39

6. Web Launcher ............................................................................................................................................................................................. 40 a. Configuring the Web Launcher for a Secret ............................................................................................................................... 40 b. Creating a Configuration .................................................................................................................................................................... 40

c. Launching to a Website ...................................................................................................................................................................... 41

VII. Setting up Password Masking ............................................................................................................................................... 41

Page 2


VIII. Secret Expiration ....................................................................................................................................................................... 41

1. Setting up Secret Expiration for the Secret template ................................................................................................................. 42

2. Setting up Secret Expiration for the Secret ..................................................................................................................................... 42

3. Forcing Expiration .................................................................................................................................................................................... 42

4. Resetting an Expired Secret .................................................................................................................................................................. 42

IX. DoubleLock .................................................................................................................................................................................. 43

1. Creating a DoubleLock Password ....................................................................................................................................................... 43

2. Creating a DoubleLock ............................................................................................................................................................................ 43

3. Assigning a DoubleLock to a Secret ................................................................................................................................................... 43

4. Changing a DoubleLock Password ..................................................................................................................................................... 43

5. Resetting a DoubleLock Password ..................................................................................................................................................... 43

X. Secret Check Out ........................................................................................................................................................................ 44

1. Configuring Password Changing on Check In ................................................................................................................................ 44

2. Checking Out Secrets................................................................................................................................................................................ 44

3. Configuring a Secret for Check Out .................................................................................................................................................... 45

4. Exclusive Access ......................................................................................................................................................................................... 45

5. Check Out Hooks ........................................................................................................................................................................................ 46

XI. Requires Approval for Access ............................................................................................................................................... 46

1. Setting up Access Request for a Secret ............................................................................................................................................. 46

2. Requesting Access after Approval is Granted ................................................................................................................................ 47

3. Approving a Request ................................................................................................................................................................................ 47

XII. Remote Password Changing .................................................................................................................................................. 47

1. Remote Accounts Supported ................................................................................................................................................................ 47

2. Enabling Remote Password Changing in Secret Server ............................................................................................................ 47

3. Configuring a Secret for AutoChange ................................................................................................................................................ 47

a. Privileged Accounts and Reset Secrets ........................................................................................................................................ 48 b. Change Password Remotely ............................................................................................................................................................. 48 c. Configuring Remote Password Changing – Mapping Account Fields ............................................................................. 48

d. Ports Required for Remote Password Changing ..................................................................................................................... 49 e. AutoChange Schedule ......................................................................................................................................................................... 49

4. Remote Password Changing for Service Accounts ...................................................................................................................... 50 a. Configuring the Dependency Tab................................................................................................................................................... 50 b. Dependency Settings and Information ........................................................................................................................................ 50

Page 3


c. Manually Adding a Dependency ..................................................................................................................................................... 51 d. Dependency Finder .............................................................................................................................................................................. 51

5. Custom Password Changers .................................................................................................................................................................. 51

a. Modifying Password Changers ........................................................................................................................................................ 52

b. Deactivating Password Changers ................................................................................................................................................... 54 c. Changing Ports and Line Endings .................................................................................................................................................. 54 d. Editing a Custom Command ............................................................................................................................................................. 54

e. Creating a New Custom Command Password Changer ........................................................................................................ 55

6. Heartbeat ...................................................................................................................................................................................................... 55 a. Remote Accounts Supported ........................................................................................................................................................... 55

b. Enabling Heartbeat .............................................................................................................................................................................. 56 c. Configuring Heartbeat ........................................................................................................................................................................ 56 d. Using Heartbeat ..................................................................................................................................................................................... 56 e. Alerts on Failure .................................................................................................................................................................................... 56

7. Remote Agents ............................................................................................................................................................................................ 56 a. Enabling Remote Agents .................................................................................................................................................................... 56 b. Create an Agent Installer ................................................................................................................................................................... 56

c. Installing an Agent ............................................................................................................................................................................... 57 d. Assigning an Agent to a Secret ........................................................................................................................................................ 57

8. Powershell Scripts .................................................................................................................................................................................... 57 a. Creating a PowerShell Script ........................................................................................................................................................... 57 b. Testing a PowerShell Script.............................................................................................................................................................. 57

c. Using a PowerShell Script ................................................................................................................................................................. 58 d. Auditing .................................................................................................................................................................................................... 58

XIII. Searching Secrets ....................................................................................................................................................................... 58

1. Search Indexer ............................................................................................................................................................................................ 59

2. Search Indexer Edit .................................................................................................................................................................................. 59

XIV. Secret Import .............................................................................................................................................................................. 59

1. Configuring Data for Import ................................................................................................................................................................. 60

2. Importing Secrets ...................................................................................................................................................................................... 60 a. Secret Server Migration Tool ........................................................................................................................................................... 60

b. Advanced XML Import ........................................................................................................................................................................ 61

XV. Discovery ...................................................................................................................................................................................... 61

Page 4


XVI. Session Monitoring ................................................................................................................................................................... 62

XVII. Webservices ........................................................................................................................................................................ 62

1. Enabling Webservices ............................................................................................................................................................................. 62

2. Windows Integrated Authentication Webservice ........................................................................................................................ 62

3. Java Console API for Accessing Secret Values Programmatically.......................................................................................... 63 a. Installing the Java Console ................................................................................................................................................................ 63

b. Security in the API ................................................................................................................................................................................ 64

XVIII. Folder Synchronization .................................................................................................................................................. 64

XIX. Users ............................................................................................................................................................................................... 64

1. Creating a User ........................................................................................................................................................................................... 64

2. Configuring Users ...................................................................................................................................................................................... 66 a. Bulk Operation ....................................................................................................................................................................................... 66 b. Login Settings ......................................................................................................................................................................................... 66

c. Password Settings ................................................................................................................................................................................ 67

d. Restriction Settings .............................................................................................................................................................................. 68

XX. Active Directory Synchronization ....................................................................................................................................... 69

1. Adding a Domain ....................................................................................................................................................................................... 69

2. Setting up a Synchronization Group .................................................................................................................................................. 69

3. Configuring Active Directory ................................................................................................................................................................ 69

4. Creating an Active Directory User ...................................................................................................................................................... 71 a. Converting Local Users to Domain Users ................................................................................................................................... 71 b. Unlocking Local Accounts ................................................................................................................................................................. 71

XXI. Advanced Authentication ....................................................................................................................................................... 72

1. Integrated Windows Authentication ................................................................................................................................................. 72 a. Enable Integrated Windows Authentication:............................................................................................................................ 72 b. Configure IIS ........................................................................................................................................................................................... 72 c. Logging in as a Local Account .......................................................................................................................................................... 72

2. SAML ............................................................................................................................................................................................................... 73 a. Enable SAML ........................................................................................................................................................................................... 73 b. Perform the Backend SAML Configuration ................................................................................................................................ 73

XXII. User Preferences ............................................................................................................................................................... 74

1. General Tab .................................................................................................................................................................................................. 74

2. Launcher Tab .............................................................................................................................................................................................. 75

Page 5


XXIII. Groups ................................................................................................................................................................................... 76

1. Creating a Group ........................................................................................................................................................................................ 76

2. Adding Users to a Group ......................................................................................................................................................................... 76

3. Group Assignment ..................................................................................................................................................................................... 77

4. Group Owners ............................................................................................................................................................................................. 78

XXIV. Roles ...................................................................................................................................................................................... 78

1. Creating a Role ............................................................................................................................................................................................ 79

2. Editing Permissions for a Role ............................................................................................................................................................. 79

3. Assigning Roles to a User ....................................................................................................................................................................... 79

XXV. IP Address Restrictions .................................................................................................................................................. 80 a. Creating an IP Address Range ......................................................................................................................................................... 80 b. Editing and Deleting an IP Address Range ................................................................................................................................. 80 c. Assigning an IP Address Range ....................................................................................................................................................... 80

XXVI. Administration .................................................................................................................................................................. 80

1. General Tab .................................................................................................................................................................................................. 80

2. Security Tab ................................................................................................................................................................................................. 82

3. Ticket System Tab ..................................................................................................................................................................................... 82

4. Email Tab ...................................................................................................................................................................................................... 82

5. Session Recording Tab ............................................................................................................................................................................ 83

XXVII. Administrator Auditing .................................................................................................................................................. 84

1. User Audit Report ...................................................................................................................................................................................... 84

2. Secret Audit .................................................................................................................................................................................................. 85

3. Report Auditing .......................................................................................................................................................................................... 86 a. Legacy Reports ...................................................................................................................................................................................... 86 b. Secrets ....................................................................................................................................................................................................... 86

c. Folders ...................................................................................................................................................................................................... 87 d. Groups ....................................................................................................................................................................................................... 87 e. Roles and Permissions ........................................................................................................................................................................ 87 f. User ............................................................................................................................................................................................................ 87

g. Activity ...................................................................................................................................................................................................... 88 h. Password Compliance ......................................................................................................................................................................... 88 i. Discovery Scan ....................................................................................................................................................................................... 88

j. Report Schedules .................................................................................................................................................................................. 89

Page 6


XXVIII. Backup / Disaster Recovery ..................................................................................................................................... 89

1. Backup Settings .......................................................................................................................................................................................... 89

2. Folder Permissions ................................................................................................................................................................................... 90

3. Manual Backups ......................................................................................................................................................................................... 90

4. Scheduled Backups ................................................................................................................................................................................... 90

5. File Attachment Backups ........................................................................................................................................................................ 91

XXIX. Exporting Secrets .............................................................................................................................................................. 91

1. Exported File Format ............................................................................................................................................................................... 91

2. Recovery ........................................................................................................................................................................................................ 92

XXX. Unlimited Administration Mode ................................................................................................................................. 92

XXXI. System Log ........................................................................................................................................................................... 93

XXXII. Event Engine ....................................................................................................................................................................... 94

1. Event Subscription Page ......................................................................................................................................................................... 94

a. Creating an Event Subscription ...................................................................................................................................................... 95 b. Editing a Subscription......................................................................................................................................................................... 95 c. Deleting a Subscription ...................................................................................................................................................................... 95

2. Viewing the Event Subscription Log .................................................................................................................................................. 95

XXXIII. CEF / SIEM Integration ................................................................................................................................................ 96

1. Configuring CEF ......................................................................................................................................................................................... 96

2. Testing CEF .................................................................................................................................................................................................. 96

XXXIV. Language Maintenance ............................................................................................................................................... 96

XXXV. Customizing the Look ...................................................................................................................................................... 96

1. Creating Themes ........................................................................................................................................................................................ 97

2. Embedded Mode ........................................................................................................................................................................................ 97

XXXVI. Reporting in Secret Server ........................................................................................................................................ 97

1. General Tab .................................................................................................................................................................................................. 97

2. Reports View Page .................................................................................................................................................................................... 98 a. Viewing a Report................................................................................................................................................................................... 98 b. Deleting or Undeleting a Report ..................................................................................................................................................... 98 c. Auditing for a Report .......................................................................................................................................................................... 98

3. Reports Edit Page ...................................................................................................................................................................................... 98

a. Modifying Report Categories ........................................................................................................................................................... 99 b. Creating and Editing a Report ......................................................................................................................................................... 99

Page 7


4. Scheduled Reports ..................................................................................................................................................................................100 a. Creating a New Schedule for a Report .......................................................................................................................................100 b. Viewing Existing Report Schedules .............................................................................................................................................100 c. Editing Schedule Settings ................................................................................................................................................................100

5. Security Hardening Tab ........................................................................................................................................................................101

6. User Audit Tab ..........................................................................................................................................................................................103

XXXVII. Server Clustering ........................................................................................................................................................ 103

XXXVIII. Encryption and Security ........................................................................................................................................... 103

1. Advanced Encryption Standard .........................................................................................................................................................103

2. SHA-512.......................................................................................................................................................................................................103

3. SSL Overview .............................................................................................................................................................................................104

4. Two-Factor Authentication at Login ...............................................................................................................................................104 a. Email Two-Factor Authentication ...............................................................................................................................................104

b. RADIUS Authentication ....................................................................................................................................................................105

c. TOTP Authentication .........................................................................................................................................................................106

d. Duo Security Authentication ..........................................................................................................................................................108

5. SMTP Configuration ...............................................................................................................................................................................109

6. FIPS Compliance ......................................................................................................................................................................................110

7. PCI Datacenter Compliance .................................................................................................................................................................110

8. SafeNet HSM Integration ......................................................................................................................................................................111

XXXIX. Upgrading Secret Server .......................................................................................................................................... 111

XL. Licensing ..................................................................................................................................................................................... 111

1. Professional License ...............................................................................................................................................................................111

2. Enterprise License ..................................................................................................................................................................................112

3. Enterprise Plus License.........................................................................................................................................................................112

4. Installing New Licenses ........................................................................................................................................................................112

5. Converting from Trial Licenses .........................................................................................................................................................112

6. Activating Licenses .................................................................................................................................................................................112

7. Limited Mode ............................................................................................................................................................................................113

XLI. External Applications ............................................................................................................................................................. 114

1. iPhone Application ..................................................................................................................................................................................114

2. Blackberry Application .........................................................................................................................................................................115

3. Android Application ...............................................................................................................................................................................116

Page 8


4. Desktop Application ...............................................................................................................................................................................117

XLII. Appendix ............................................................................................................................................................................ 118

1. Technical Support ...................................................................................................................................................................................118

Page 9


I. Getting Started

1. Installation

Secret Server is distributed as an .msi (setup.exe) which installs the web application. A .zip file option is also available if needed, but is not recommended as the setup.exe is much easier. To install Secret Server, simply run the setup.exe. For more detailed information on setting up the prerequisites (IIS, ASP.NET, and connecting to Microsoft SQL Server), please see the Installation Guide .

2. Terminology

Throughout this user guide, certain terms are used to refer to specific features or concepts within Secret Server:

Administrator

Access to features within Secret Server is controlled using user roles . Administrator is a default role that comes pre-

configured with Secret Server. This role can be customized to have different permissions. In this guide, 'administrator' will be used when referring to users who manage the system and have control over global security and configuration settings. Note that administrators in Secret Server do not automatically have access to all data stored in the system – access to data is still controlled by explicit permissions on that data.

Secret

A piece of information that is stored and managed within Secret Server is referred to as a Secret. Secrets are derived

from Secret templates. Typical Secrets include, but are not limited to, privileged passwords on routers, servers, applications, and devices. Files can also be stored in Secrets, allowing for storage of private key files, SSL certificates, license keys, network documentation, Microsoft Word or Excel documents and more.

Secret Template

Secret templates are used to create Secrets and allow customization of the format and content of Secrets to meet

company needs and standards. Examples include: Local Administrator Account, SQL Server Account, Oracle Account,

Credit Card and Web Password. Templates can contain passwords, usernames, notes, uploaded files, and drop-down list values. New Secret templates can be created, and all existing templates can be modified.

Role-based Security

Secret Server uses role-based access control, which provides the ability to set strict, granular permissions for each user.

All features in Secret Server are made available to users based on permissions, which collectively make up roles .

Unlimited Administration Mode

The emergency, "break-the-glass" feature. When this mode is enabled, administrators can access all content within the

system, regardless of explicit permissions. Access to Unlimited Administration Mode is controlled using role

permissions.

Remote Password Changing

Secret Server provides the ability to automatically change passwords on remote devices and various platforms,

including the following: Windows accounts, various database logins, Active Directory accounts, UNIX/Linux/Mac accounts (including root passwords), network appliances/devices and more.

Page 10


II. Dashboard

Dashboard is the main screen for searching and viewing Secrets. For a visual demonstration of the Dashboard, see the video at the following link: http://my.thycotic.com/movies/secretserver/welcome/ .

1. Advanced and Basic Views

As of Secret Server version 8.6.000000, an alternate Dashboard view is available called Basic Dashboard. Viewing the

Advanced Dashboard requires the role permission View Advanced Dashboard. A role called Basic User is included by default and contains the same role permissions as the default User role, with the exception of the View Advanced

Dashboard permission. A user that has the View Advanced Dashboard permission has the ability to switch between the two views by clicking Advanced or Basic at the top-right corner of Dashboard. A user without this permission will be

restricted to the Basic view, which does not include use of any widgets aside from Recent Secrets.

Basic Dashboard

Page 11


Advanced Dashboard

2. Browse Tab

The Browse tab is the only tab that new users will see. By default, the Browse tab contains the Search/Browse, Favorite

Secrets, Expired Secrets, Create New Secret and Recent Secrets widgets. All widgets except the Search/Browse widget can be added or removed from this tab. The Browse tab cannot be deleted or renamed, but can be moved in the tab order.

3. Search / Browse Widget

This widget can be used to limit the Secret search results to a particular folder and its subfolders. The Browse tab will always contain a Search/Browse widget based on the < All Folders > root folder.

Create

This widget is created by creating a new custom tab . Only one Search/Browse widget can be present per tab, and they

cannot be added to pre-existing tabs.

Delete

Search/Browse widgets can be deleted from custom tabs, but cannot be removed from the Browse tab.

Search

Secret search results can be filtered by selecting a folder on the left, either by clicking it or using the search field above the folder tree. On the right side of the widget, Secrets can be filtered further by specifying search criteria in the top

Page 12


textbox. The Advanced section allows filtering by Secret template and status as well as the option to include Secrets contained in sub-folders. Advanced criteria will only remain in effect while those options are expanded (visible).

View and Manage

Secrets that are listed in the results grid can be managed and/or viewed based on a user’s permissions. To view a

Secret, click the row and it will expand to display. Some of the features available include the copying and unmasking of passwords, using the launcher, and viewing other pertinent details.

Customize

Additional columns can be displayed on the grid. This data can be either metadata pertaining to the Secret or Secret

template fields that have been set to be available for exposure on Dashboard. See Using the Secret template Designer

section for further details. To select additional columns to display, click the Advanced link and then the Column

Selection link. The following metadata fields can be displayed:

- Days until Expiration

- Requires Comment

- Expiration Field Changed

- Double Lock

- Checkout Enabled

- Deleted

- Created

- Hide Password

- Is Checked Out

- Inherit Permissions

- Requires Approval

Search/Browse widgets cannot be rearranged. They will always remain in the top left region of the tab.

4. Widgets

Widgets are the basis of functionality for Dashboard. All widgets except for the Search/Browse widget share similar UI functionality. Widgets can be created, deleted, and rearranged on a per-user basis.

Create Secret

This widget is used to create new Secrets. From the Create New drop down list, select the Secret template that you wish

to use. You will then be sent to the New Secret page. See the Creating a Secret section for the details on how to use this

screen.

Expired Secrets

Displays Secrets that are expired.

Favorite Secrets

Displays Secrets that are marked as Favorites.

Out-Of-Sync Secrets

Displays Secrets that are out-of-sync, meaning that Heartbeat

and/or Remote Password Changing have failed.

Recent Secrets

Displays the Secrets that have been viewed most recently.

Report

Displays a report. Click Create New to select a report from the drop-down menu. One report can be displayed per

widget. Click the title of the report to navigate to the Report View page. For further details, see the Reporting in Secret

Server section.

Page 13


5. Managing Widgets

The following operations can be performed to manage widgets:

Add

Expand the Content area at the upper-left corner of the Dashboard and drag a widget name to the content area below.

Delete

Click the icon at the top of the widget.

Refresh

Click the icon at the top right of the widget. This is not available for all widgets.

6. Custom Tabs

The following operations can be performed to customize tabs:

Create

Drag a folder from the Browse/Search widget to the tab region at the top of Dashboard to create a tab containing a new Browse/Search widget, or click on the

+

tab to create a new empty tab.

Edit

Click the icon on a tab to enter a new name. Cancel changes by pressing the Esc key.

Delete

Click the icon on a tab to permanently delete it. A prompt will appear to confirm the change.

Reorder Tabs can be reordered by dragging a tab to the left or right of another existing tab.

7. Bulk Operations

From the Dashboard, bulk operations can be performed on multiple Secrets. Select the Secret(s) you wish to include by checking the checkbox next to the Secret’s Name. To check them all, check the checkbox in the column headers row.

Then, select the operation from the dropdown list below the list of Secrets.

Currently Available Bulk Operations:

- Add Share

- Assign To Agent*

- Assign Secret Policy

- Change Password Remotely*

- Change to Inherit Permissions

- Disable Check Out**

- Disable Comment on View*

- Disable Heartbeat*

- Edit Share

- Enable AutoChange*

- Convert Secret template

- Delete

- Disable AutoChange*

- Enable Check Out**

- Enable Comment on View*

- Enable Heartbeat*

*

Available with Professional, Enterprise, or Enterprise Plus editions.

**

Available with Enterprise or Enterprise Plus editions.

- Hide Launcher Password

- Move to Folder

- Run Heartbeat

- Set Privileged Account*

- Undelete

- Unhide Launcher Password

Page 14


III. Secrets

Secrets are individually named sets of sensitive information created from Secret templates. Flexibility in templates allows

Secrets to address a broad spectrum of secure data. Secret security can be centrally managed through Sharing settings for each individual Secret. Additionally, folder structure can allow one or more Secrets to inherit permissions from their parent folder. All Secret field information is securely encrypted before being stored in the database, with a detailed audit

trail for access and history. For details on using bulk operation to configure Secrets, see the Dashboard section.

