PowerBroker Desktops User Guide - BeyondTrust

1 August17, :August17,2012 :0 COPYRIGHTNOTICEC opyright 2005 2012 BeyondTrustSoftware, ,asandwhenapplicable,isalsosubjecttothet ermsandconditionsofthelicensebetweenthel icenseeandBeyondTrustSoftware,Inc.( BeyondTrust )orBeyondTrust sauthorizedremarketer, ,asandwhenapplicable,andtheinformationan dknow-howtheycontainconstitutetheproprie tary,confidentialandvaluabletradesecreti nformationofBeyondTrustand/oroftherespec tivemanufacturerorauthor, ,asandwhenapplicable,havebeenprovidedpur suanttoanagreementthatcontainsprohibitio nsagainstand/orrestrictionsoncopying, ,anylimitedwarrantiesexpresslyprovidedpu rsuanttoalicenseagreement,NOOTHERWARRANT YISEXPRESSEDANDNONESHALLBEIMPLIED, (IfApplicable)IfprovidedpursuanttoFARS,t hissoftwareand/ordocumentation,asandwhen applicable, ,asandwhenapplicable,maybereproducedandu sedbytheGovernmentwiththeexpresslimitati onthatitwillnot,withoutthepermissionofBe yondTrust,beusedoutsidetheGovernmentfort hefollowingpurposes:manufacture,duplicat ion,distributionordisclosure.

2 ( (g)(2)(AlternateII))LIMITEDRIGHTSDFARSNO TICE(IfApplicable)IfprovidedpursuanttoDF ARS,use,duplication,ordisclosureofthisso ftwareand/ordocumentationbytheGovernment issubjecttolimitedrightsandotherrestrict ions,assetforthintheRightsinTechnicalDat a ,PowerPassword, ,PowerADvantage,PowerBrokerPasswordSafe, PowerBrokerDirectoryIntegrator,PowerBrok erManagementConsole,PowerBrokerforDeskto ps,PowerBrokerforVirtualization, , ,bySafeNet, , , :BeyondTrustisaregisteredtrademarkofBeyo ndTrustSoftware, ,expressorimplied, ,InternetExplorer,Outlook,Windows,Window sServer, (c)1991AT& , 1991,1992,1993,1994,1995byAT& ,copy,andmodifythissoftwarewithoutfeeish erebygranted, ASIS , ,NEITHERTHEAUTHORSNORAT& , :======================= 1998,1999, 2001,2002,2003,2004,2005, 2007 MichaelChapmanContentsIntroduction9 What' August17,20125 GeneratingMultipleRulesforaTypeofApplica