1. Creating a Secret

From Advanced Dashboard, find the Create Secret widget and select the Secret template from which to create the Secret.

After selecting a template, you will be directed to the New Secret page. On Basic Dashboard, click Create New and select the desired Secret template type from the Secret Template drop-down menu. This template contains all the relevant

fields for a Secret. If you do not find a suitable template available, a custom template can be created .

For more information about Dashboard views, see Dashboard .

2. New Secret Page

For simple Secret templates, Secret creation is intuitive and straightforward. The more complex Secret templates are discussed later in this user guide. On The New Secret page, fill in the Secret Name, as well as the other Secret fields

present. Fields with an asterisk * are required (these can be modified at the Secret Template level).

Note The Secret Name field is the text used both for display purposes throughout the application as well as for search

functions (other fields can be used as well; see Searching Secrets for more details).

Click Save and Share after filling out the Secret fields to immediately set the Sharing settings on the newly created Secret.

Sharing is discussed in more detail in Secret Sharing .

It is possible to import data as Secrets. This topic is discussed in the Secret Import section.

Page 15


3. Viewing a Secret

To view the information contained in a Secret, you must navigate to the Home page. From there, click on the Secret name,

then click View. For instructions on browsing your Secrets on the Home page, see the Searching Secrets section.

Only the General tab is discussed in this section. This page will be referred to as the Secret View page. For information on

the other tabs, see the Secret View Tabs section.

The Secret View page displays the relevant information for a Secret. The password fields of a Secret can be masked,

depending on your settings . The icons below will perform the following operations when clicked:

Lock

History

Unmask a field until the cursor is moved away from the icon.

Display the history of changes to the field.

Copy-to-clipboard

Copy the field to the clipboard. You may need an add-on for this to function.

NATO

Display the field using the NATO phonetic alphabet. This is helpful when communicating a password over the phone.

a. Common Configuration Options

Listed below are configuration options that are common to every Secret:

Folder Folder location of the Secret. The Secret will inherit permissions of this folder depending on the

Default Secret Permissions setting in the Secret Server Configuration options.

Favorite Click the star from the Dashboard or check this box on the Secret View page to mark the Secret

as a favorite. It will then be displayed in the Favorite Secrets widget .

Edit the Secret fields.

Create a duplicate copy of the Secret, which may also be renamed and modified.

Configure the sharing settings , or permissions, for the Secret.

View the Secret audit log to see which users have accessed the Secret and the actions that have

been performed.

Delete the Secret .

Change which template is being used to store and display information in this Secret.

Page 16


b. Advanced Options

Below are the buttons, fields, and icons that are specific to more advanced Secrets:

Initiate Heartbeat , which will attempt to verify that the Secret credentials can

authenticate.

Launcher icon

Expire the Secret manually.

Click to open the Launcher. Further details in the Launcher section.

4. Secret View Tabs

a. Personalize Tab

These settings will only be applied to the user who is editing the settings. They will not apply to the other users who have

View/Edit/Owner permission to the Secret.

To use the settings in the Email Notifications area, you must have email configured correctly in your Configuration settings . You also need a valid email address entered for each user account to use these settings. This can be set in the

Administration > Users section.

Page 17


The following Email Notifications settings are available:

Send Email When Viewed

Email the user when the Secret is viewed by any user.

Send Email When Changed

Email the user when the Secret is edited by any user.

Send Email When Heartbeat Fails

Email the user when Heartbeat fails for the Secret. The email will contain the Secret name, error code and details.

The Personalize tab also contains settings that pertain to the type of launcher configured for a Secret. If the Launcher type is Remote Desktop, the following settings will be available:

Connect to Console

Allow Access to Printers

Remote Desktop Connection will connect to the console session.

Grant Remote Desktop Connection access to local printers.

Allow Access to Drives Grant Remote Desktop Connection access to drives connected to the local machine.

Allow Access to Clipboard Grant Remote Desktop Connection access to the clipboard of the local machine.

Use Custom Window Size Allow user to specify custom window height and width. Use Preferences will refer to the user’s settings in Tools > Preferences under the Launcher tab.

Users may opt to enable or disable these settings, or to defer to what is configured in their user settings by selecting Use

Preferences.

b. Expiration Tab

Inside the Expiration tab, the expiration period can be modified. The following options are available:

Template Interval

Default expiration period configured for new Secrets based on the current template.

Custom Interval

Specify a custom expiration period in days.

Custom Date

Specify a custom expiration date in month/day/year format.

See Secret Expiration for further details.

c. Security Tab

The Security tab contains settings that can be enabled to increase security for a Secret. The settings listed below may or may not be visible, depending on your configuration settings:

Require Check Out

Only one user at a time can have access to a Secret. See Secret Check Out

for further details.

Page 18


Enable DoubleLock

A user must enter their DoubleLock password to decrypt and view a Secret.

Enable Requires Approval for Access

A user must request access to view a Secret. See Requires Approval for Access

for further details.

Require Comment

A user must enter a comment before being granted access to view the Secret. The comment is stored in the audit log for that Secret.

Enable Session Recording

Record the Launcher session. This applies to Secrets with a Launcher associated with the Secret template. See Session

Recording for further details.

Hide Launcher Password

Remove the ability of users with only View permission to copy-to-clipboard or unmask the password field of the Secret.

This applies to Secrets with a Launcher associated with the Secret template.

Customize Password Requirement

Check this box to specify a password requirement for each field of the Secret that has the type “password.”

d. Launcher Tab

The Launcher tab will appear for Secrets that use either a Custom Launcher or Web Launcher.

If a Custom Launcher is associated with a Secret template, a Secret Owner can configure associated Secrets or a privileged

Secret to run the Launcher process. The associated Secret can be tied in to the command line parameters on the Custom

Launcher, and the privileged Secret is the identity that will kick off the launcher process.

If a Web Launcher is associated with a Secret template, the Launcher tab will display how the Web Launcher is configured for that Secret. The following options will be available:

Test Launcher

Edit Fields

Test the current Web Launcher configuration.

Modify which Secret fields are mapped to the HTML input controls on the target website.

Reconfigure Web Launcher Reset the Web Launcher configuration.

Use Web Password Filler

Opt to use the Web Password Filler rather than the Web Launcher.

See the Web Launcher section for further details.

e. Remote Password Changing Tab

The settings inside the Remote Password Changing tab are used for Secrets that are Remote Password Changing- enabled:

Auto Change

Enable or disable Auto Change for the Secret.

Page 19


Next Password

Specify the next password

For more information see the Remote Password Changing section.

f. Dependencies Tab

The settings inside the Dependencies tab are used for Secrets that have Remote Password Changing enabled. For more

information on Dependency checking, see the Dependency Finder

section within the Remote Password Changing section.

5. Editing and Deleting a Secret

If using the Dashboard, see the Dashboard section.

To edit a Secret, navigate to its Secret View page and click Edit. All fields will become editable. For passwords, there is an ability to randomly create a password with the Generate button. This will generate a password according to the rules set

at the template level (see Secret templates for more information about password requirements).

To delete a Secret, navigate to the Secret View page and click Delete. The Secret will be logically deleted and hidden from users who do not have a role containing the View Deleted Secrets permission. Secret Server uses “soft deletes,” to maintain the audit history for all data. However, deleted Secrets are still accessible by administrators (similar to a permanent Recycle Bin) – to ensure that audit history is maintained and to support recovery. A user must have the View

Deleted Secrets permission in addition to Owner permission on a Secret to access the Secret View page for a deleted

Secret. For more information about these permissions, see Roles

and Sharing a Secret .

To undelete a Secret, navigate to the Secret View page and click Undelete.

Secrets can also be deleted in bulk. For details, see Bulk Operations on Secrets .

6. Sharing a Secret

Sharing passwords is crucial for information technology teams. Due to the sensitive nature of sharing secure information,

Secret Server takes all necessary security measures to ensure that shared passwords are tracked and guarded.

There are three permission levels to choose from when sharing Secrets with another user or group:

View

Allows the user to see all Secret data (fields – username, password, etc.) and metadata (permissions, auditing, history, security settings, etc.).

Edit

Allows the user to edit the Secret data (username, password, etc.). Also allows users to move the Secret to another folder unless Inherit Permissions from Folder is turned on, in which case the user needs Owner permissions to move the Secret.

Owner

Allows the user to change all the Secret metadata (permissions, security settings, etc.).

Password fields will not be visible if a Secret has a launcher and Hide Launcher Password is turned on or the user does not have the

View Launcher Password role permission.

Page 20


For example, administrators require the Edit permission to the router password, but a contractor doing network upgrades might only need View (read-only) access to that same Secret.

Secrets can be shared with either groups or individual users. Secret Sharing section allows Secrets to be configured for access.

To add and/or remove Sharing from a Secret, navigate to the Secret View page and click Share. On the Secret Share page, existing Sharing settings for each user or group are displayed in the grid. To edit these settings, click Edit. You can now add or remove users or groups from Sharing on the Secret. You can also modify Sharing settings for users or groups that already have Sharing enabled for the Secret. If a user or group is not displayed, they do not have access to the Secret.

To further simplify the process of Sharing, Secrets can automatically inherit the settings from the folder they are stored in.

By enabling the Inherit Permissions from folder option on the Sharing Edit page, a Secret will inherit all the parent folder's

Sharing settings. For more on folder security, see the Folders section.

7. Copying a Secret

Secret Copy allows for more efficient duplication of secrets. Any user with the Owner secret permission on a secret can click Copy Secret at the bottom of the General tab to create a new Secret with information based on the original secret.

Secret field information, launcher settings, secret settings, double locks, email settings, and permissions are copied over.

Audit records are written to the source Secret and target Secret to indicate that a copy operation took place. Currently, file attachments are not copied.

Page 21


IV. Folders

Folders allow you to create containers based on your individual needs. These folders help organize your customers, computers, regions, branch offices, etc., into centralized areas. Folders can be nested within other folders to create further sub-categories for each set of classifications. Secrets can be assigned to these folders and sub-folders. A benefit of folders is customizing permissions at the folder level and enabling Inherit Permissions on Secrets within the folders.

Setting permissions at the folder level will ensure future Secrets in that folder have the same assigned permissions, and simplify managing access across users and Groups.

1. Creating a Folder

To create a folder, select Folders from the Administration menu.

To view the Folders page and create folders, you must have a Role with the Administer Folder permission.

Click New to create a new folder. By default, a new folder will be created at the root level. If you wish to create a subfolder, select the parent folder from the folder tree before clicking New. To return to the root level, click the highlighted folder to unselect it. To create a sub-folder, you must have Edit or Owner permissions on the parent folder.

Page 22


By default, the new folder will inherit the Secret Policy assigned to its parent folder. To disable this, deselect the Inherit

Secret Policy checkbox. To assign a Secret Policy to this folder, select the policy from the drop-down menu. For more

information about configuring these policies, see Secret Policy .

Folder Name will be the text used both for display purposes throughout the application as well as for search functions, and the folder icon setting is used to display the specialized icon in the Folder Tree views and advanced folder searching.

The folder icons available are Folder (default), Customer, and Computer.

2. Folder Tree View

a. Folder Sharing and Permissions

If the new folder is a sub-folder, then you can have it use the Sharing settings of its parent folder by enabling the folder to

Inherit Permissions from Parent.

Folders have the same Sharing structure as Secrets: Edit, View and Owner.

View

Edit

Allows the user to see the folder and Secrets in that folder that are inheriting permissions from their folder.

Allows the user to create new folders in that folder (will force “Inherit Permissions from Parent” to on for the new folder), move Secrets into that folder, and add new Secrets into that folder.

Owner

Allows the user to create new folders in that folder without forcing inheritance, move the folder, delete the folder, rename the folder, and change the permissions and inheritance settings on the folder.

Click Save and Edit Permissions to configure Sharing settings on the new folder. Depending on your Configuration setup, these settings could affect the permissions of sub-folders and Secrets contained in this folder. Folders are not visible to users that do not have View permission (unless the configuration setting “Require View Permissions on Specific Folder for

Visibility” is turned on). This allows users to create and manage their own folders without making them visible to all users.

Page 23


3. Editing Folder Permissions

To edit the permissions of a folder, highlight the folder on Dashboard and click the icon. Folder permissions can also be edited from the Administration > Folders page by highlighting the folder and clicking Edit.

Below are a few folder-specific settings you may wish to use in your Secret Server configuration (go to Administration

> Configuration):Default Secret Permissions

This setting determines whether new Secrets will by default inherit permissions from their containing folder, copy permissions from their parent folder, or give the creator of the Secret access. The options are as follows:

 New Secrets inherit permissions from folder

New Secrets will be marked as inheriting from folder, thus will have the same permissions as the folder.

 New Secrets copy permissions from folder

New Secrets will not be marked as inheriting from folder, but will start with the same permissions as their folder.

 Only Secret’s creator has access

New Secrets will not be marked as inheriting from folder. Only the creator will initially have permissions on the

Secret. Note that when a Secret is copied, the new copy will also have whatever permissions the source Secret had.

Page 24


Require View Permission on Specific Folder for Visibility

When enabled, this hides folders that the user does not have explicit View permission on. The folders will not appear in the tree view or allow search and browse. If disabled, the users can see the folders in the folder tree but they will appear empty as the user does not have View permission to the Secrets.

Require Folder for Secrets

This setting is used to force users to always add Secrets to folders.

It is possible to setup an automatically replicated folder structure from an external Database, such as ConnectWise or other CRM

systems. This topic is discussed later in Folder Synchronization .

4. Adding and Moving Secrets

To add a Secret to a folder, you must have Edit permission on that folder (either direct or through inheritance).

To move a Secret to a folder, you must have Edit permission on that folder (either direct or through inheritance).

To move a Secret from a folder, you must have Edit permission on that Secret. If the Secret has “Inherit Permissions from folder” then you must have Owner permission to move that Secret to a new folder.

When a Secret is moved to a folder, it will automatically get “Inherit Permissions from folder” even if it had specific permissions before the move.

5. Creating, Deleting and Moving Folders

The Administer Folders role permission will allow a user to be able to create new folders and manage folders but specific folder permissions still apply.

Any user with the Administer Folders role permission will be able to create new folders, however to create folders at the root level the user also needs the Create Root Folders permission.

They will also be able to add new folders to any folders where they have Edit or Owner permission on that folder.

They must have Owner permission to be able to delete a folder.

They can also move folders where they have Owner permission on the source folder and Edit or Owner permission on the target folder (where they are moving it). The folder will automatically “Inherit Permissions from parent” when it is moved

(same as when Secrets are moved).

6. Secret Policy

Secret Policies can be configured to apply Remote Password Changing and Security settings to an entire folder of Secrets.

To view existing Secret Policies or create a new policy, select Secret Policy from the Administration menu.

Click the Secret Policy Name of an existing policy to view the policy details and/or edit the policy.

Page 25


To create a new Secret Policy, click Create New. Enter a name for the Secret Policy, and then choose a Setting for the setting that you would like to configure. Aside from < Not Set >, which means that the setting will not be applied, there are two options:

Default

The policy will be applied to all Secrets in the folder initially, but it is possible to manually change the applied Secret settings as well.

Enforced

The policy will be applied to all Secrets in the folder initially, and it is not possible to change those applied settings on

Secrets in that folder.

Apply the setting by selecting the Value check box in that row. Applying the setting may enable configuration of related settings in the grid. For example, enabling Auto Change causes Auto Change Schedule to be available for configuration.

Page 26


Click Save to make the policy available for assignment to folders. To deactivate a policy that you would no longer like to be used, edit the policy and deselect the Active check box.

For information about applying a Secret Policy to a folder, see Editing Folder Permissions .

7. Personal Folders

In Secret Server, we will refer to a “personal folder” as a folder that one (and only one) individual has owner access to. No user is able to modify sharing permissions on these folders. A user cannot add subfolders to their personal folder. The purpose of this folder is to allow a user to securely store work-related Secrets that other users do not require access to.

Note that when in break the glass mode, an unlimited admin can access a user’s personal folder in order to recover

Secrets if needed.

To use personal folders, they will first need to be enabled:

Enable Personal Folders

1. From the ADMIN menu, select Configuration.

2. Click the Folders tab, and then click Edit.

3. Select the Enable Personal Folders check box.

4. If you would like to customize the root-level folder that will contain all personal folders, you can enter a new

Personal Folder name.

5. If you would like to display a warning message to users when placing Secrets in their personal folders, select the

Show user warning message check box and optionally edit the Warning message text.

6. Click Save. A personal folder for each user will now be created in a root-level folder with the Personal Folder

name specified.

When personal folders are enabled, a user will require the Personal Folders role permission in their role to be able to view and use their own personal folder.

V. Secret Templates

1. Creating or Editing a Secret Template

Select Secret Templates from the Administration menu. On this screen, either select a Secret template to edit or create a new one. If creating a new Secret template, a prompt will appear to specify the name of the new template. Enter the new name and proceed. The Secret template Designer page provides all the options for configuring a Secret template as well as which fields will appear on any Secret created from that template.

2. Secret Template Fields

The Secret Template Designer provides a number settings to customize Secret template fields. To add a Secret field, fill out the values and click the button. To delete a field, click the icon. There will be a confirmation dialog box before deletion takes place. To edit a field, click the icon. Click either the icon to save or the icon to discard the changes.

Page 27


a. Secret Template Field Settings

The settings available for fields are listed below:

Field Name Name of the field. This name will be used for the Create New drop-down list on either the

Dashboard’s Create Secret Widget or Home page.

Field Description

Field Type

Is Required

Description of the field.

Type to use in the field. See below for a description of the different fields.

Whether or not the field should require a value. These fields will be checked for correct content when the user attempts to create this Secret. A validation error will be displayed if not entered correctly.

History

Searchable

Edit Requires

Number of values to keep in the field’s history of values.

Whether or not that field should be indexed for searching. By default, passwords are not indexed. File attachments and history fields cannot be indexed for searching.

Minimum permissions on the Secret needed in order to edit the value on the Secret. Valid options are Edit, Owner and Not Editable. This enables the Secret Field to be locked down at a more granular level than other fields on the template.

Hide On View If checked, this field will not be displayed to users when viewing the Secret. The field will only be displayed when the Secret is in Edit mode.

Expose For Display If checked, this field will be available to be displayed as a Custom Column on Dashboard.

All fields that are set to Expose For Display will NOT be encrypted in the Database. Only check this value if the Secret field data is not considered privileged information.

The order of appearance of the fields in the Template Designer grid is the order in which they will appear when the user views or edits a Secret created from this template. The order can be modified through the up and down arrows on the grid.

Default values can be specified on each field by clicking the Edit Defaults button . These added values will appear as a drop down list on any Secret created from this template.

b. Secret Template Field Types

Template fields can be specified as one of several different types to enhance customization.

Text Single-line text field.

Notes

URL

Multi-line text field.

Clickable hyperlink.

Page 28


Password Password type field.

File File attachment link. File attachments are stored in the Microsoft SQL Server database.

3. Additional Changes to a Template

For additional changes to a Secret template, click the Change link on the Secret template Designer page to navigate to the

Secret template Edit page.

Expiration Enabled?

Secret templates allow expiration on certain fields. When the Expiration Enabled? option is turned on, an expiration time interval can be specified for a selected field using the drop down menu. With this option enabled and a time duration specified, Secret Server will begin providing alerts if the Secret field is not changed within the specified

expiration requirements. See Secret Expiration section.

Keep Secret Name History?

If Keep Secret Name History is enabled, Secret Server will keep the specified number of entries for viewing. This feature creates a record of every name used when a new Secret is created.

Edit Passwords button

Only visible for templates that contain a field that is of Password type. It is used to alter the minimum password length

as well as the character set used for the auto-generation of the Secret’s password (see the Editing and Deleting a Secret

section for further details on password auto-generation).

Configure Password Changing button

Used to enable Remote Password Changing on these Secrets. For further details, see the Remote Password Changing

section.

Configure Launcher button

Used to enable Remote Desktop or PUTTY Launcher or custom launchers on these Secrets. For further details, see the

Launcher section.

4. Activating and Inactivating Templates

If a template is no longer relevant or outdated, it can be inactivated. This can be done from the specific template's Secret template Edit page.

Templates can also be inactivated in bulk from the Manage Secret templates screen. Click the Active Templates button to navigate to the Set Active Secret templates screen. This screen displays all the Secret templates in Secret Server. Each

Secret template can be set as active or inactive. Once the Secret templates are chosen as active or inactive, then saving changes will bring the Secret templates into effect immediately. Note that inactivating a Secret template will not inactivate any Secrets using that Secret template – those Secrets will still exist but users won’t be able to create new

Secrets using an inactivated Secret template.

Page 29


5. Character Sets

Character Sets are a collection of distinct characters that are used in Password Requirements and Password Rules. Custom sets can be created and both ASCII and Unicode are supported. For more information on setting up compliance checks

and password generation standards see the Password Requirements section. The 5 standard Character Sets are:

 Lower Case (a-z)

 Upper Case (A-Z)

 Numeric (0-9)

 Non-Alphanumeric (!@#$%^&*())

 Default – Includes all the above

To manage Character Sets click the Character Sets button on the Administration > Secret templates page. Only character sets which are not currently used by a Password Requirement can be deleted.

6. Password Requirements

Requirements can be set on a password field to validate user-entered passwords and/or make auto-generated passwords conform to certain specifications.

A Password Requirement is made up of a minimum and maximum length, a set of characters, and optional rules such as

“At least 3 upper-case characters”. The default password requirement is 12 characters from the Default character set, with at least one upper-case, lower-case, numeric, and symbol character.

Password Requirements can be created or edited through the Password Requirements button on the

Administration>Secret templates page. Character sets can be created or deleted from the Character Sets button next to the Password Requirements button.

Page 30


To set the password requirement for a field for a Secret template, click the Edit Passwords button on the Secret Template

Edit page. Next, click the Edit icon ( ), select the desired Password Requirement, and click the Save icon ( ) to save the changes.

To set a custom password requirement for a specific Secret, use the Customize Password Requirement in the Security tab of a Secret. For further details, see the Security Tab section.

Validation of manually entered passwords can be turned on or off at the Secret template level via the Validate Password

Requirements On Create and Validate Password Requirements On Edit settings.

The What Secrets Do Not Meet Password Requirements report shows Secrets containing a password that does not meet the Password Requirements set for its Secret template.

Password requirements cannot include rules with overlapping character sets. For example, if an attempt is made to add both a

“Minimum of 1 upper-case” rule and a “Minimum of 3 Default” rule to a new password requirement, an error will be displayed.

Page 31


7. Naming Patterns

Secret Server supports naming patterns for Secret templates. Naming patterns are a way for administrators to maintain consistency for Secret names and can help ease both browsing and grouping Secrets by name. Patterns are created using regular expressions. Regular expressions are a formal set of symbols commonly used to match text to patterns.

An example regular expression is ^\w+\\\w+$, which would allow "NTDOMAIN01\USER3454" but not "USER3454 on

NTDOMAIN01". Here the "^" symbolizes the beginning of the text. "\w" specifies alpha-numeric characters, plus the "_" character, while "+" indicates one or more occurrences of the previous symbol. In this case "+" means one or more alphanumeric characters ("\w"). The "\\\" is used to denote a single "\". In regular expressions special characters are escaped with a "\", so to try and match a single slash requires extra escape characters. Lastly the "$" signals the end of the text.

8. Convert to New Template

It is possible to convert Secrets from one Secret template to another. To do this, view a Secret and click on the Convert

Template button. Next, select the target template from the Secret template drop down list. You will then be able to map each field to a new field. To do this, go through each drop down list and select the target field for each source field on your Secret. If you want to remove the value for a field instead of converting it, then select the <Remove> option on the drop down list for that field. When you are done selecting, you can choose a folder and click Save.

The Convert Template button is only available to users and groups with the “Owner” permission to the Secret.

To preserve audit data, when a Secret is converted from one type to another, the old Secret is deleted and a new Secret is created. An admin can view old Secret by searching for deleted Secrets on the dashboard. A user will need “Add Secret,” “Edit Secret,” “Delete

Secret,” and “Share Secret” role permissions in order to convert a Secret to a new template.

VI. Launcher

Secret Server's Launcher opens a connection to the remote computer or device or logs into a website using the Secret's credentials directly from the Web page. While this provides a convenient method of opening RDP and PUTTY connections, it also circumvents users being required to know their passwords. A user can still gain access to a needed machine, but is not required to view or copy the password out of Secret Server. The Web Launcher will automatically log into websites using the client’s browser.

1. Built-In Launcher Types

Remote Desktop

Launches a Windows Remote Desktop session and automatically authenticates the user to the machine.

PUTTY

Opens a PUTTY session and authenticates the user to a Unix system.

Web Password Filler

Uses a bookmarklet or a Chrome extension to automatically log the user into a website with Secret credentials. The

Web Password Filler section has more detailed information.

Page 32


2. Enabling the Launcher

By default, the Launcher is enabled by the Enable Launcher setting under Administration > Configuration.

The Launcher can be deployed in two ways – either with the ClickOnce application or Protocol Handler application. This

can also be configured in the Configuration settings. Protocol Handler allows the Launcher to be used in virtualized

environments, or any environment in which the user does not have access to a Windows Temp directory. The Protocol

Handler can be downloaded from the Tools > Launcher Tools page. For details on use and deployment of Protocol

Handler, see the Protocol Handler Launcher KB article.

3. Remote Desktop Launcher

a. Browser Configuration

Firefox Configuration

Firefox requires a Helper Add-on application to run the RDP and PUTTY Launcher. The Microsoft .Net Framework

Assistant add-on and .NET framework version 3.5 SP1 need to be installed.

Chrome Configuration

Chrome requires a Helper Add-on application to run the RDP and PUTTY Launcher. The ClickOnce add-on for Google

Chrome Add-on needs to be installed.

SSL Certificates

SSL must be set up properly for the RDP launcher to work correctly. If Secret Server is using SSL certificates, they must be trusted at the user's computer. This will only be an issue with self-created certificates.

b. Setting Up the Secret Template

Launchers can be accessed from any Secret created from a properly configured template. By default, the templates

Windows Account, Active Directory Account, Cisco Account (SSH), HP iLO Account (SSH), Unix Account (SSH), Web

Password, and SQL Server Account have the launcher configured. Secrets can be configured for the Launcher from within the Secret Template Designer page. Clicking Configure Launcher displays the options available.

Add a Launcher

Click Add New Launcher to add a Launcher to the template. On the following page, select a Launcher type from the drop-down menu. The fields below will reflect the fields necessary to map to the Launcher. In the case of a custom

Launcher, these fields will be used to run the Launcher process if the Launcher is configured to run as Secret credentials.

Choose a Secret field in the drop-down menu on the right to map to each Launcher value on the left. See the following section for further details on editing Launcher configuration. Click Save to add the Launcher to the template.

Page 33


Edit a Launcher

Click Edit to modify the settings for a Launcher that has already been added to the template. For a Launcher to work properly, Secret Server requires the appropriate credentials to be taken from Secret fields. Fields must be assigned their corresponding credentials from the drop down list. In addition to the Secret Fields, the Domain can be mapped to

<blank> which passes empty string to be used with Local accounts, and the machine or Host can be mapped to <user input> which prompts the user for a specific machine to be used with Domain accounts.

In cases where there are multiple endpoints to connect to, such as with a domain account, the machines can be restricted to a set list. Under the Advanced section of the Secret template Launcher configuration, enable Restrict User Input. When that option is on, the Launcher will show a drop down of machines to connect to, based on a comma-separated list in the specified Secret Field.

c. Session Recording

Session recording provides an additional level of security by recording a user's actions after a launcher is used Session

Recording will work for any launcher, including Putty/SSH, Windows Remote Desktop, Microsoft SQL Management Studio, and custom executables. The resulting movie is viewable from the secret audit. Session recording can be toggled on or off globally on the Configuration page, and set for individual secrets on the Security tab. Detailed information on supported codecs can be found in the Session Recording KB article . When a user launches a session with session recording enabled, a brief message is displayed to inform the user that their actions will be recorded.

Page 34


When multiple Launchers are enabled for a Secret template, enabling session recording for a Secret will apply the setting to all

Launchers for that Secret.

d. Custom Launcher

Secret Server has the ability to wire up a program to run when clicking the Launcher on a Secret. Custom process

Launchers can be customized to work with any application that can be started by command-line and will pass values to the command-line from the Secret fields. In order for process Launchers to work, the client machine will need to have the program installed and typically needs the program folder in the PATH environment variable.

There are three types of custom launchers to choose from:

 Process

Launch a process on the client machine that will connect directly to the target system from the client.

 Proxied SSH Process

Launch a process on the client machine that will proxy its connection to the target system through Secret Server.

See SSH Proxy for more information about configuring Secret Server as a proxy.

 Batch File

Launch a batch file from the client machine.

To create a new Custom Launcher, select Secret Templates from the Administration menu and click the Configure

Launchers button, then click New. The following settings are available:

Launcher Name

Active

Friendly name of the launcher that will be displayed to the user.

Whether or not the Launcher is active for use.

Launcher Type

Process Name

Select Process, Proxied SSH Process, or Batch File.

Name of the process that will be launched.

Page 35


Batch File

Process Arguments

As an alternative to opening a process, upload a .bat file that will be downloaded and executed on the client when the user runs a launcher. The file will be deleted from the client after execution.

Process arguments depend on the process that is being launched. View the built in SQL Server Launcher for examples on how the fields are substituted. For greater flexibility, other Secrets can be linked on the Launcher tab on the Secret.

The field values from those Secrets can also be used in the Process Arguments using the same prefix $[1][FieldName] syntax as the SSH custom commands.

Introduced in 8.1.000035 is a launcher specific token $SESSIONKEY that can be passed to the command line. This passes an identifier to the customer launcher that can be used to anonymously check in the Secret using the

CheckInSecretByKey Web Service method.

Run Process As Secret Credentials If set to true, the process will authenticate as the credentials on the Secret instead of the client user that is using the launcher. This can be overridden at the

Secret level to use a privileged account to run the process.

Use Additional Prompt

Additional Prompt Field Name

If enabled, the user will be prompted for additional information when using the launcher.

Name of the field that will be prompted for when the user uses the launcher.

This value can be referenced in the Process Arguments with a $ prefix.

Default Launcher Requirements

 SQL Server Launcher

Requires SQL Server Management Studio installed. When installed, the program will be automatically added to the

PATH (by default uses 2008).

 Powershell Launcher

Requires Powershell installed. When installed the program will be automatically added to the PATH.

 Sybase isql Launcher

Requires isql.exe installed.

How to Add a Program Folder to the PATH?

Right click on Computer and go to Properties. In the properties window click Advanced system settings. On the

Advanced Tab, click the Environment Variables button. In the System Variables section scroll to Path. Click Edit then at the very end of the Textbox, paste the full path to the folder where the program file is located but make sure not to replace any existing entries. The list is semi-colon separated. Click OK to close the dialogs.

Common Errors

Page 36


 The process (process name) was not found

The application has not been installed on the machine. If the application was installed, the program folder will need to be added to the path.

 The stub received bad data (1783)

The process is set to Launch As the Credentials of the Secret but the username or domain is not correct on the

Secret or the client machine cannot find the user or domain credentials specified.

e. Launching a Session

On the Secret View page, clicking the Launcher icon will launch the Remote Desktop, PUTTY, or custom session directly from the browser or log into the website. The mapped fields will be passed to the Launcher for automatic authentication.

If the machine is set to <user input> for Remote Desktop, the console will launch and allow the machine to be specified from the RDP dialog. If the Host is set to <user input>, a prompt will ask for the specific machine before launching the

PUTTY session. For certain browser security levels, the user will need to click Allow for the Launcher application to open.

The View Launcher Password permission can be removed to prevent users from viewing the credentials, but will still be able to use the authentication session to access the computer.

The settings under the Launcher Tab are used for Secrets that are enabled for custom Launchers.

Page 37


4. SSH Proxy

Launchers using an SSH connection can alternatively use Secret Server as a proxy rather than the launcher connecting directly to the target system from the machine it is being launcher from. To configure this, select SSH Proxy from the

Administration menu and click Edit to enter your configuration settings:

SSH Bind IP Address The IP Address of the network adapter that the Secret Server SSH listener should bind to. This should not be localhost or 127.0.0.1.

SSH Public Host

SSH Proxy Port

The public hostname or IP that the client launcher will connect to. In most cases this can be the same as the SSH Bind IP, however there may be cases where the public IP or host differs than the private IP that Secret Server should bind to.

The port Secret Server will listen on. Default is 22.

SSH Banner

Users connecting through Secret Server will see this as a banner on the SSH client.

SSH Proxy Private Key The Secret Server SSH private key, this can be generated using the corresponding button.

Inactivity Timeout

Closes the session if there is inactivity for a certain number of seconds.

Page 38


Once SSH Proxy has been configured, Secrets using an SSH Launcher will have an additional Show Proxy Credentials button available. Clicking this button will display credentials that can be used to connect through Secret Server to the target system, the case that a user would like to start an SSH session manually.

5. Web Password Filler

The Web Password Filler is a login helper that can be used on any web site with a login. To use the Web Password Filler you need to drag a link to the bookmark bar of your browser. The link is available by going to any secret which uses the

Web Password Secret template or any other Secret template that has a searchable URL field.

Once you have the link on your browser bookmark toolbar, it is ready to use. Navigate to the login page of the website you wish to log in to, and then click the web password filler link. A dialog will open on the login page with the Web

Password Filler. The Web Password Filler will show you available Secrets that match the current URL for you to login with.

It will also permit you to create new Secrets for the website.

Page 39


6. Web Launcher

The Web Launcher provides a convenient click to automatically log into websites. By default, the web launcher is enabled

on the Secret template Web Password, but can be enabled on custom templates as well as described in Enabling the

Launcher .

a. Configuring the Web Launcher for a Secret

Once enabled on the template, the Web Launcher will need to be configured for the Secret. Each website login is unique and will require the Secret fields to be mapped to the form controls. For a new Secret the Launcher icon will appear and clicking on it will take the user to a configuration screen. The user can also view and access the configuration screen from the Launcher Tab. Depending on whether other Secrets with the same website have been configured, the user will have different options.

Configuring the Secret for use with the Web Launcher requires the user to have Owner permission on the Secret.

First, there is the option of downloading the setting from Thycotic.com. When the Configure Web Launcher page is loaded, Secret Server will check online at Thycotic.com for pre-approved matching websites. If any are found, they are downloaded and made available to pick from in the dropdown list.

This functionality can be disabled in Secret Server in the Configuration Settings. See the Configuration Settings section for further

details.

The drop down list will list all downloaded configurations and other Secrets’ configuration for the same domain that the user has permission to view. Select one from the drop down list and click Next to create a copy of the settings for the

Secret.

There is also an option to create a configuration which will allow the Web Launcher to be used on most websites and not rely on published configuration settings. In order to use this select the last item in the dropdown list and click Next. The next section will discuss the create process.

b. Creating a Configuration

Entering the Login URL

Secret Server needs to know the exact URL used to login to be able to figure out the controls and perform the automatic login. Some example login URLS:

 https://login.yahoo.com/config/login

 https://MyServer/Billing/login.aspx

 https://firewall07/login/

The Login URL is typically a secure site with a prefix of https://. If allowed to access the site, Secret Server will automatically detect if https should be used to ensure the credentials are passed securely.

Page 40


Providing the Page Source

If Secret Server is not allowed access to sites, or the login URL is not accessible by an external site, the page source will need to be provided for the Web Launcher controls to be obtained. Ensure the login URL is correct when the page source is taken. If the site can be accessed by Secret Server the page source will be automatically obtained and this step will not be present.

Choosing the Form

The page will be read and the exact login form will need to be identified. The page forms will be listed in the drop down list with the most likely selected. If no forms or no likely forms are found, the user will need to update the URL or page source, as configuration must have at least one textbox and one password box.

Wiring Up the Fields to Controls

In most cases Secret Server will automatically wire up the Username and Password fields to the correct page controls. If not the user will complete the control mapping on the Launcher tab.

c. Launching to a Website

The Web Launcher can be used by clicking the Launcher icon on the Secret View page. The Web Launcher will open a new window in the browser which will attempt to login to the site using the credentials on the Secret. The Launcher can also be used with the Test Launcher button on the Launcher Tab. Testing the Launcher will create a dialog to offer troubleshooting help and means to upload the configuration to Thycotic.com. The uploaded configuration will be reviewed and published by Thycotic for all Secret Server customers to use with the Check Online feature. No Secret or identifiable information is uploaded to Thycotic.com. Only the website URL and control names are sent.

VII. Setting up Password Masking

Password Masking prevents over the shoulder viewing of your passwords by a casual observer (passwords show as

*******). Note the number of asterisk does not relate to the length of the password for added security.

As an administrator, you can force all the Secret Password fields in the system when viewed to be masked. To do this, enable the Force Password Masking setting in the Configuration settings. Only Secret fields marked as a password field on the Secret template will be masked.

There is also a user preference setting which will force password masking on all Secret Password fields viewed by the user.

This Mask passwords when viewing Secrets setting is found in the Tools>Preference section for each user. Note that if the

Configuration setting discussed above is enabled, this user preference setting will be overridden and cannot be disabled.

See the Viewing a Secret section for instructions on unmasking the password using the lock icon.

VIII. Secret Expiration

A core feature of Secret Server is Secret expiration. Any template can be set to expire within a fixed time interval. For a

Secret to expire, a field must be selected as the target of the expiration. For example, a Secret template for Active

Directory accounts might require a change on the password field every 90 days. If the password remains unchanged past

Page 41


the length of time specified, that Secret is considered expired and will appear in the Expired Secrets panel on either the

Dashboard’s Expired Secrets widget or the Home page.

Secret expiration provides additional security by reminding users when sensitive data requires review. This can assist in meeting compliance requirements that mandate certain passwords be changed on a regular basis. When expiration is combined with Remote Password Changing, Secret Server can completely automate the process of regularly changing entire sets of passwords to meet security needs.

1. Setting up Secret Expiration for the Secret template

To set up expiration on a Secret, you must first enable expiration on the template from which the Secret is created.

To enable Secret expiration for a Secret template, navigate to Administration > Secret templates. In the Manage Secret templates page, select the template from the dropdown list and click the Edit button. In the Secret template Designer page, click on the Change link. On this subsequent page, check the Expiration Enabled? box. You can now enter the expiration interval (every x number of days) as well as the field on the Secret you wish to expire and require to be changed. The interval setting can be overridden for each individual Secret (see below).

Enabling expiration for a template will enable expiration for all the Secrets that were created using this template.

2. Setting up Secret Expiration for the Secret

Now that expiration has been enabled for the template, Secret expiration is enabled for the Secrets that were created using that template as well as Secrets created in the future. The Expiration tab will appear on the Secret View page and requires the user to have Owner permission on the Secret. If you would prefer to set a custom expiration at the Secret level, you can adjust the interval of expiration for the Secret by clicking the Expiration tab in the Secret View page. In the

Expiration tab, you can set the Secret to expire using the template settings (default), a custom interval, or a specific date in the future.

3. Forcing Expiration

To force expiration, navigate to the Secret View page. From there, click Expire Now. This will force the Secret to expire immediately regardless of the interval setting. The expiration date will read "Expiration Forced".

4. Resetting an Expired Secret

To reset an expired Secret, you will need to change the field that has expired and is required to change. For example, if the field set to expire is the Password field and the current Password is "asdf", then a change to "jklh" will reset the expiration interval and thus remove the expiration text on the Secret View page.

If you do not know which field is set to expire, you will need to go to the Secret template that the Secret was created from. Navigate to Administration > Secret template and select the template. Click the Edit button and then on the next page, click the "Change" link. In the "Change Required On" textbox you will see the field that is set to expire.

Page 42


IX. DoubleLock

DoubleLock provides an additional layer of security by encrypting Secret data with a custom encryption key that is only accessible with an additional password, regardless of permissions or physical access to the machine running Secret Server.

DoubleLock uses private/public key encryption technology to securely share access to the DoubleLock among users when access is granted.

1. Creating a DoubleLock Password

Before creating a DoubleLock, you will need to create a DoubleLock password. This password will be used to generate

DoubleLock keys that encrypt sensitive secrets.

Any reference to a password while using DoubleLock will refer to this DoubleLock password, not the user’s Secret Server login password.

2. Creating a DoubleLock

A DoubleLock is the entity key used to encrypt a given Secret and allow assigned users access to the encrypted Secret.

As an Administrator, to use the DoubleLock functionality on your Secrets, you must first create a DoubleLock. To do that, navigate to Administration > DoubleLock. If you have not created a DoubleLock password yet, you will be prompted to create one.

Before creating a new DoubleLock, you may be prompted to enter your DoubleLock password. After DoubleLock creation, you can assign the DoubleLock to other users who already have DoubleLock passwords. These other users will be able to access the Secrets that use this DoubleLock by entering their own DoubleLock password to access each Secret.

3. Assigning a DoubleLock to a Secret

To assign a DoubleLock, navigate to the Security tab of the Secret View page for the Secret. In there, click the Enable

DoubleLock checkbox. You can now select from a dropdown list the DoubleLock to assign to the Secret.

4. Changing a DoubleLock Password

A user my change their DoubleLock password by going to Tools > Change DoubleLock Password. The change will update the encryption on the DoubleLock keys for that user and will not affect other users assigned to a common DoubleLock.

5. Resetting a DoubleLock Password

In the event a user forgets their DoubleLock password, it can be reset by going to Tools > Reset Double Lock Password.

This will result in the loss of access to existing DoubleLocked Secrets.

In the case the DoubleLocked Secret is only accessible by the user, the Secret will be deleted and the data permanently lost, as the password used to encrypt the Secret has been removed. Once the DoubleLock is reset, the other users assigned to a DoubleLock will need to reassign the user who reset their password.

Page 43


X. Secret Check Out

The Check Out feature forces accountability on Secrets by granting exclusive access to a single user. If a Secret is configured for Check Out, a user can then access it. If Change Password on Check In is turned on, after “check in,” Secret

Server automatically forces a password change on the remote machine. No other user can access a Secret while it is

checked out except Unlimited Administrators (see the Unlimited Administration Mode section). This guarantees that if the

remote machine is accessed using the Secret, the user who had it checked out was the only one with proper credentials at that time.

The exception to the exclusive access rule is the assignment of Unlimited Administrator. If Unlimited Administration is enabled, users with Unlimited Administrator Role permission can access checked out Secrets.

1. Configuring Password Changing on Check In

To configure Change Password on Check In, navigate to the Remote Password Changing administration page and set

Enable Password Changing on Check In. If Remote Password Changing is turned off, it will need to be enabled before

Check Out can be configured. Once Remote Password Changing and Check Out are enabled, Secrets can be configured for

Change Password on Check In and Check Out. Optionally, you can also set a Check Out interval that specifies how long a user will have exclusive access to the Secret.

2. Checking Out Secrets

Each Secret must be individually set to require Check Out. From the Secret View page, open the Security tab to modify a

Secret's Check Out setting. The Secret needs to be configured for Remote Password Changing before Change Password on

Check In can be set. Enable Require Check Out to force users to check out the Secret before gaining access. And Enable

Change Password on Check In to have the password change after the secret is “Checked in.”

Page 44


3. Configuring a Secret for Check Out

After Require Check Out is enabled, users will be prompted for Check Out when attempting to view that Secret.

4. Exclusive Access

Any user attempting to view a checked out Secret will be directed to a notification dialog informing them when the Secret will be available. Secret Server automatically checks in Secrets after either 30 minutes or the interval specified on the

Secret. Users can check in the Secret earlier from the Secret's page.

Page 45


5. Check Out Hooks

In addition to change the password on Check In, Secret Owners can also specify Administrator created PowerShell scripts to run before or after Check Out and Check In. These are accessed from the Hooks tab of the Secret, which will only show if Check Out is enabled and PowerShell scripts have been created by an Administrator. To specify a Before or After Check

Out hook, click Create New Hook and specify the following settings:

Before/After

Event Action

Whether the PowerShell script should run before or after the Event Action.

The Hook will run at either Check In or Check Out.

Name

Description

A descriptive name for the Hook.

An extended description for the purpose of the Hook.

PowerShell Script Administrator-created PowerShell script to run.

Arguments

Stop On Failure

Any command line arguments to pass to the PowerShell script.

If enabled, Secret Server will prevent the Event Action if the script returns an error. For example, if Stop On Failure is selected for a Check Out action, then Secret Server will prevent the user from Checking Out the Secret if the script fails.

Privileged Account If needed, the script can run as another Secret’s identity.

XI. Requires Approval for Access

The Access Request feature allows a Secret to require approval prior to accessing the Secret. Establishing a workflow model, the user will have to request access from the approval group or groups. An email will be sent to everyone in the approval groups, notifying them of the request. The request can be approved or denied by any members of the approval groups. Access will be granted for a set time period. If Owners and Approvers also Require Approval is enabled, then even users who are Owners or are in an approval group will need to request access.

1. Setting up Access Request for a Secret

To enable Access Request for a Secret, navigate to the Secret View page for the Secret. Go into the Security tab and click the Edit button. You can then check the Enable Requires Approval for Access checkbox to enable the setting. Once enabled, you must then select users or Groups as Approvers for the Secret. Unless the Owners and Approvers also Require

Approval option is turned on, users with Owner share permission for the Secret, or users that are members of the

Approvers Group will not need to request access to view the Secret.

Users need at least View access to the Secret to be able to access the Secret even with Access Request enabled. If the users do not have View permission they will be unable to find the Secret with Search or Browse.

The email configuration settings will need to be set up, as well as valid email addresses, for the users in the approval group for the emailing functionality to work.

Page 46


2. Requesting Access after Approval is Granted

To start the request process for access to a Secret, the user must simply attempt to view the Secret. The user will then be sent to the Request page. In there, the user can explain the reason for the request and then click Request Access to submit the request.

If a member of the Approval Group either approves or denies the request (see below for details), the requestor will be sent an email with the details. If approved, the requestor can access the Secret via the link contained in the email.

3. Approving a Request

Once a request for access to a Secret has been made, Approvers will receive an email. The email will contain one link to the Secret Access Request Approval page for that request in Secret Server, and five additional links to approve or deny the request if the Allow Approval For Access from Email configuration setting is enabled. The approver can either click one of the links contained in the email or navigate to Tools > Manage Secret Access Requests within Secret Server. If choosing the latter, in the displayed grid click Pending in the Status column. This will take you to the Secret Access Request

Approval page. From here, you can accept or deny the request as well as set an expiration date. The requestor will have access to the Secret until the specified date. Selecting the current date is the smallest window of time allowed and will grant access to the end of the day. With Allow Approval For Access from Email enabled, clicking one of the five additional links in the email will allow access for 1, 2, 4, or 8 hours OR deny the request, per the link description in the email.

The expiration date referred to in approval requests is not the same as Secret expiration.

XII. Remote Password Changing

Remote Password Changing (RPC) allows properly configured Secrets to automatically update a corresponding remote account. Secrets can be set for automatic expiry so Secret Server will automatically generate a new strong password and change the remote password to keep all the account synchronized with Secret Server.

If Secret Server fails to change a remote password, an alert will appear notifying that there are Secrets out of sync.

1. Remote Accounts Supported

For the most up-to-date list of account types supported by Remote Password Changing, see this KB article .

2. Enabling Remote Password Changing in Secret Server

RPC is enabled under the Administration, Remote Password Changing page. Click edit to enable Remote Password

Changing, Secret Heartbeat, and Secret Checkout. Once enabled, all Secret templates with RPC configured will be available to use RPC.

3. Configuring a Secret for AutoChange

The Remote Password Changing tab contains the settings for configuring RPC on an individual Secret. Enabling

AutoChange on a Secret will allow Secret Server to Remotely Change the Password when it expires. The user must have

Page 47


Owner permission on the Secret to enable AutoChange. When editing on the RPC tab, the Next Password field can be set or if left blank an auto-generated password will be used.

If the password change fails, Secret Server will flag the Secret as Out of Sync and continue to retry until it is successful. If the Secret cannot be corrected or brought In Sync, manually disabling AutoChange will stop the Secret from being retried.

a. Privileged Accounts and Reset Secrets

By default, RPC uses the Credentials on Secret option, using the credentials stored in the Secret to invoke a password change. For Windows and Active Directory accounts, a privileged account can be used instead by selecting the Privileged

Account Credentials option and selecting an Active Directory Secret with permission to change the account’s password.

For Secret templates with a Custom Commands Password Type, any number of associated Reset Secrets can assigned for use in the Custom Commands. See section Custom Command Sets (Professional or Enterprise Edition) for more details on using the Reset Secrets in Custom Commands.

When a Secret is wired up with a Privileged account or Reset Secrets, the ability to Edit the username, Host, Domain, or

Machine is restricted if the user does not have access to those associated Secrets. On the RPC tab, the user will see “You do not have access to View this Secret” for the Secret name and on the Edit screen all fields mapped for RPC except the

Password will be disabled. This added security prevents the user from changing the username and resetting another account’s Password.

If the user does not have access to the privileged account or reset Secrets, the ability to edit all Secret fields mapped for RPC except the password field is restricted to prevent changing the password on another account.

b. Change Password Remotely

On the RPC tab there is a button called Change Password Remotely that allows the use to change the password immediately instead of waiting for it to expire. When this button is clicked the user is taken to the Change Password

Remotely page where they are able to enter in or generate the new password for the account. When the user clicks the

Change button the secret will enter the queue for having its password changed. The RPC Log found on the Administration,

Remote Password Changing page details the results of the password change attempts and can be used for debugging.

If the password change fails, Secret Server will continue to retry until it is successful or the change is canceled by the user. In order to manually cancel the change, click Cancel Password Change on the RPC tab.

c. Configuring Remote Password Changing – Mapping Account Fields

All the Secret templates with the prefix RPC have RPC configured by default. For creating a custom template that uses RPC it can be configured from the Secret template Designer. Enable Remote Password Changing must be turned on for Secrets created from the template to make use of this feature. Select the password type for the account and map the fields to be used for authenticating to the remote server. The Secret Fields will need to be mapped to the corresponding required fields based on the Password change type.

Page 48


The Retry Interval field is the amount of time that a Secret will wait before once again attempting to change a password after a password change is unable to succeed.

The Default Privileged Account field is the Secret that will be set as the privileged account for all new Secrets that are created with this Secret template. Changing this will not affect any existing Secrets.

d. Ports Required for Remote Password Changing

Password Changer Type Port(s)

Unix SSH 22

Unix Telnet

Microsoft SQL Server

23

1433

Windows Kerberos

Windows NTLM

Active Directory

Sybase

Oracle

88 or 441

445

389 or 636

5000

1521 or 1526

e. AutoChange Schedule

The AutoChange Schedule button will be visible on the Secret View RPC tab when RPC and AutoChange is enabled on a

Secret. The AutoChange Schedule page allows you to specify an interval, start date, start time, and time frame for when the password is allowed to be changed. This setting is useful for having the Remote Password Change occur during offhours in order to prevent disruptions. By default, this setting will be None, which allows the Secret to be changed immediately. Note that regardless of the AutoChange Schedule, the password will still have to expire before being automatically changed.

Page 49


While the password change is waiting for this next scheduled time, the Remote Password Changing Log (visible by navigating to

Configuration > Remote Password Changing) will report the Secret could not be changed because of time schedule. The Secret will also remain expired until this AutoChange Schedule is reached, even if the Secret was forced to expire.

4. Remote Password Changing for Service Accounts

RPC can be performed on Service accounts where the dependent services will be automatically updated and restarted as the service account password is changed. Administrators will be notified if a dependency fails to restart. The supported dependency types are IIS Application Pools, IIS Application Pool Recycle, Scheduled Tasks, Windows Services, PowerShell scripts, and passwords embedded in .ini, .config, and other text files. PowerShell script Dependencies are Enterprise Plus only. The Application Pool Recycle will only recycle the specified Application Pool, it does not update the password of the

Service Account running the Application Pool.

a. Configuring the Dependency Tab

Dependencies are items that rely on the username and password stored in the Secret. By adding them to the dependencies tab, they will automatically be updated when the Secret's password is changed, ensuring they are up to date with the account on which they depend.

b. Dependency Settings and Information

Machine Name

Dependency Type

Dependency Name

Privileged Account

Status

Active

Description

Regex

File Path

Script

Computer name or IP address on which the dependency is located.

Whether the Dependency is an IIS Application Pool, Scheduled Task, Windows Service, Remote

File, or COM+ Application.

Name of the Dependency on the remote machine.

The account Secret Server will authenticate as when changing the Dependency's credentials, so it must have privileges on the remote machine to edit the Dependency.

Whether the Dependency was successfully updated during the last password change.

Whether Secret Server will attempt to update the Dependency. An inactive Dependency will be ignored by Secret Server.

Description of the Dependency for documentation purposes.

For Remote File Dependency types, the regular expression used to locate the password embedded in the file.

For Remote File Dependency types, the file path on the remote server where the embedded password exists.

For PowerShell Script Dependency types, the admin uploaded script to execute.

Page 50


Arguments For PowerShell Script Dependency types, the command line arguments for the script. Secret field values can be used as command line arguments by specifying $FIELDNAME where

FIELDNAME is the name of a Secret Field, i.e. $USERNAME.

Example values for a Windows Service Dependency on a remote computer might be: 192.11.158.99, Windows Service, aspnet_state, DOMAIN\admin.

Due to security constraints, Dependencies other than Windows Services may not be changed if they are on the same machine as the

Secret Server installation. Additionally, Scheduled Tasks require an Active Directory domain user as the Privileged Account.

c. Manually Adding a Dependency

To manually add a dependency, click on the plus icon next to Create New Dependency on the Dependencies tab. Then, choose your dependency type from the drop down list. Next, fill in the Dependency Name, Machine Name, and other information depending on the Dependency type. To choose the account used to change the Dependency password, click on the link next to the Privileged Account label. If the Privileged Account is blank, the current Secret’s credentials will be used. Click the OK button to finish adding the Dependency.

d. Dependency Finder

To automate adding all impacted Windows Services, the Dependency Finder can be used to search domain computers for services running under the credentials on the Secret. On the Dependency Tab, click the Find Dependency button, and then enter the domain and credentials to search for computers in Active Directory. The username and domain name will be saved for faster searching in the future. Entering Computer Names will limit the search to specific computers. When leaving Computer Names blank, the computer’s screen will list all computers within the domain, and the user can choose the computers to be searched. Each computer search may take a while as the Windows Services are located. The next step of the Dependency Finder is to select the desired dependencies and then set the Privileged Account. The

Dependency Finder will create and add service dependencies to the Secret. Dependency Finder will filter out dependencies already setup on the secret.

The Dependency Finder is only available on for Active Directory accounts.

5. Custom Password Changers

The Password Changers Configuration page can be accessed by navigating to Administration > Remote Password Changing

> Configure Password Changers.

There are a few Password changing types that allow the user to enter in specific commands that will be sent to the computer where the password is changing. This enables the system to accommodate for differences in the standard password change procedure. For example: The Unix system that is being changed prompts for the current password twice instead of only once before asking for the new password.

Page 51


a. Modifying Password Changers

The following table lists the password changers that ship with Secret Server and which parameters can be customized and tested:

Password Changer

 Active Directory Account

Customizable Parameters Test actions

 Password Reset Commands

 Verify Password Changed Commands

 Password Reset By Admin Credentials

Commands



 Amazon (Web User Account)

 Blue Coat Account Custom (SSH)

 Blue Coat Enable Password

Custom (SSH)

 Cisco Account Custom (SSH)

 Cisco Enable Secret Custom

(SSH)

 HP iLO Account Custom (SSH)

 Juniper Account Custom (SSH)

 Cisco Account Custom (Telnet)

 Cisco Enable Secret Custom

(Telnet)

 Google (Web User Account)

 LDAP (Active Directory)

 LDAP (DSEE)

 LDAP (OpenLDAP)

 MySQL Account

 Oracle Account

 Oracle Account (AS SYS)

 Oracle Account (DataSource)

 Commands

 Line Ending

 Custom Port

 Use SSH Password

Authentication

 Commands

 Line Ending

 Custom Port

 Line Ending

 Custom Port



LDAP Settings

 Line Ending

 Custom Port










Commands




Commands



 PostgreSQL

 Reset Commands

 Connection String

 Custom Port



Page 52


Password Changer

 Salesforce (Web User Account)

Customizable Parameters

 SAP Account

 SonicWall NSA Admin Account

 SonicWall NSA Local User

Account

 SQL Server Account

 Line Ending

 Custom Port

 Sybase Account

 Unix Account (SSH)

 Unix Account (Telnet)

 Unix Account Custom (SSH)

 Unix Root Account Custom (SSH)

 Unix Account Custom (Telnet)

 Commands

 Line Ending

 Custom Port

 Use SSH Password

Authentication

 Commands

 Line Ending

 Custom Port

 Windows Account

Test actions






Commands






Commands




Commands




Commands










Commands

Page 53


b. Deactivating Password Changers

To make a password changer unavailable for use and to hide it from view in your list of password changers, you will need to mark it as inactive:

 From the Password Changers Configuration page, click the Password Type Name of the password changer you would like to make inactive.

 Click Edit.

 Uncheck the Active box.

 Click Save.

To view inactive password changers, check the Show Inactive box at the bottom of the list of password changers. The

Active column in the table will indicate the status of the password changer.

c. Changing Ports and Line Endings

To change the port or line ending used on a password changer, click the password changer on the Configure Password

Changers page and then click Edit. There, you can choose the line ending and port used by the device. By default, line endings are set to New Line (\n), however some devices and applications (such as HP iLO) use a different line ending system. The port defaults to 22 for SSH connections and 23 for Telnet connections.

d. Editing a Custom Command

The SSH type changers use the SSH protocol to access the machine. This type only contains custom commands for the password reset functionality. The Telnet type changers use the Telnet protocol in order to access the machine and contain custom commands for both the password reset and the verify password functionality. The Verify functionality is used in the Heartbeat, as well as verifying that the password was changed successfully.

To edit the custom commands, click on the Edit Commands button. This will set the command grids into Edit mode where you can add, update, or delete the commands in order to suit their purpose.

Any Secret Field value can be substituted by prefacing the Field Name with a ‘$’. For example, in order to echo the Notes value for a Secret, the user would enter: echo ‘$Notes’ as a command. Along with these Secret Field values, the following variables are available in custom commands:

RPC Mapped Fields

 $USERNAME

The username field mapped in RPC on the Secret template.

 $CURRENTPASSWORD

The password field mapped in RPC on the Secret template.

 $NEWPASSWORD

The next password (filled in Next Password textbox or auto-generated).

Associated Reset Secrets

Page 54


 $[1]

Adding this prefix to any field will target the associated Reset Secret with order 1.

 $[1]$USERNAME

The mapped username of the associated secret.

Both the mapped fields and Secret Field names can be used.

Check Result Commands

 $$CHECKFOR <text>

Checks that the response from the last command equals <text>

 $$CHECKCONTAINS <text>

Checks that the response from last command contains <text>

If these conditions are not met the process fails and immediately returns a result.

You can test out your Password Reset and Verify Password command sets by clicking on the Test Action buttons next to the relevant sections. All communication between Secret Server and the target machine will be displayed when using these test buttons.

e. Creating a New Custom Command Password Changer

 From the Password Changers Configuration page, click New.

 Select a base password changer – it is recommend that you select the option that most closely matches the type of password changer you will be creating, as this determines which customizable parameters and test actions will be available to you.

 On the next page, make any customizations you would like. To save a new command, click the + icon at the end of the row. The command can be edited once more by clicking the edit button, which is labeled with a small pencil icon at the end of the row.

 To access the test actions for your new password changer, click Back to return to the overview screen.

 To edit additional parameters (if applicable), click Edit from the password changer overview to change settings such as the Name, Line Ending, and Custom Port.

6. Heartbeat

Heartbeat allows properly configured Secrets to have the entered credentials automatically tested for accuracy at a given interval. Using Heartbeat on Secrets will ensure the credentials stored in Secret Server are up-to-date and can alert administrators if the credentials are changed outside of Secret Server. Heartbeat helps manage Secrets and prevent them from being out of sync.

a. Remote Accounts Supported

For the most up-to-date list of account types supported by Remote Password Changing, see this KB article .

Page 55


b. Enabling Heartbeat

To enable Heartbeat, Enable Heartbeat must first be turned on in the Remote Password Changing Configuration page

(navigate to Administration > Remote Password Changing). It must also be set on the Secret template by enabling the

Enable Remote Password Changing Heartbeat setting.

c. Configuring Heartbeat

Heartbeat is configured from the Secret template Designer. The Heartbeat interval will determine how often the Secret

credentials will be tested. See the RPC Section on Configuring Remote Password Changing - Mapping Account Fields .

d. Using Heartbeat

Heartbeat will run in a background thread to check each Secret where it is enabled. If the credential test fails the Secret will be flagged as Heartbeat Failed and out of sync. To avoid locking out the account, Heartbeat will no longer run on that

Secret until the Secret items are edited by the user. If the machine is determined to be Unavailable the Secret will be flagged as Heartbeat Unable to Connect and the Secret will continue to be checked on the Heartbeat interval.

To manually use Heartbeat to check the credentials the Secret View page has the Heartbeat Now button. The Heartbeat

Now button will mark the password as Heartbeat Pending. The background thread will process the Secret in the next 10

Secrets and when the page is refreshed the Heartbeat Status will be updated.

Heartbeat for Windows Accounts is not compatible for accounts on the server that is running Secret Server. These accounts will be flagged with a status of Incompatible Host.

e. Alerts on Failure

On the Preferences page, the Send email alerts when Heartbeat fails for Secrets setting can be enabled to email the user

when Heartbeat fails for any Secret the user has View access to.

7. Remote Agents

Remote Agents allow Remote Password Changing and Heartbeat to occur on networks that are not directly connected to the network that Secret Server is installed on.

a. Enabling Remote Agents

To enable Remote Agent support in Secret Server, perform the following steps:

 Navigate to the Administration > Remote Password Changing within Secret Server.

 Click Agent Configuration and then click Edit to edit the Remote Password Changing Agent Configuration.

 Check the Enable Remote Agents box and click Save.

b. Create an Agent Installer

In order to create a Remote Agent installer, perform the following steps:

Page 56


 Navigate to the Administration > Remote Password Changing within Secret Server.

 Click Download Agent Installer.

c. Installing an Agent

 Extract the zip file that was created in previous section and run the "SecretServerAgentInstaller.msi" file from the remote computer that you are installing the Agent on.

 Follow the installation instructions in the installer and take note of the "Confirmation Code" that is displayed.

 Go back into Secret Server and click the "Manage Agents" button, your new installed Agent should be there (or will be in a minute or two).

 Click on the Agent name and then click on the "Activate" button if the Confirmation Code matches what was displayed when the Agent was installed.

 The Agent is now available to be used for Heartbeat and RPC.

d. Assigning an Agent to a Secret

In order to use a Remote Agent to use RPC or perform a Heartbeat on a Secret, perform the following steps:

 Open the RPC-enabled Secret.

 Navigate to the Remote Password Changing tab.

 Click Edit.

 Choose the preferred Agent from the dropdown list and click Save.

That Secret will now use the selected Agent when a RPC or Heartbeat action is called on the Secret.

For additional information on agents, please read the following KB article: Remote Agent FAQ .

8. Powershell Scripts

PowerShell Scripts for post-password change custom actions can be created by Administrators with the role permission called Administer PowerShell Scripts. The scripts can be accessed by going to Administration > Remote Password Changing

> PowerShell Scripts.

Secret Server requires that WinRM is configured on the web server, for instructions please see the following KB article: Configuring

WinRM for PowerShell .

a. Creating a PowerShell Script

On the PowerShell Administration screen click Create New and enter the name of the script, a description, and the commands to run, then click OK. The Script now shows up in the grid. Scripts can be deactivated and reactivated from the grid.

b. Testing a PowerShell Script

All PowerShell scripts will run from the machine that Secret Server is installed on, or the Agent assigned to the Secret. To test a Script click the Test button on the grid next to the corresponding script.

Page 57


PowerShell scripts will run as the identity of the Secret, so enter in an Active Directory credential to run the script as. Then enter in any command line arguments that the script requires. The output of the script will be displayed above the grid for debugging purposes.

c. Using a PowerShell Script

To run a PowerShell Script after a password change occurs it must be set as a Dependency on the Secret. On any Secret enabled for Remote Password Changing, go to the Dependencies tab and click Create New Dependency. From the list, select any active PowerShell Script and define the arguments that should be passed in to the script.

After a password change on the Secret occurs, Secret Server will run the PowerShell Script selected.

d. Auditing

A full history of each PowerShell script is kept and can be downloaded from the audit trail. Click View Audit to view the audit trail for PowerShell. Each time a script is updated, the previous one can be downloaded from the corresponding audit record.

For additional information on setting up PowerShell scripts, please read the following KB article: Creating and Using PowerShell

Scripts .

XIII. Searching Secrets

Searching Secrets is performed on the Dashboard from the Search/Browse widget. To make searches more precise, the results can be limited by way of the various parameters available when clicking the Advanced link. Searches will search for all fields that are configured to be “searchable” on the Secret’s template if the Extended Search Indexer is enabled. If the

Search Indexer is not enabled, searches will only be performed on the Secret Name field.

The Browse tab is a quick way to view all active Secrets available regardless of folders or search parameters.

Page 58


1. Search Indexer

The Search Indexer allows searching on all fields set to Searchable on the template. From the Administration > Search

Indexer, click the Edit button to configure and enable the indexing service. Save any changes and the Indexer will start indexing all the Secrets. The progress is displayed on the Search Indexer Administration page and indexing may take some time depending on the size of the installation. The indexer runs in the background to avoid the undesirable effect of decreased performance caused by using full server resources.

2. Search Indexer Edit

Standard Search mode is the default search mode. Standard searching creates indexes on the values of each field set to

Searchable (previously Indexable) on the template. However, it will only search on whole words in these fields. For example, a Secret with a field value of “Thycotic” would only match a search for “Thycotic”.

Extended Search allows searching on both whole words and sections of words (minimum three letters). For example, the

Secret with a field value of "Thycotic" would be returned on a search for "Thycotic" or "thy" or "cotic". This allows for more fine-grained search results, but may impact search performance as well as create a larger index table.

Indexing Separators are used to split the text fields into search terms. By default the separators are semi-colon, space, forward slash, back slash, tab (\t), new-line (\n), return (\r), and comma. Changes to the Indexing Separators will require a full rebuild of the search index.

XIV. Secret Import

Secret Server's Import feature simplifies integration with legacy systems and allows users to easily add large numbers of

Secrets from an Excel or CSV/Tab delimited file. Secrets are batch imported by template, so multiple types of input data will need to be imported in several batches. The Password Migration Tool supports easy addition of existing Secrets from other third party password storing applications.

Page 59


1. Configuring Data for Import

To get started, click Import Secrets from the Tools page. A template corresponding to the type of data in the input file must then be selected; then Continue to add the Secrets.

Paste the Secrets for import directly into the text area in the Import Secrets dialog. The order of the fields being imported will be listed depending on the template selected. A few items to note when importing Secrets:

 Do not include a header line.

 Secret Names must be included but others fields can be blank unless the Secret template indicates that the field is required.

 Fields containing commas or tabs must be surrounded with double quotes.

There are two options for importing Secrets: Ignore Duplicate Secrets and Import With Folder. Ignore Duplicate Secrets will prevent the import of any Secrets with the same name of an already existing Secret. Import With Folder allows an additional field in the import text specifying a fully qualified folder name for the Secret to be created in. Secret Server will display a preview of the new Secrets prior to being imported.

2. Importing Secrets

a. Secret Server Migration Tool

Secret Server offers a migration utility for users wishing to import Secrets from other applications. Currently, the

Migration Tool supports to following applications:

 Password Corral

 KeePass

 Password Safe

This is done with another Export Tool that creates a single XML file. Please contact support for more details.

Page 60


b. Advanced XML Import

The Advanced Import will add folders, Secret templates, and Secrets based on an XML file. Permissions can be specified on the folders and Secrets or the default is to inherit permissions. This import can only be done by administrators with proper role permissions.

For details on the XML file, see the Knowledge Base article Advanced Import with XML .

XV. Discovery

As an alternative to manually creating or importing accounts, Secret Server has an automatic Discovery option for local

Windows accounts, Active Directory Service Accounts, Unix Accounts, and VMware ESX/ESXi accounts. This allows administrators to quickly import accounts found by Secret Server on specified domains or IP addresses.

Please reference the Discovery Guide for a comprehensive guide to configuring and using Discovery.

To run Discovery on your domain(s), you will need to first enable the Discovery feature for Secret Server. Second, you will need to enable Discovery for each Discovery source you would like to be scanned. For Active Directory sources, this also involves selecting either the entire domain or specific OU’s to be scanned.

Enable Discovery for Secret Server

1. On the Administration menu click Discovery, and then click Edit.

2. Select the Enable Discovery check box.

3. Select or unselect the check boxes allowing each type of Discovery. By default all of these will be selected. For

more information, see Discovery Types .

4. Fill in the Synchronization Interval for Discovery fields for days, hours, and/or minutes. This determines how often Discovery will run.

5. Click Save.

Enable Discovery for your Active Directory Domain

1. On the Administration menu click Active Directory, and then click Edit Domains.

2. Click the Domain value for the domain you would like to configure. For more information about adding domains,

see Adding a Domain .

3. From the Enable Discovery drop-down menu, select Entire Domain.

4. Click Save And Validate.

Enable Discovery for Specific OU’s of a Domain

1. On the Administration menu click Discovery, and then click Edit Domains.

2. Click the Domain you would like to configure. For more information about adding domains, see Adding a Domain .

3. From the Enable Discovery drop-down menu, select Specific OUs.

4. Click Save And Validate.

5. If you are not already redirected there, click the Specific OUs tab.

6. Type an OU name in the Include box to add an OU to the list. If the OU is found, it will auto-populate below the box. Click the name to add it to the list. An included OU will appear with a icon.

Page 61


7. Type an OU name in the Exclude box to exclude it from Discovery. An OU will only be available to be excluded if it is contained within an OU that has already been included. An excluded OU will appear with a icon.

8. To remove an OU from the list, click the to the right of the OU.

9. Click Save.

Note The ports required for Discovery are documented in this KB article .

XVI. Session Monitoring

Session Monitoring allows Administrators with the Session Monitoring permission to view all active launched Sessions within Secret Server. If Session Recording is enabled on the Secret, the admin can watch the user’s session in real time.

Admins can search through active and ended sessions. For active sessions there are two actions that can be taken:

Watch Live

When session recording is turned on for the Secret and admin can view and replay the user’s activity.

Terminate

Send a message to the end user, or terminate their session. The end user will see an alert dialog pop up on their machine with the message. Session recording does not need to be enabled for this to work.

For ended Sessions admins can watch the recorded video and view the SSH log if session recording was turned on for the

Secret.

XVII. Webservices

Secret Server provides a suite of Webservices which can be used to retrieve and update Secrets, and folders. The

Webservices allow Secret Server to be accessed using the mobile apps as well as custom built integrations. The

Webservices are secure and require authentication in the same manner as regular access to Secret Server. All actions that involve data are also logged (Secret views, updates, adds, etc).

1. Enabling Webservices

Webservices can be enabled at the Administration > Configuration general tab. Enabling Webservices simply makes the

ASP.NET Webservices built into Secret Server available. They are found under /webservices/sswebservice.asmx in your

Secret Server. They run on the same port as the web application. You can view them with a browser to see the functionality that is offered. Specific Webservice functionality is documented in the Secret Server Webservice API guide.

2. Windows Integrated Authentication Webservice

Secret Server also provides a webservice that use Integrated Windows Authentication instead of a user name and password. This webservice can be used in an application or script to access Secret Server and retrieve Secrets with storing the login credentials in the application or configuration file.

Page 62


See the Windows Integrated Authentication Webservice KB article for more advanced technical information on using this webservice.

3. Java Console API for Accessing Secret Values Programmatically

Secret Server has the ability to set up a Java Console API to retrieve values from Secret Server without embedding a password. This allows scripts to retrieve passwords from Secret Server while keeping both the password and credentials to Secret Server secure. The Secret Server Java Console is setup using a user in Secret Server but the password is changed and hardware specific so copying the jar file to other machines will not allow it to access Secret Server. As a user in Secret

Server, an admin can choose to share only specific Secrets with the account running the Java Console. As a Java implementation, this can be used on any OS including Windows, Mac, Linux and Unix.

a. Installing the Java Console

 Create a local user account in Secret Server that will be used by the instance of Java Console API you are installing

Since the hardware is used to secure the API to a specific account, a different user is required for each machine where the jconsole is installed.

 Install Java 7 JRE on the machine available from here.

 Request the jar file from your Thycotic Account Manager at http://thycotic.com/MyAccount.html

 Once the zip is received in an email, place the jar file in a folder you will access it from. Ex C:\SecretServerAPI\

 Install the jar file using the -i command:

C:\SecretServerAPI> C:\Program Files\java\jre7\java -jar secretserver-jconsole.jar -i (Username) (Password) (URL to

Secret Server)

The URL does not include any pages:

Good example: http:\\mysecretserver.com\SecretServer\

Bad example: http:\\mysecretserver.com\SecretServer\login.aspx

 Once installed the password on the account is changed based on some encrypted items and the machine hardware

 The secretserver-jconsole.jar can be called with -s or -v to retrieve Secret Field Values:

Single Field

C:\SecretServerAPI> C:\Program Files\java\jre7\java -jar secretserver-jconsole.jar -s (SecretId) (FieldName)

Multiple Fields

C:\SecretServerAPI> C:\Program Files\java\jre7\java -jar secretserver-jconsole.jar -v (SecretId) (Separator)

(FieldName1) (FieldName2)

The SecretId can be found by going to SecretView.aspx and in the address bar the QueryString will have SecretId=# that can be used to load the Secret

Page 63


b. Security in the API

We highly recommend locking down the secretserver-jconsole.jar and created config files through file permissions to grant only certain users access to calling the Java Console. This will allow only the allowed scripts or users to use the API.

Below are ways in which the API implements extra security measures:

No password stored

The credentials to Secret Server are calculated based on Hardware of the machine and encrypted files, so the password is not known by anyone.

Obfuscation

The Java console is obfuscated to make reversing the encryption more difficult.

Tied to hardware

Copying the files to another machine will not work to access Secret Server.

Password expiration causes autochange

When the local account password expires (based on configuration settings), the console will automatically change the password.

XVIII. Folder Synchronization

To setup this feature, navigate to Administration > Folder Synchronization.

To edit the settings, you must have a Role assignment with Administer ConnectWise Integration permissions.

Enabling folder synchronization will require specifying the synchronization interval in days, hours, and minutes. The Folder to Synchronize is the parent folder where you will be creating the folder structure. Enter the SQL Server Location, SQL

Database Name, and the credential information for accessing the reference database, for example to your ConnectWise instance. The SQL View defaults to a standard ConnectWise customer layout but can be customized to meet the desired

Folder Layout.

See the How to create a custom view for ConnectWise synchronization KB article for more advanced technical information on setting up the SQL View.

XIX. Users

1. Creating a User

To manually create a single user, navigate to Administration > Users and click the Create New button. On the subsequent page, you can enter the relevant information for a user.

To add many users from your Active Directory setup, you can use Active Directory synchronization (see Active Directory

Synchronization ).

Page 64


Below is a brief explanation of each field:

User Name

Login name for the user.

Display Name

Text that is used throughout the user interface, such as in audits.

Email Address

Email address used for Request Access, email two-factor authentication, etc.

Domain

If a drop-down list is visible, selecting a domain from the list is one way to set the expected domain of the user.

However, a more dynamic way to have this field (and all the other fields) set is through Active Directory synchronization .

Password

Login password for the user. For the various login settings, see Login Settings section.

Email Two-Factor Authentication

On a login attempt the user will have an email sent to the email address entered above. This email will contain a pin

code that the user will need to log into the account. See Email Two-Factor Authentication for more details.

RADIUS Two-Factor Authentication

This field will only appear if RADIUS authentication is enabled in the configuration. On a login attempt the user will need

to enter the RADIUS token sent from the RADIUS server. See RADIUS Authentication section for more details.

RADIUS User Name

This field will only appear if the above RADIUS Two Factor Authentication setting is enabled. This is the username the

RADIUS server is expecting. See RADIUS Authentication for more details.

Enabled

Disabling this field will remove this user from the system. Effectively, this is the way to delete a user. Secret Server does not allow complete deletion of users due to auditing requirements. To re-enable a user, navigate to the Administration

> Users page, check the Show Inactive Users checkbox just under the users grid, and edit the user to mark them enabled

(see Configuring Users for details).

Locked Out

If checked, then this user has been locked out of the system due to too many login failures. To remove the lock, uncheck

the checkbox. For more details on locking out users, see Maximum Login Failures setting described in the Login Settings

section.

Application Account

If checked, this user can only be used to access Secret Server through the Java Client/Console API and will not take up a license. See the Application Account KB for more information.

Page 65


A new user will be assigned the Role called “User” by default. For more information on Roles, see the Roles section.

2. Configuring Users

User settings can be modified by clicking the username in the User Name column on the Users page. Search for users using the search bar at the top of the grid. To show users that are marked inactive, check the Show Inactive Users box below the grid.

a. Bulk Operation

Bulk operations on users can also be performed from the Users page. Select one or more users using the checkboxes beside the User Name column, or select all or none by toggling the checkbox in the header row. Once the appropriate users have been selected, use the Bulk Operation drop-down menu at the bottom of the grid to select an action. Bulk operations on users currently include enabling or disabling user access as well as configuring users for email or RADIUS two-factor authentication.

b. Login Settings

Secret Server users can be set up with many different login requirements. For example, you can force strong Login passwords by requiring a minimum length and the use of various character sets.

The following settings are available under the Administration > Configuration page, inside the Login tab:

Allow Remember Me

This option enables the Remember Me checkbox on the Login screen. When a user chooses to use Remember Me, an encrypted cookie will be set in their browser. This will enable the user to revisit Secret Server without the need to log in.

This cookie will no longer be valid when the Remember Me period has expired. They will then have to enter their login information again. This option allows users to remain logged in for up to a specific period of time (specified in the

Remember Me is valid for setting mentioned below). This option can be a security concern as it does not require reentry of credentials to gain access to Secret Server.

Remember Me is only visible if Allow Remember Me is enabled. This is the period of time that the Remember Me cookie mentioned above will be valid.

For example: if set to one day, then users taking advantage of Remember Me will have to log in at least once a day. To set a time value

(Minutes, Hours, or Days), uncheck the Unlimited checkbox.

Allow AutoComplete

AutoComplete is a feature provided by most web browsers to automatically remember and pre-fill forms for you. This can be a great security concern since they typically do not save the data in a secure manner. You can enable or disable web browser pre-fill on the login screen by using this option.

Maximum Login Failures

Set the number of login attempts allowed before a user is locked out of their account. Once locked out, they will need a

Secret Server administrator to reset their password and enable their account. For details on how to reset a locked

account, see the Creating a User section.

Page 66


Visual Encrypted Keyboard Enabled

This setting will enable a visual keyboard for logins.

Visual Encrypted Keyboard Required

This setting will require a visual keyboard for logins.

Require Two Factor for these Login Types

This setting specifies which types of login require two factor:

 Website and Web Service Login

 Website Login only

 Web Service Login only

Enable RADIUS Integration

Allow for RADIUS server integration with your user login authentication. Other RADIUS settings will appear upon

enabling this option. These settings are discussed in the RADIUS Authentication section.

c. Password Settings

The following settings are found in the Administration > Configuration page, inside the Local User Passwords tab. These settings apply to users that were created manually, not users brought into Secret Server through Active Directory synchronization:

Allow Users to Reset Forgotten Passwords

If enabled, the Forgot your password? link will appear on all users’ login screens. Clicking on this link will prompt the user to enter the email address that is associated with the user’s Secret Server account. If the email address is found, then an email containing a link for password reset will be sent. Note that this only works for local user accounts and not for Active Directory accounts.

Symbols Required for Passwords

Force all user Secret Server login passwords to contain at least one symbol (i.e., !@#$%^&*).

Lowercase Letters Required for Passwords

Force all user Secret Server login passwords to contain at least one lowercase letter.

Uppercase Letters Required for Passwords

Force all user Secret Server login passwords to contain at least one uppercase letter.

Numbers Required for Passwords

Force all user Secret Server login passwords to contain at least one number.

Minimum Password Length

Force all user Secret Server login passwords to contain at least this many characters.

Page 67


Enable Local User Password Expiration

When enabled, Secret Server will force a password change for a user after a set interval elapses. After the interval time has elapsed, the next time the user attempts to log in they will be prompted for the old password, a new password, and a confirmation of the new password. The new password will be validated against all the password requirements (see the earlier settings – Symbols Required for Passwords, etc.). Newly created local users will also be prompted to change their password upon logging into Secret Server for the first time when this setting is enabled.

Local User Password is valid for

If enabled, this is the interval that a local user password will be valid before it must be changed (see Enable Local User

Password Expiration setting for details). If this setting is disabled, the entered value will display as “Unlimited”.

Enable Minimum Local User Password Age

If enabled, the value for this setting reflects the minimum amount of time that needs to elapse before a password can be changed. This will prevent a user from changing their password too frequently, which will allow them to quickly reuse old password.

Enable Local User Password History

If enabled, this will prevent a user from reusing a password. For example, if set to “20 Passwords”, this will prevent the user from using a password they have used the previous 20 times. This in conjunction with Enable Minimum Local

Password Age will help ensure that users are using a new and unique password frequently rather than recycling old passwords.

d. Restriction Settings

The following restriction settings are available:

Force Inactivity Timeout

This setting is the time limit on idle Secret Server sessions. Once a session expires, the user must login again with their username and password.

IP Restrictions

This setting can be entered by going to Administration > IP Addresses. In there, you can enter the IP ranges you wish your users to use. To configure a user to use the ranges, navigate to the User View page and click the Change IP

Restrictions button. In the subsequent page, you can add all the ranges you want your user to use.

Login Policy Agreement

The Login Policy Agreement is displayed on the login screen. You can change the contents of the Login Policy Statement by editing the file "policy.txt". By default, this is not enabled. The settings to enable this are accessed by first navigating to Administration > Configuration and going into the Login tab. From here, click the Login Policy Agreement button.

 Enable Login Policy

If enabled, this will simply display the policy. To force the acceptance of the policy, see Force Login Policy below.

Page 68


 Force Login Policy

This setting will force the checking of the “I accept these terms” checkbox before allowing the user to login to

Secret Server.

XX. Active Directory Synchronization

Secret Server can integrate with Active Directory by allowing users to use their Active Directory credentials to login to

Secret Server. Microsoft Active Directory is a component of the Windows Server System that allows a centralized location of user management for a Windows Network. Secret Server synchronizes Active Directory users from a Security Group in a

Domain at a periodic interval. Secret Server does not store the Domain user’s passwords. Instead, it will pass through the credentials to the Domain for authentication. To synchronize with Active Directory, specify the Domain to Synchronize

Groups from, and then select the Groups that Secret Server will use to replicate users and membership. When a new user is pulled in from Active Directory, Secret Server will also replicate the email address if one is populated.

1. Adding a Domain

Before synchronizing or creating users, specify which domains Secret Server will be able to authenticate against. Secret

Server can synchronize with any number of domains. From the Active Directory Configuration page, click Edit Domains and then Create New to add a new Active Directory domain. Username and password are only required for connecting to the domain when synchronizing users. Note that a member of a parent or child domain can be used to synchronize if you enter the username in the Domain\Username. If you wish to use Secure LDAP, check the Use LDAPS option under the expandable Advanced section. For more information on Secure LDAP, see the Using Secure LDAP KB Article. If you wish for all users brought into Secret Server to have RADIUS enabled by default, check the Auto-Enable RADIUS for new Users

option. For more information on configuring RADUIS see the RADIUS Authentication section.

The account entered will be used to synchronize users and groups, it will require permission to search and view the attributes of the users and groups. If you plan on using Discovery, the account will also need permissions to scan computers on the network for accounts.

2. Setting up a Synchronization Group

Once a domain has been added, the Synchronization Groups needs to be set by clicking the Edit Synchronization button on the Active Directory Configuration page. The Available Groups represent all accessible groups on the specified Active

Directory domain. The user membership can be previewed with the Group Preview control. Select the desired group from the Available Groups that contains the Active Directory accounts for users you would like to create in Secret Server. If the specific group does not exist, one can be created by your Active Directory administrator. If you create domain users manually or converting local users to domain users, then see the corresponding sections below before setting the synchronization group.

3. Configuring Active Directory

Active Directory configuration can be enabled by a user with the "Administer Active Directory" Role. To change these settings, select Active Directory from the Administration menu and then click Edit.

Page 69


The configuration screen offers several options:

Enable Active Directory Integration

Enable or disable the Active Directory Integration feature.

Enable Synchronization of Active Directory

Enable or disable the automatic synchronization of the selected Synchronization Groups from Active Directory. If you have manually added users and will not be using the Synchronization Group, do not enable this setting or manual users can be locked out.

Enable Integrated Windows Authentication

Enable or disable the Windows Integrated Authentication feature.

Synchronization Interval for Active Directory

Set the interval that Secret Server will synchronize its users and Groups with the Active Directory.

User Account Options

 Users are enabled by default (Manual)

Secret Server users will automatically be enabled when they are synced as new users from Active Directory. If they were disabled explicitly in Secret Server, they will not be automatically re-enabled. If creating a new user will cause the user count to exceed your license limit, the user will be created as disabled.

Page 70


 Users are disabled by default (Manual)

Secret Server users will automatically be disabled when they are pulled in as new users from Active Directory. If they were enabled explicitly in Secret Server, they will not be automatically re-disabled.

 User status mirrors Active Directory (Automatic)

When a new user is pulled in from Active Directory, they will be automatically enabled if active on the domain. The exception is when this will cause you to exceed your license count. For existing users, they will automatically be disabled if they are removed from all synchronization groups, deleted in AD, or disabled in AD. They will be automatically re-enabled when they are part of a synchronization group and are active in AD.

4. Creating an Active Directory User

Active Directory users can be created manually by a user that has the Administer Users Role. You can do this by going to

Administration > Users, then clicking the Create New button.

a. Converting Local Users to Domain Users

Local users can be converted to a domain user in a one-way irreversible process. This feature helps existing customers with extensive groups and permissions setup for a local user that they want to convert to an Active Directory user. The page can be accessed on the Administration > Users page by clicking the Migrate To AD button. For the conversion to work the domain user must not exist within Secret Server. The username will be changed to match the domain user throughout the system.

b. Unlocking Local Accounts

If a user fails their login too many times (specified in the Local User Passwords section of the configuration page), their account will be locked out and they won’t be able to log in. To unlock the account, log in as an administrator, click on

Administration, then on Users, and then click on the user who is locked out. Next, click Edit, uncheck the Locked Out check box, and save.

Page 71


XXI. Advanced Authentication

Secret Server provides integration options for Windows authentication and SAML to automatically authenticate users to the application when they browse to Secret Server on their workstations.

1. Integrated Windows Authentication

Windows Integrated Authentication allows Active Directory users that are synced with Secret Server to log into workstations and be automatically authenticated to the application. A user's Active Directory credentials are automatically passed through to IIS, logging them into the site.

For further information, Microsoft has a knowledge base article troubleshooting some common client side issues with integrated authentication.

a. Enable Integrated Windows Authentication:

Active Directory Integration and Synchronization must be enabled before configuring integrated Windows authentication.

For details, see the Active Directory Synchronization section.

 Navigate to Administration > Active Directory, and click Edit.

 Check the enable Integrated Windows Authentication box. Click Save.

b. Configure IIS

Open IIS and highlight your Secret Server website or application. In the right pane, double-click Authentication.

Enable Windows Authentication and disable Anonymous Authentication. Ensure that Forms Authentication remains enabled.

An alert may appear indicating that challenge-based and login redirect-based authentication cannot be used simultaneously. This alert can be ignored.

For additional information on requirements and troubleshooting, see our KB article on Integrated Windows

Authentication .

c. Logging in as a Local Account

After you have set up Integrated Windows Authentication, you may sometimes want to log in as a local admin account to configure Secret Server, perform an upgrade, or if AD is down.

First, do one of the following:

 Log in to your computer as an Active Directory account that has Read access to the Secret Server application directory but is not enabled in Secret Server.

 Browse to Secret Server using FireFox or Chrome.

Page 72


Next, go to your Secret Server website. You may be prompted for your AD credentials. If you are, log in as a user with

Read access to the Secret Server application directory that is not enabled in Secret Server. You should then be redirected to the login page of Secret Server. Select the “local” domain and enter your local account username and password.

2. SAML

Secret Server provides the option to integrate your SAML implementation to automatically authenticate users to the application. See the following sections to configure SAML integration with Secret Server in your environment.

a. Enable SAML

Navigate to Administration > Configuration, then click the Login tab. Click Edit and check the Enable SAML Integration box.

Enter a SAML Username Attribute, if necessary (this is optional).

b. Perform the Backend SAML Configuration

There are three parts to the backend configuration for SAML. After performing the following steps, recycle Secret Server’s application pool in IIS to allow the updated settings to take effect.

Step 1: Enable the SAML configuration file (saml.config)

Copy the saml.config.template to saml.config. This, along with setting Enable SAML Integration in the Secret Server login configuration page, turns on SAML in your Secret Server installation.

Step 2: Modify the Secret Server SAML configuration file according your IdP settings

First, fill out the ServiceProvider section in the saml.config file:

 Choose an EntityId for your Secret Server instance. By default, the EntityId in the file is:

‘urn:componentspace:SecretServerServiceProvider’. Type this into the

[EntityIdForYourSecretServerServiceProvider] section of the saml.config file.

 Verify the AssertionConsumerServiceUrl is: ~/SAML/AssertionConsumerService.aspx.

 Specify the certificate to use (see next section).

Next, fill out the PartnerIdentityProvider section in the saml.config file:

 Specify the EntityId of the Identity Provider in the Name attribute..

 Specify the SingleSignOnServiceUrl (the URL on the IdP where users go to sign in).

 Specify the SingleLogoutServiceUrl (the URL on the IDP where users go to sign out).

 Specify the certificate to use (see next section).

 Specify additional options, such as encryption and signing. See this document on SAML for details on these optional settings.

Secret Server currently supports only one Identity Provider at a time.

Step 3: Specify a certificate for SAML

X.509 certificates are used for XML signatures and XML encryption. A certificate for SAML can be specified in a number of different ways within the saml.config file. A certificate may be stored in a file or the Windows certificate store.

Page 73


If the certificate is stored on the file system:

 Specify a CertificateFile. This can be an absolute path or a path relative to the application folder.

 Specify a CertificatePassword. This is the password associated with the certificate file. Certificate files (*.pfx) that include the private key should be protected by a password. For a production certificate, the password should be stored encrypted in web.config. Refer to the CertificatePasswordKey attribute directly below for more details.

 Specify a CertificatePasswordKey. This specifies the web.config’s appSettings key for the certificate file password.

For example, if the CertificatePasswordKey attribute value is localCertificatePassword, then under the web.config’s appSettings section an entry with the key name localCertificatePassword is expected and the entry value is used as the password. By encrypting the appSettings section using the aspnet_regiis utility, the certificate file password is secured.

If the certificate is stored in the Windows certificate store, one of the following methods must be used to reference the certificate:

 Specify a CertificateSerialNumber attribute. Specifies the X.509 certificate by serial number within the certificate store.

 Specify a CertificateThumbprint attribute. Specifies the X.509 certificate by thumbprint within the certificate store.

 Specify a CertificateSubject attribute. Specifies the X.509 certificate by subject within the certificate store.

Step 4: Modify the IdP’s metadata for Secret Server integration

Following the instructions provided by your IdP, add the appropriate entries for Secret Server as a Service Provider. For an example, see this document on SAML .

 Secret Server’s assertion consumer service is located at: https://<PATH TO YOUR SECRET SERVER>/SAML/AssertionConsumerService.aspx

 Secret Server’s SingleLogoutService is located at: https://<PATH TO YOUR SECRET SERVER>//SAML/sloservice.aspx

 Secret Server’s EntityId (or URN or other similar reference) is the EntityId chosen in Step 2 above.

 Modify the Secret Server SAML configuration file to match your IdP settings.

XXII. User Preferences

Users can set their preferences by navigating to Tools > Preferences.

1. General Tab

The following configuration settings are available for users under the General tab:

Mask passwords when viewing Secrets

When enabled, this will mask the Password field for a Secret. There is a configuration setting that will force this to be

enabled for all users. For details on password masking, see Setting up Password Masking in the Secret section.

Send email alerts when dependencies fail to update

Enables emails to be sent when dependencies fail to update. For further explanation of this, see the Dependency Finder

section.

Page 74


Send email alerts when Secrets are changed

Enables emails to be sent on all changes of any Secret that the user has View permission. There is a limit of one mail per five minutes per edit of the same user. For example, if user “User1” edits the Secret twice within this grace period, only one email will be sent.

Send email alerts when Secrets are viewed

Enables emails to be sent on all views of any Secret that the user has View permission. There is a limit of one email per five minutes per view of the same user. For example, if user “User1” views the Secret twice within this grace period, only one email will be sent.

Send email alerts when Heartbeat fails for Secrets

When enabled, the user will be emailed when Heartbeat fails for any Secret the user has View permission to.

Show the full folder path on search results

Enables the full path to be displayed in the folder column on the Home page.

Use the TreeView control for search on the home screen

Enables the TreeView control for the Search tab on the Legacy Home screen. This option does not apply to the

Dashboard.

Date Format and Time Format

Date and time format displayed for a user in Secret Server.

Language and My Theme

Customize the look of Secret Server on a per user basis. For details, see the Customizing the Look section.

2. Launcher Tab

The following configuration settings are available to users on the Launcher tab:

Connect to Console

Allows you to connect to remote machines using the Remote Desktop Launcher and will connect as an administrator.

This is the equivalent of using the /admin or /console switch when launching Remote Desktop.

Allow Access to Printers, Allow Access to Drives, Allow Access to Clipboard

Allow the various items when using the Launcher. See the Launcher section for more details.

Use Custom Window Size

Checking this box will display Width and Height fields for the user to specify a custom window size for the RDP

Launcher.

Page 75


XXIII. Groups

Secret Server allows administrators to manage users through groups. Users can belong to different groups and receive the sharing permissions, as well as roles, attributed to those groups. This setup simplifies the management of the various permissions and roles that can be assigned to a user. Additionally, groups can be synchronized with Active Directory to further simplify management.

1. Creating a Group

You can create and edit groups from the Groups page. You can get to the Groups page by navigating to Administration >

Groups. By either selecting an already existing group from the list, or clicking Create New, you can modify or add the group.

To add groups and the users inside them from your Active Directory setup, you can use Active Directory synchronization (see Active

Directory Synchronization section).

2. Adding Users to a Group

On the Group View page, users can be added and removed from the group. Use the arrow buttons to move users into and out of the current group. If needed, a group can also be enabled or disabled from this page. When you have finished with your changes, click the Save button and your new group members will be added.

Page 76


3. Group Assignment

Alternatively, you can click the Assign Groups button on the main Groups page. This will allow you to select a group from a drop-down list, and assign or unassign users to the group. In the By User tab, you can select a user from a drop-down list, and assign or unassign the user from the groups in the selectable list boxes.

If the group was created using Active Directory synchronization, this group will not be editable. See the Active Directory

Synchronization section for details on adding and removing users using Active Directory synchronization.

Page 77


4. Group Owners

Group Administrators can also set another group or user as the Group Owners for a Secret Server local group. Group owners will be able to manage membership just for that Group. Set the Managed By to Group Owners on a local group and then select Groups or Users. Note that Unlimited Administrator mode can still be used to manage groups with Group

Owners assigned.

XXIV. Roles

Modeled after the role-based access control mechanism (RBAC), role-based security (RBS) is Secret Server's method of regulating permission to system access. Each user and group must be assigned to a role. Secret Server ships with three roles: Administrator, User, and Read-Only User. Each role contains various permissions to match the job function of the user. With RBS, strict granular access to Secret Server is ensured. A list of role permissions and their descriptions can be found in this KB article .

Multiple permissions can be assigned to a role. For example, you could assign Administer Users, Edit Secret, Share Secret, and View Active Directory permissions to a role. That role can then be assigned to a user or group.

The Unlimited Administrator permission will allow the user to have Unlimited Administrator rights when Unlimited Administrator is

enabled in the configuration. By default, it is disabled. See the Unlimited Administrator section for more information.

Page 78


1. Creating a Role

You can create roles from the Roles page. To get to the Roles page, navigate to Administration > Roles. Click the Create

New button to add the role.

2. Editing Permissions for a Role

To add or remove permissions to an existing role, click the Role Name of the role you wish to edit.

On this Role View page, permissions can be added and removed from the role by clicking the Edit button. Use the arrow buttons to move permissions into and out of the current role. If needed, a role can also be enabled or disabled from this page. If you have finished with your changes, you must click the Save button to have the changes take effect.

3. Assigning Roles to a User

To assign roles to a user, click the Assign Roles button on the main Roles page. Depending on which tab is selected, this page will allow you either view the roles that are assigned to users or view the users that are assigned to roles. To change these settings, click the Edit button. Now select a role from the drop-down list, and assign or unassign users to the role. In the By User or Group tab, you can select a user or group from the drop-down list, and assign or unassign roles to them in the selectable list boxes.

Page 79


XXV. IP Address Restrictions

IP Address Restrictions allow you to control which IP Address ranges users can use to log in to Secret Server.

a. Creating an IP Address Range

To create an IP Address Range, go to the IP Addresses under Administration. Once there, click the Create New button. In the IP Address/Network Name text box, enter a descriptive name for your range. In the IP Address Range text box, enter an IP Address or IP Address range. Secret Server supports single IP Addresses (i.e., 10.0.0.4), a range separated by a hyphen (i.e., 10.0.0.1-10.0.0.255), and CIDR notation (i.e., 10.0.0.0/24). Finally, click Save.

b. Editing and Deleting an IP Address Range

To edit an IP Address Range, go to the IP Addresses page, click on a range, and click Edit. To delete a range, click on the range and click the Delete button.

c. Assigning an IP Address Range

To assign a range to a user, go to the Users page under administration, click on a user name, and click Change IP

Restrictions. Next, check or uncheck the boxes next to the ranges to choose which IP Addresses a user can use to access

Secret Server. If no boxes are checked, the user can access Secret Server through any IP Address.

Regardless of the restrictions, users can always log in when accessing Secret Server on the server using a local IP address (127.0.0.1 or

::1). This is prevents total lockout from Secret Server.

XXVI. Administration

Secret Server is a highly customizable application. Administrators can increase site security through various configuration settings such as force inactivity timeouts and specifying a SMTP server. This level of configuration allows Secret Server to be altered to meet the needed requirements for the instance. The settings are explained below.

1. General Tab

The following configuration settings are available in the General tab:

Allow Automatic Checks for Software Updates

Enable this option to be notified of a new Secret Server release. If a new update is available, displayed at the top of each

Secret Server page will be a link to the latest update. This feature is only available to those with Support licenses.

Enable Webservices

Enable other applications to interact with Secret Server (still requires them to login as a Secret Server user).

Maximum Time for Offline Access on Mobile Devices

Amount of time that a mobile device can be disconnected from the server before it removes cached Secret Server data from the device.

Page 80


Force Inactivity Timeout

See Configuring the Users section.

Force Password Masking

See Setting up Password Masking section.

Require Folder For Secrets

See Folders section.

Prevent Application from Sleeping When Idle

Prevents the application pool that Secret Server is running under from going to sleep.

Allow Approval For Access from Email

Adds links in Request for Approval emails allowing approvers to approve or deny access to a Secret without logging into

Secret Server. See Requires Approval for Access for details.

Secret View Interval Minutes

The number of minutes after which users must enter another comment when Require Comment is enabled.

Default Theme

See the Customizing the Look section.

Allow Users to Select Themes

Allows users to customize the theme for Secret Server. This selected theme would only apply to their login. See the

Customizing the Look section for more details.

Enable Syslog/CEF Logging

Allow Secret Server to export logs to a SIEM tool server

Enable Launcher

Enables Remote Desktop Launcher capabilities for Secret Server. See the Launcher section for further details.

Launcher Deployment Type

Select either Click Once (which is the default) or Protocol Handler. See the Launcher section for further details.

Allow Secret Server to Retrieve Website Content

Enables the Web Launcher to retrieve the web site content in order to parse the form and find the login controls.

Allow Web Launcher Mappings to be Downloaded

Enables the Web Launcher Configuration to download pre-approved website launcher settings from Thycotic.com.

Allow Web Launcher Mappings to be Uploaded Off-site

Enables the user to upload successful Web Launcher Configurations to Thycotic.com where they will be approved and shared with other customers.

There will not be any Secret data uploaded to Thycotic.com, only the website URL and control names are sent.

Page 81


Default Secret Permissions

See the Folders section.

Require View Permission on Specific Folder for Visibility

See the Folders section.

Time Zone

Time zone that all dates will be displayed in.

Default Date, Time Format

Default date/time format used for all users. This setting can be overridden by each user. See the User Preferences section for more details.

WinRM Endpoint URL

URL for WinRM, which is used for PowerShell hooks.

Change Administration Mode

See the Unlimited Administration section.

2. Security Tab

The Security tab contains the following configuration options:

Force HTTPS/SSL

Require HTTPS; users will not be able to access Secret Server using HTTP.

Enable FIPS Compliance

See the FIPS Compliance section.

Encrypt Key using DPAPI

This will encrypt the Secret Server AES 256 key using the machine key. It provides protection from admins copying

Secret Server from the server to their own machine. Note that a backup of the encryption key should be made before using this option. Otherwise, disaster recovery will be impossible if the server dies. After encrypting the key, an administrator of Secret Server will be able to decrypt it.

3. Ticket System Tab

Secret Server has the ability to allow users to enter a Ticket Number when viewing a Secret. This number can be validated through a regular expression, and can also be marked required if needed. For more information on Ticketing System

Integration, see the Ticket System Integration with Secret Server KB Article.

4. Email Tab

The Email tab contains the following configuration options:

Page 82


Email Server

Specify the domain name or IP address of your SMTP server. For example: “smtp.yourcompany.com”

From Email Address

This is the email address that emails sent by Secret Server will be from.

Use Credentials

Whether or not to use credentials when sending emails. Requires username/password to be entered when enabled.

Domain

The domain of the credentials to use (optional).

Use SSL

Whether or not to use SSL when sending emails.

Use Custom Port

Whether or not to use a custom port when sending emails. Requires a custom port to be specified when enabled.

5. Session Recording Tab

The Session Recording tab contains the following configuration options:

Video Code

Specify the codec to use to create the videos from the launcher screenshots. This codec will have to be installed on the web server (or servers if clustering is enabled) that Secret Server is installed on.

Save Videos To

By default videos are stored in the database, Secret Server can also store them directly to a network share. This network share must be accessible from all web servers that Secret Server is installed on.

Enable Moving To Disk

After the Days Until Moved To Disk value, Secret Server can move videos from the database to an archive path on disk.

Enable Deleting

After the Days Until Deleting value, Secret Server will delete the videos from disk.

For details on the settings in the Login and Local User Passwords tab, see Configuring the Users in the Users section.

Page 83


XXVII. Administrator Auditing

Secret Server keeps a detailed audit history for users and Secrets. Secret Server implements a detailed tracking system for actions made on Secrets. Auditing users is an indispensable component of any password management system. The audit trail allows administrators to know which Secrets were accessed and ensures that Secrets are being properly used.

Additionally, the User Audit report helps SEC regulated companies comply with the Sarbanes Oxley Act of 2002 as well as other regulatory compliance mandates.

1. User Audit Report

From the Reports page, click the User Audit tab. From the dialog on the tab select a user and a date range to view, then click Search History to view the user's audit trail.

The Audit Search displays results for all of the Secrets the selected user has viewed or edited during the selected time period. The administrator has the option of expiring all of the viewed Secrets, to notify users to change sensitive information, or to force password changing (if the Remote Password Changing is configured).

Page 84


To get a full view of the actions taken on a particular Secret, select that Secret from the results list. The Secret Audit displays the specific user actions for a Secret.

2. Secret Audit

The audit log for a Secret can be accessed by clicking the View Audit button on Secret View page or navigating from the

User Audit Report. The log will show the date, the user name, the action, and any other details about the event.

Secret auditing provides a detailed view of each change or view on a Secret. Secret Audits are taken for the following user actions:

 View

 Update

 Editing Permissions

 Forced expiration

 Check Out

 Set for Check-In

 Hide launcher password changes

 Adding, Updating and Removing Secret Dependencies

For certain audit items, action notes are added providing additional details. For example, if permissions are edited, an audit record is generated detailing which users or groups gained or lost permissions. Detailed audit records add accountability to sensitive Secrets where auditors or administrators need to know exactly what was modified.

Page 85


3. Report Auditing

In addition to the User Audit and individual Secret Audit, the Reporting feature provides a series of activity, user, and

Secret reports.

a. Legacy Reports

Secret Server Usage

The number of Secret audit activity records (view, edit, sharing) by month over a period of time. This report is an indicator of overall usage of the system.

Secret Expiration Health

The number of Secrets in the system in various stages of expiration. This is a good indicator for the overall health of the

Secrets in terms of age (frequently changed passwords are more secure).

Secret template Distribution

The percentage and number of Secrets based on their Secret template within the system. This typically indicates the types of information being stored.

Top Ten Viewers

The ten users who have viewed the most Secrets over a date period.

b. Secrets

What Secrets can all users see?

The Secrets that are viewable by all users. This report is useful from an auditing perspective to ensure that users are not able to access inappropriate Secrets.

What Secrets can a user see?

The Secrets that are viewable by a particular user (user has view permission). This report is useful from an auditing perspective to ensure that a user is not able to access inappropriate Secrets.

What Secrets have been accessed?

The Secrets that have been accessed within the specified date range. This report shows the user and last accessed date for each Secret.

What Secrets have been accessed by a user?

The Secrets that have been accessed within the date range for the user. This report shows the last accessed date for each Secret for the user.

What Secret permissions exist?

The permissions on Secrets in the system, along with where the permission has been set. This report can be used to verify that all Secrets have the correct permissions.

Page 86


What Secret permissions exist for a user?

The permissions on Secrets for the user along with where the Permission has been set. This report can be used to verify that a user has the correct permissions on Secrets.

c. Folders

What folders can all users see?

The folders permissions for all users. This report is useful from an auditing perspective to ensure that users are not able to access inappropriate folders.

What folders can a user see?

The folder’s permissions for a particular user. This report is useful from an auditing perspective to ensure that a user is not able to access inappropriate folders.

What folder permissions exist?

The folders in the system along with their assigned or inherited permissions. This report can be used to verify that all folders have the correct permissions.

d. Groups

Group Membership

The Role permissions for a particular user and where they are getting the Role permission from (Group, Role). This can be useful in diagnosing complex Role assignments.

e. Roles and Permissions

What role permissions does a user have?

The Roles and which users have been assigned to the Role and how (directly or through a Group). This report can be used to quickly verify that all users have been assigned to the correct Roles.

What role assignments exist?

The roles and which users have been assigned to the Role and how (directly or through a Group). This report can be used to quickly verify that all users have been assigned to the correct Roles.

What role permission assignments exist?

The assignment of permissions to users based on Role assignments and Group memberships. This report can be useful when auditing that permissions are assigned correctly.

f. User

Failed login attempts

All failed login attempts to the Secret Server. This report can be used to show any attempts to compromise a user account.

Page 87


Who hasn't logged in within the last 90 days?

User accounts that are not being used on a regular basis. Access by these users should be re-evaluated to determine if they really need access to the system.

g. Activity

Secret Activity

Secret activity for a given date range. This report can be used to quickly verify Secret activity by all users.

Secret Activity Today

Secret activity for today. This report can be used to quickly verify Secret activity by all users.

Secret Activity Yesterday

Secret activity for yesterday. This report can be used to quickly verify Secret activity by all users.

Folder Activity

Folder activity for a given date range. This report can be used to quickly verify folder activity by all users.

Users Activity

User activity for a given date range. This report can be used to quickly verify user activity by all users.

Custom Report Activity

Custom report activity for a given date range. This report can be used to quickly verify custom report activity by all users.

h. Password Compliance

Secret Password Compliance Status

Secrets and their current password compliance validation status.

What secrets do not meet password requirements?

Secrets with one or more password fields that do not meet the requirements.

i. Discovery Scan

Discovery Scan Status

Machines that are in Active Directory but no longer exist, machines that have been successfully scanned, and existing machines that have not yet been successfully scanned. For detailed info on each part of the breakdown, view the other discovery reports.

What computers in Active Directory no longer exist?

Computers in Active Directory that have either never connected to the domain or have not connected in the last 3 months.

What computers have been successfully scanned?

Computers that have been successfully scanned at some point in the past.

Page 88


What computers that exist have not been successfully scanned?

Computers that have connected to the domain within the last 3 months but have not been successfully scanned by

Secret Server.

j. Report Schedules

Report Schedules

A list of all report schedules. To edit a schedule, open the report and click Schedule.

In addition to the packaged reports, a user can create their own. See the Creating and Editing a Report section for more

information.

XXVIII. Backup / Disaster Recovery

Secret Server supports manual and scheduled database and IIS directory backups. The database access settings support

SQL Mirror and automatic failover. As an additional disaster recovery measure, administrators can export Secrets to a CSV spreadsheet.

1. Backup Settings

The following configuration options are available on the Backup page of Secret Server:

Backup File Path

This directory must exist on the web server and will store the zip file of the application directory.

Backup Database File Path

This folder must be accessible by the SQL server and will store the database.bak file.

Database Backup SQL Timeout (Minutes)

Number of minutes that Secret Server will wait for the database backup to complete successfully before timing out.

Keep Number of Backups

Number of previous backups to keep.

Notify Administrators on Backup Failure

Users with the Administer Backup role permission will be notified if the backup fails.

Enable Scheduled Backup

Enables automatic backups on a set schedule.

Page 89


2. Folder Permissions

From the Backup Administration page, specify the correct directory paths for the IIS Secret Server file directory and the database backups to be stored. The backup path must be local to the server where the Secret Server database or file directory exists. The directories must also have the proper permissions to allow Secret Server to automatically store backups at those locations. The account that requires permission will be displayed as an alert on the Backup page.

3. Manual Backups

On the Backup Administration page, click Backup Now to force an immediate backup. This is useful for testing the backup settings and is recommended to be done before upgrading.

4. Scheduled Backups

There are numerous options to consider when backing up Secret Server. Backups can be scheduled to run on a specific time interval. To prevent the directory from growing too large, the number of backups to keep can be defined as well.

Page 90


Depending on size constraints or preferences of the DBA who would be administrating a disaster recovery scenario, the database backup can either truncate the transaction log or keep it intact. The additional schedule settings will be available when the Enable Schedule Backup is enabled and the view page will indicate the time and date of the next scheduled backup.

5. File Attachment Backups

Files uploaded to Secrets can be backed up using the standard Secret Server backup function. Upon backup completion, they retain their encrypted status and will be inside the application backup file (the .zip file).

XXIX. Exporting Secrets

From within the Administration > Export page, select the folder that needs to be exported. By default, all Secrets will be exported if a folder is not selected. In the event that no particular folder is selected, all Secrets will be exported by default.

The administrative password must be entered, as it is a security measure to verify the permission of the user performing the export.

Only the Secrets the user has View access to will be exported.

Exports can be configured further with options to Export With Folder Path and Export Child Folders. Export With Folder

Path adds the full folder path to the export. Folder paths in the export file provide organizational structure if Secrets need to be imported at a later date.

By default, the option to Export Child Folders is active. While this option is enabled, any export of a specified folder will also export content located in folders beneath the initial selection.

1. Exported File Format

Secrets are exported as a comma-separated file (.csv) or as XML. The .csv file can be easily handled in Excel or other spreadsheet applications. The file is grouped by Secret template and each cluster of Secrets has a header row that contains the template field names followed by all exported Secrets based on that template.

Page 91


The XML file follows the exact structure of the Advanced XML Import. As such, this can be useful with migrating data from one Secret Server installation to another.

Secrets are exported in the exact structure as a Secret Import. As long as exports are maintained, an installation of Secret

Server can be completely reproduced on a separate instance by applying the exported file.

2. Recovery

Recovery requires using the application and database backups. To restore web application directory, extract the root directory to the web server. The encryption.config file is most important for being able to read the contents of the database. The SQL database can be restored using the standard process in SQL Server Management Studio from the .bak file.

For detailed instructions see the Restoring Secret Server from a backup KB article.

XXX. Unlimited Administration Mode

Unlimited Administration Mode is a feature designed to allow an administrator access to all Secrets and folders in their

Secret Server instance without explicit permission. This can be used in the instance a company has an emergency situation where access to a particular Secret is needed when no users who have permission are available. Alternately, it can be used when company policies require administrators to have access to all information in the system.

An alert visible to all users will be displayed at the top of the Secret View page when Unlimited Administration Mode is enabled.

For a user to be an Unlimited Administrator they must be assigned a role with the Unlimited Administrator permission and

Unlimited Administration Mode must be enabled in Configuration settings.

To navigate to the Unlimited Administration section, select Configuration from the Administration menu, and then click

Change Administration Mode. It is recommended that administrators have specific permissions to folders and Secrets and this mode is only used temporarily to assign the correct permissions.

Changes to the administration mode are logged in an audit grid. The grid shows the user, time of the change, and any notes made by the user.

Page 92


XXXI. System Log

The System Log is used to communicate the different events that are occurring while Secret Server is executing. It can be helpful in troubleshooting unexpected behavior. The system log can be enabled by clicking Edit and checking the Enable

System Log box on the Administration > System Log page.

Maximum Log Length

This is the maximum number of rows to keep in the System Log table in the SQL database. When it reaches that amount, it will be reduced by 25%.

Notify Administrators when System Log is Shrunk

This setting is used to send an email to all System Log administrators when the System Log has been truncated. A

System Log administrator is any user in a role with the Administer System Log permission included.

To clear the system log of all its records, click Clear.

Page 93


XXXII. Event Engine

1. Event Subscription Page

Subscription Name

Send Email Alerts

Name for the subscription.

Sends an email to both users and all the users contained in the groups for this subscription. It also sends an email to all email addresses in the Additional Email

Recipients list (see below).

Send Email with High Priority Sends the email for this subscription with High Priority set.

Subscribed Users List of the Secret Server users and groups subscribed to this event.

Additional Email Recipients List of additional email addresses to send the email to.

These entries are meant to be outside of the users' email addresses as known to Secret Server. One of these might be, for example,

User1's home email address.

Subscribed Events List of the events that are contained in this subscription.

Page 94


a. Creating an Event Subscription

To add an event subscription, navigate to Administration > Event Subscriptions. On this page, click New.

In the Subscription Name field, enter a name for this new event subscription.

Add users and groups to this subscription by selecting them from the Add New drop-down selector. They will be added to the Subscribed Users list above the Add New drop-down selector.

Add events to this subscription by adding rows to the Subscribed Events data grid. To do this, select an entity type from the drop-down selector in the Entity column of the first row (Secret, User, Folder, etc.). After an entity is chosen, you can now select an action (Create, Delete, Edit Permissions, etc.). After an action is selected, a condition may be available.

Select the condition you wish to implement. Finally, to add this event to the subscription, click the button. This must be done before the Save button at the bottom of the page is clicked in order to add this event to the subscription.

b. Editing a Subscription

To edit an event subscription, navigate to Administration > Event Subscriptions, click the subscription name, and then Edit.

To remove a subscribed user, group, or event, click the button next to the entry in the appropriate list. To add entries

to either list, see the Creating an Event Subscription section above. Click Save to save all changes.

c. Deleting a Subscription

To delete an event subscription, navigate to Administration > Event Subscriptions, click the subscription name. Click

Delete on the following page.

2. Viewing the Event Subscription Log

To view the events that have been triggered in a subscription, navigate to Administration > Event Subscriptions and click

View Audit. In the Event Subscription Activity list, the most recent events to have been triggered will be on top of the list.

To select a specific time frame, click the … buttons and select start and end dates at the top of the page. Click Update

Report to return the corresponding log entries.

It may take a few seconds for the events to make it into the Log.

Page 95


XXXIII. CEF / SIEM Integration

Secret Server can log to a CEF or Syslog listener. When this is configured, all event engine events and important system log entries are sent to the CEF or Syslog server that is entered in the configuration. The written events contain data such as user information, time, IP Address, and any other important details about the event.

1. Configuring CEF

When in Administration > Configuration, click the Edit button and check the Enable Syslog/CEF Logging checkbox. When you do this, three additional settings will appear:

Syslog/CEF Server

Syslog/CEF Port

IP address or name of the server.

Port that the events will be sent to the server on.

Syslog/CEF Protocol Either UDP or TCP, the protocol used by your server.

Once you have entered these values, click Save.

2. Testing CEF

After enabling CEF, your server should start to receive messages right away if you entered the data correctly. In order to force an event to happen, perform a log out and then log back in. If the event does not appear on your CEF server soon after, there is something wrong with your configuration.

XXXIV. Language Maintenance

The Language Maintenance page can be used to analyze the missing text from a custom language file. The Secret Server

UI has been designed to be able to support any language using a resource file model. Secret Server ships with an English and Russian language file, but translating the English text to another language for a custom resource file is also possible.

This page will compare the language resource files to the English one to identify all missing nodes. After an upgrade, the

Language Maintenance page will illustrate the new nodes that need to be translated.

See the KB article Translating Secret Server to Another Language for more technical information about creating another language file.

XXXV. Customizing the Look

By default, Secret Server is set to a 'slate' theme unless specified within the Configuration settings. Secret Server comes with four other bundled themes: Classic, Corporate, Blue Chrome and ConnectWise. The default theme can be set at

Administration > Configuration on the general tab. Theming differences can be allowed by individual users with the Allow

User to Select Themes setting.

Page 96


1. Creating Themes

Themes are controlled from style sheets and a central image directory within a theme directory. A guide for creating new themes is available in the form of a CSS document noting how each line affects specific aspects of Secret Server's appearance. CSS help, properties and tags are listed with examples at www.w3schools.com

.

2. Embedded Mode

Embedded Mode will remove the header and footer to allow Secret Server to be more easily placed within a frame. To activate Embedded Mode for the session, add an "embedded=true" query string parameter to the URL when accessing

Secret Server. For example, if you normally access Secret Server by going to "http://myserver/Secretserver/login.aspx", then you can enable embedded mode by going to "http://myserver/Secretserver/login.aspx?embedded=true". This parameter can be added to the URL on any page in Secret Server. To disable embedded mode simply change the query string to "embedded=false."

XXXVI. Reporting in Secret Server

The reporting interface comes with a set of standard reports. These reports include a variety of 2D and 3D charting/graphing components and a full grid of data. Some of the reports are purely data detailed and have no charts.

You can also create your own reports based on any Secret Server data (user, audit, permissions, folders, etc). You can also create report categories to aid in the organization of your reports. Reports can be arranged to provide access to auditors and meet compliance requirements. These reports can be accessed in the General tab.

The Security Hardening Report checks aspects of Secret Server to ensure security best practices are being implemented.

While Secret Server will run with all of the items failing, administrators should be aware of possible security issues within

an installation. For more details on this, see the Security Hardening Tab section below.

The User Audit Report shows all Secrets accessed by a particular user during a specified period of time. For a more

detailed explanation of this, see the User Audit section below.

1. General Tab

Page 97


2. Reports View Page

The reports are listed under the report categories. To view a report, click on the name. This will take you to the Report

View page.

You can view a record of all the actions performed on reports by clicking on the View Audit button. For more information

on this, see the Auditing section.

For details on the Edit button, see the Reports Edit Page section below.

The “Create it” link is a shortcut for creating a new report. For further explanation, see the Creating and Editing a Report

section.

a. Viewing a Report

On this page you will see the graph, chart, grid, etc. for the report. To see a grid representation of the report, click the

Show Data link to expand that area. If there is no data, then no graph will be visible and the text “There are no items” will be displayed in the Show Data section.

Some reports use dynamic values like User, Start Date, End Date, etc. Adjust these values to generate the report you need. Click the Update Report button to generate the new report.

The Edit button allows you to alter the report to fit your requirements. See the Creating and Editing a Report section

below for details.

b. Deleting or Undeleting a Report

To delete a report, click the Delete button.

To undelete a report, you will need to navigate to the Reports Edit page (see the Reports Edit Page section) as deleted

reports are not visible on the Reports View page. On the Reports Edit page, click the Show Deleted button. This will display a Deleted Report category which contains all the deleted reports. Either drag the report to a report category that is not deleted or click the report name to go into its Report View page. In there, click the Undelete button.

c. Auditing for a Report

You can view a record of all the actions performed on a report by clicking on the View Audit button. For more information

on this, see the Administrator Auditing section.

3. Reports Edit Page

You can adjust the look of the Reports View page. The report categories as well as the reports can be rearranged on the page. To do this, click Edit on the Reports page.

Page 98


a. Modifying Report Categories

For details on the Show Deleted button, see Undelete a Report earlier in the section.

Rearrange

Any item with the icon can be dragged and dropped to a new location. Report categories can be moved anywhere within the page. Reports can be moved from one report category to another.

Create New

Click Create Report Category and specify a category name and description on the following page. Note that the Report

Category Description is used as the tooltip for the report category on the Reports View page.

Delete

Click the icon next to the report category name. This will delete all the reports in the category. To undelete the

reports, see Undelete a Report section.

Edit

Click the icon next to the report category name to change the name or description of the category.

b. Creating and Editing a Report

There are two ways to create a Report. From the Reports Edit page, click the Add New link at the bottom of a Report

Category. Or alternatively, from the Reports View page, click the Create it link at the bottom of that page.

To edit a Report, navigate to the Report View page and click Edit.

The SQL script text cannot be edited for standard reports.

Page 99


Below is an explanation of the different fields for the Report Edit page:

Report Name Name that is displayed on the Reports page as a link underneath its containing category.

Report Description Description for the Report. This is displayed in the Report View page. It is also used as the Tooltip for the Report name on the Reports page.

Report Category

Chart Type

3D Report

Page Size

Selection for which Report Category to place the Report into.

Type of chart to use for displaying the results. If set to None, then a grid will be displayed.

Specify a 3D style to render the chart in.

Page size limit setting for the data displayed in the grid.

Report SQL SQL script that is used to generate the report.

Reports support the embedding of certain parameters into the SQL in order to give the user the ability to dynamically change the resulting data set. Another option available for custom reports is to apply a different color to returned rows dependent on certain conditions. For more information as well as examples, see the Using Dynamic Parameters in Reports

KB article.

Also available to aid the creation of custom reports is the means to show Secret Server’s SQL database information. By selecting the SQL Table from the drop down list, the details of the table’s columns will be displayed in a grid. Click the

Show Secret Server SQL database information link to see the SQL Table drop down list and SQL Table Columns grid.

Click Preview at the bottom of the page to see a preview of the chart. The resulting chart will display in the Report

Preview section at the bottom of the page.

4. Scheduled Reports

a. Creating a New Schedule for a Report

To create a schedule for a report, click Schedule on the Report View screen. Once on the Custom Report Schedules page, click Create New.

b. Viewing Existing Report Schedules

To view existing schedules for a report, click Schedule on the Report View screen. A list of existing schedules for the report will be visible in the grid. To view the details of a schedule, click the schedule name in the grid. Deleted schedules can be made visible by checking the Show Deleted box at the bottom of the grid. Click the View link in the History column of the grid to view the history of all generated reports for that schedule.

c. Editing Schedule Settings

When viewing a report, click Schedule and then the name of the report schedule to modify it. The following configuration options are available:

Page 100


Schedule Name

Name of the schedule for the report. This name must be unique to the Secret Server installation.

Health Check

When enabled, an email notification will only be sent when the report contains data.

Recurrence Schedule

Specify that the schedule will run every X number of days, weeks, or months, with the option to specify particular days of the week or month as well. The date and time that the report schedule will be effective can be specified in this section as well.

Save Generated Reports

When enabled, Secret Server will save the history of generated reports in the database for later viewing. Enabling this setting will also allow you to specify the number of generated reports to save.

Send Email

When enabled, Secret Server will send an email containing the generated report every time the schedule runs. Enabling this setting will also allow you to specify whether or not the email will be sent with the high priority flag and a list of

Secret Server users or Groups that will receive the generated report email. Add additional email recipients in the text box below the subscribers, separating recipients by a semi-colon.

The following configuration options will appear if the report being scheduled contains at least one dynamic parameter in the SQL of the report:

User Parameter Value

Group Parameter Value

Value of the #USER parameter to set in the report when it is generated.

Value of the #GROUP parameter to set in the report when it is generated.

Start Date Parameter Value Value of the #STARTDATE parameter to set in the report when it is generated.

End Date Parameter Value Value of the #ENDDATE parameter to set in the report when it is generated.

5. Security Hardening Tab

The Security Hardening Report checks aspects of Secret Server to ensure security best practices are being implemented.

While Secret Server will run with all of the items failing, administrators should be aware of possible security issues within an installation. Below is an explanation of the different values:

Browser AutoComplete

Browser AutoComplete allows web browsers to save the login credentials for the Secret Server login screen. These credentials are often kept by the web browser in an insecure manner on the user's workstation. Allowing AutoComplete also interferes with the security policy of your Secret Server by not requiring the user to re-enter their login credentials on your desired schedule. To prevent the AutoComplete feature, disable the Allow AutoComplete option on the

Configuration page.

Page 101


Force Password Masking

Password masking prevents over-the-shoulder viewing of your passwords by a casual observer (when masked,

passwords show as *******). To activate this option, turn on the Force Password Masking option on the Configuration

page.

Login Password Requirements

Login passwords can be strengthened by requiring a minimum length and the use of various character sets. A minimum password length of 8 characters or longer is recommended. In addition, all character sets (lowercase, uppercase,

numbers and symbols) are required to get a pass result. Turn on these login password settings on the Configuration

page.

Maximum Login Failures

The maximum number of login failures is the number of attempts that can be made to login to Secret Server as a particular user before that user's account is locked. A user with user administration permissions will then be required to unlock the user's account. The maximum failures allowed should be set to 5 or less to get a pass result. Change the

"Maximum Login Failures" settings on the Configuration page.

Remember Me

Remember Me is a convenience option that allows users to remain logged in for up to a specific period of time. This setting can be a security concern as it does not require re-entry of credentials to gain access to Secret Server. Turn

Remember Me off on the Configuration page to get a pass result. It must be set to be valid for 1 day or less to not get a

fail result.

SQL Server Authentication Password Strength

SQL Server authentication requires a username and password. The password must be a strong password to get a pass result. Strong passwords are 8 characters or longer and contain lowercase and uppercase letters, numbers and symbols.

The SQL Server authentication credentials in use can be changed by going to the installer (installer.aspx) and changing them on Step 3. A pass result is also given if Windows authentication is used to authenticate to SQL Server.

SQL Server Authentication Username

The SQL Server authentication username should not be obvious. The use of "sa", "ss" or "secretserver" will give a fail result. The SQL Server authentication credentials in use can be changed by going to the installer (installer.aspx) and changing them on Step 3. A pass result is also given if Windows authentication is used to authenticate to SQL Server.

Windows Authentication

Windows authentication takes advantage of Windows security to provide secure authentication to SQL Server. The SQL

Server authentication options can be changed by going to the installer (installer.aspx) and changing them on Step 3.

Please see page 19 of the Installation Guide for instructions on configuring Windows authentication to SQL Server.

Require SSL

Secure Sockets Layer (SSL) is required to ensure that all communication between the web browser and Secret Server is

encrypted and secure. Once the SSL certificate is installed, Force HTTPS/SSL in Configuration to get a pass result. Please

see the Installing a Self-Signed SSL/HTTPS Certificate Knowledge Base article for instructions.

Page 102


Using SSL

SSL needs to be running with at least a 128-bit key size to get a pass result. A warning result indicates your key size is less than 128 bits. A fail result indicates you are not using SSL.

Use of SSL is highly recommended for Secret Server.

6. User Audit Tab

User Audit Reports show all Secrets accessed by a particular user during a specified period of time. For a more detailed

explanation of this, see User Audit Report in the Audit section.

XXXVII. Server Clustering

Secret Server has the ability to run with multiple front end web servers. For a critical instance, clustering offers a redundant system to limit potential down time from a single point of failure. Clustering will also allow users to load balance for better performance.

For instructions on enabling Clustering in Secret Server, see the Setting up Clustering KB article.

XXXVIII. Encryption and Security

1. Advanced Encryption Standard

Secret Server uses different types of encryption to ensure data security. Every field, except name, on a Secret is encrypted at the database level with the Advanced Encryption Standard (AES) 256 bit algorithm. Database encryption prevents unauthorized access of sensitive data on the server.

The AES encryption algorithm provides a high level of security for sensitive data. The creation of AES was instigated by the

National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) to find a replacement for the Data Encryption Standard (DES), which had numerous issues, namely small key size and efficiency.

Encryption algorithms use keys to obfuscate the data. While DES only had a key size of 56 bits, AES can have a key size of 128, 192 or

256 bits. Larger keys provide more security as their size makes brute force attacks infeasible.

To address concerns from the cryptographic community, the NIST embarked on a transparent selection process. During the selection process the NIST solicited designs from the global cryptographic community and voted for a winner from within fifteen finalists. The eventual winner was a team of Belgian cryptographers with their submission of the Rigndael encryption method.

For more information about the technical specifications of AES, please see the official standard.

2. SHA-512

Secret Server user passwords are hashed in the database using the SHA 512 hashing function. A hash function differs from an encryption method such as AES because a hash function is practically impossible to reverse. Hashing algorithms are

Page 103


mathematical functions to replace inputted text values with numerical ones. If the input text is the same, the final hashed value will also be the same. The input text of "fox" will always produce the same hashed value. Minor changes in the input value will radically alter the hashed output, as shown in the examples below. In addition each password is hashed with a

“Salt”, which is just a random text. This guarantees that if two users use the same password, their hash in the database will not be the same, which prevents Rainbow Table attacks.

Example input text: "The quick brown fox jumps over the lazy dog".

Hashed value: 07e547d9 586f6a73 f73fbac0 435ed769 51218fb7 d0c8d788 a309d785 436bbb64 2e93a252 a954f239

12547d1e 8a3b5ed6 e1bfd709 7821233f a0538f3d b854fee6

Example input text, with 'dog' changed to 'cog': "The quick brown fox jumps over the lazy cog".

Hashed value: 3eeee1d0 e11733ef 152a6c29 503b3ae2 0c4f1f3c da4cb26f 1bc1a41f 91c7fe4a b3bd8649 4049e201 c4bd5155 f31ecb7a 3c860684 3c4cc8df cab7da11 c8ae5045

3. SSL Overview

Secret Server can be configured to run using Secure Sockets Layer (SSL) certificates. It is strongly recommended that

Secret Server installations run using SSL. Not using SSL will significantly reduce the security of the contents of Secret

Server since browsers viewing the site will not be using an encrypted connection.

4. Two-Factor Authentication at Login

Users who access Secret Server from laptops or other mobile devices are more vulnerable to having a device stolen.

Requiring multiple forms of authentication provides additional security against theft or attempts to crack a user's password.

Two-factor authentication is a method of strong authentication that requires two different forms of identification instead of the traditional single password. The types of two-factor authentication supported by Secret Server include the following:

 Email

A one-time pincode is emailed to the user. For further information, see Email Two-Factor Authentication , below.

 RADIUS

Users will be prompted for their RADIUS password or token as second factor of authentication.

 Mobile App / Soft Token

Users will be prompted to configure their mobile app or soft token using either Duo Security or TOTP RFC6238, such as Google Authenticator or Microsoft Authenticator.

a. Email Two-Factor Authentication

Secret Server uses this design by allowing administrators to require two-factor authentication through a confirmation email for designated users. For additional information on two-factor authentication, please see this Wikipedia article .

Page 104


To configure email two-factor authentication, from the Users administration page select a user to configure. Click Edit, check the Email Two Factor Authentication box, and click save. Verify that the correct email address information is set, as that address is where the confirmation email will be sent.

The next time that user attempts to login to the system, a unique confirmation code will be emailed to them. The user will then be required to enter a new confirmation code at each login.

b. RADIUS Authentication

Secret Server allows the use of RADIUS two-factor authentication on top of the normal authentication process for additional security needs. Secret Server acts as a RADIUS client that can communicate with any server implementing the

RADIUS protocol.

Configuring RADIUS

RADIUS can be set up on the Login tab of the Configuration page. This requires enabling RADIUS Integration, specifying the server address, the ports, and the RADIUS Shared Secret. The shared secret is a specific term for RADIUS clients and is not a reference to Secrets in Secret Server.

Page 105


The RADIUS Login Explanation can be customized to give users detailed instructions for entering their RADIUS information.

Once enabled, the Test RADIUS Login button will appear on the Login tab for testing the communication with the RADIUS

Server. If you have a failover RADIUS Server, you can specify it by clicking the Enable RADIUS Failover checkbox and entering the required information. If the primary RADIUS server can’t be accessed, the failover server will be used.

Enabling RADIUS for a User

After enabling RADIUS on your Secret Server, you must enable RADIUS two-factor authentication for each user on a peruser basis. On the User Edit page, enter the RADIUS User Name for this user to match the RADIUS server. RADIUS can be

set to Enabled for new users by domain, see the Adding a Domain section for details.

c. TOTP Authentication

Secret Server support using any type of soft token/mobile app authentication using the TOTP RFC6238 algorithm. This includes Google Authenticator and Microsoft Authenticator. See instructions for setup below:

Page 106


Enable TOTP Two-Factor Authentication

1. From the ADMIN menu, select Users.

2. Select the check box beside each user to enable two-factor authentication for.

3. From the < Select Bulk Operation > drop-down menu, select Enable Google Auth Two Factor.

4. Click OK in the dialog that appears, confirming the operation.

5. The user(s) will now be required to complete the soft token setup with a mobile device the next time they log into

Secret Server. See User Setup of Soft Token Two-Factor Authentication for further details on the account and mobile app setup that will follow.

To disable soft token two-factor authentication, follow the same process as enabling soft token two-factor authentication for a user, selecting Disable Google Auth Two Factor from the bulk operation drop-down menu instead.

Reset TOTP Two-Factor Authentication

1. From the ADMIN menu, select Users.

2. Select the check box beside the user to reset two-factor authentication for.

3. From the < Select Bulk Operation > drop-down menu, select Reset Google Auth Two Factor.

4. Click OK in the dialog that appears, confirming the operation.

5. The user will now be required to complete the soft token setup with a mobile device the next time they log into

Secret Server. See User Setup of Soft Token Two-Factor Authentication for further details on the account and mobile app setup that will follow.

User Setup of TOTP Two-Factor Authentication

1. Log into the main Secret Server login screen.

2. After successful authentication, a new screen will appear with instructions.

3. Follow the instructions to configure the mobile device for soft token authentication. To enter the key manually rather than scanning the QR code, click the Manual Setup link (see image below).

4. Click Next to continue, and enter the token in your mobile app to complete the setup.

Page 107


Note If you experience errors while setting up soft token authentication with a mobile device, see Troubleshooting

Google Authenticator for more information.

d. Duo Security Authentication

Note Using this method of two-factor authentication requires that you have an active account for Duo Security .

Secret Server support using Duo Security as a second factor of authentication. See below for setup instructions:

Enable Duo Security Two-Factor Authentication

1. From the ADMIN menu, select Configuration.

2. Click the Login tab, and then click Edit.

3. Select the Enable Duo Integration check box.

4. Enter the API Hostname, Integration Key, and Secret Key values (obtain these by logging into your account at duosecurity.com

).

5. Click Save.

6. See User Setup of Duo Two-Factor Authentication for further details on the procedure that the user will follow.

User Setup of Duo Two-Factor Authentication

1. Log into the main Secret Server login screen.

Page 108


2. After successful authentication, a new screen will appear with the option to select a method to authenticate with.

3. Select one of the options (they could be Duo Push, Send SMS, and/or Phone, depending on your setup with Duo) and complete the selected authentication process to log in.

5. SMTP Configuration

Secret Server requires that a connection to a SMTP server be properly configured to send out confirmation code emails.

Enter the SMTP server information and an email address that will be used to send notifications.

When configuring Secret Server to an SMTP server, the server's availability can be verified through Telnet:

In the command prompt run the following:

Page 109


"telnet servername 25"

In this command, servername can be replaced by the SMTP server, and 25 is the port that Secret Server is configured to attempt to connect through. An example command would look like:

"telnet smtp.somesite.com 25"

If virus protection is running, a rule to allow aspnet_wp.exe to send e-mails may be necessary.

6. FIPS Compliance

The Federal Information Processing Standard 140-1 (FIPS 140-1) and its successor (FIPS 140-2) are United States

Government standards that provide a benchmark for implementing cryptographic software. Secret Server has been tested within environments that are FIPS compliant.

For instructions to enabling FIPS in Secret Server, see the Enabling FIPS Compliance in Secret Server KB article.

7. PCI Datacenter Compliance

Secret Server can make it easier to comply with various PCI-DSS requirements:

Requirement 8 Assign a unique ID to each person with computer access|

Requirement 10 Track and monitor all access to network resources and cardholder data

Requirement 11 Regularly test security systems and processes

Requirement 12 Maintain a policy that addresses information security

Our solution will help you comply with Requirement 8 by providing a secure repository for you to maintain an automated password changing schedule; forcing each user to have a unique, secured password. Secret Server’s web-based access makes it easy to access these passwords.

As for Requirement 10, Secret Server is able to monitor all access to network resources. By employing Remote Password

Changing to force password changes, administrators are able to monitor and update network resources on a customized scheduled. You can create a password changing schedule that best suits your environment.

Lastly, to help you comply with Requirement 12, our software’s global configuration and template-driven data structure can be optimized to fit the requirements of your current information security policy or assist in creating a policy based around Secret Server.

Listed below are several of the configuration options available:

 Two-factor authentication

 Local User Password requirements

 Force HTTPS/SSL

 Require Folder For Secrets

 Enable Launcher

Page 110


 Enable Webservices

8. SafeNet HSM Integration

Secret Server can be configured during installation to use a SafeNet HSM (or paired HSM’s, for failover). The HSM is a hardware device which will handle the encryption/decryption in hardware. As the encryption keys are stored within the hardware device itself (and never leave the device), use of an HSM increases the security of the encrypted data. SafeNet

HSM’s are FIPS 140-2 certified and are the type of HSM most typically used by government and military customers.

Secret Server does not require a HSM to function but it is available as an option for environments that require the highest levels of security. For information about configuring an HSM with Secret Server see the HSM Integration KB article.

XXXIX. Upgrading Secret Server

To upgrade Secret Server, you will need valid support licenses. To renew your support, please use our online web form or contact sales . Once you have valid support licenses, follow the steps in this KB article to upgrade.

XL. Licensing

Secret Server's licensing model allows for scalability and enhanced core functionality in the form of edition enhancements

(Professional, Enterprise, and Enterprise Plus) and user packs. Licenses can be purchased for these items as follows:

Users

Secret Server ships with one free single user. Additional user licenses can be purchased through the Online Store to expand an installation.

Support

Support licenses allow installed instances of Secret Server to receive all software updates. The number of support licenses and user licenses must be equivalent in order to be eligible for upgrades.

Users must be supported in order to receive technical assistance from the Secret Server support team.

1. Professional License

The Professional license enables the following Secret Server capabilities:

 Web services API

 Folder Synchronization

 IP Restrictions

 Remote Password Changing

 Heartbeat

 Remote Agent

 RADIUS Integration

 Windows login integration (Active Directory synchronization and login)

 Automated Backups

Page 111


 Scheduled reports

 Event subscriptions

 Require comment on Secret view

 Discovery of local Windows accounts

2. Enterprise License

The Enterprise license enables the following Secret Server capabilities:

 All the Professional license capabilities

 Secret access requests

 DoubleLock

 Custom reports

 Secret Check Out

 Managing service accounts (including Discovery for service accounts)

3. Enterprise Plus License

The Enterprise license enables the following Secret Server capabilities:

 All the Enterprise and Professional license capabilities

 FIPS enablement

 CEF / SIEM integration

 Server clustering

 Discovery Rules

 Session Recording

 Application Server API

4. Installing New Licenses

Once a license is obtained, it can be installed by copying the license name and code into the corresponding fields to a new license page. To access this page, select Licenses from the Administration menu, and then click Install New License.

5. Converting from Trial Licenses

If you previously had evaluation licenses and recently purchased, you will need to remove all evaluation licenses and install your purchased licenses. Normal trial licenses expire one month after issue. If the new licenses are not installed, users will start getting “License has expired” error messages.

6. Activating Licenses

All non-evaluation licenses require activation after install. Activation is per license/web server combination. Therefore, if you bring up a new web server, it will need to be activated even if your previous web server was already activated. After installing each license, you will be prompted to activate. Follow the on-screen prompts for online or offline activation. The activation process gathers the name, email, and phone number of the individual activating for internal purposes only. No other personal information will be sent to Thycotic.

Page 112


7. Limited Mode

If you fail to activate, your system will be placed in limited mode, which will prevent the following actions:

 Creating and editing Secrets

 Importing Secrets

 Active Directory sync

 Web services (mobile applications)

 Manual Remote Password Changing

Page 113


XLI. External Applications

1. iPhone Application

The Password Manager Secret Server app is available for free from the iTunes App Store for the iPhone, iPod Touch, and iPad. This great app features an intuitive Apple user interface making it easy to store, access, and organize passwords, and other private data. The app offers a portable method for access Secret Server while maintaining the strict security and permission based access.

Once the application is installed on the iPhone, select Existing Installed Account to access your Secret Server instance.

Enter the URL, Username, Domain, and Password to setup the account. For local users, the Domain will be left blank. Once the account is set up, you can access and edit your Secrets from the application. You will be required to log in again when your token expires based on the length of the Allow Remember Me setting. It is recommended that you also set up the

Passcode Lock feature to prevent unauthorized access to your Secrets from your phone.

Page 114


2. Blackberry Application

The Secret Server BlackBerry application is available for free through the Blackberry App World. The app offers a portable method for access to Secret Server while maintaining the strict security and permission based access.

Once the application is installed on the BlackBerry, select Existing Installed Account to access your Secret Server instance.

Enter the URL, Username, Domain, and Password to setup the account. For local users the Domain will be left blank. Once the account is set up, you can access your Secrets from the application. You will be required to log in again when your token expires based on the length of the Allow Remember Me setting. It is recommended that you also set up the


Page 115


3. Android Application

The Secret Server Android application is available on the Android Marketplace. The app offers a portable method for access to Secret Server while maintaining the strict security and permission based access.

Once the application is installed on the device, select Existing Installed Account to access your Secret Server instance.

Enter the URL, Username, Domain, and Password to setup the account. For local users the Domain will be left blank. Once the account is set up, you can access your Secrets from the application. You will be required to log in again when your token expires based on the length of the Allow Remember Me setting. It is recommended that you also set up the


Page 116


4. Desktop Application

The Secret Server Desktop application is available for download from: http://thycotic.com/products/secretserver/features/desktop-client/ .

The application allows you to connect to Installed or Online edition and search/browse/add/edit/view/offline-cache

Secrets on your Windows or Linux computer.

Page 117


XLII. Appendix

1. Technical Support

To be supported, a customer must have an equal number of user support licenses as their number of user licenses and the user support licenses must not have expired. All support licenses expire 365 days after they are issued.

What can be requested from Technical Support?

Technical assistance is provided for all issues/bugs/questions related with Secret Server. We do not support software from other vendors except where Secret Server functionality is specifically affected. For instance, we do provide support if Windows Authentication to Microsoft SQL Server is working for other applications but not Secret Server. We do not provide support if Windows Authentication for Microsoft SQL Server is not functioning correctly – in such cases, support must be sought from the specific vendor.

How do I access Technical Support?

Web: http://thycotic.com/support.html

Email: [email protected]

Phone: +1-202-802-9399, option 2

Hours: 9am – 5:30pm ET

Technical assistance is provided through telephone, email, and remote assistance. Remote assistance sessions are also offered when necessary using our preferred remote support vendor (currently Citrix ).

What response time can I expect?

Phone calls will be answered immediately or may go to voicemail depending on call volume. Voicemails and support requests through email will receive a response within 24 hours during business hours.

What about upgrades?

Customers that are supported have access to all new releases (both minor and major releases).

Can I request new features?

Customers with active support licensing are encouraged to participate on feedback.thycotic.com. Our Feedback area allows for discussion and voting on new features.

Page 118


No results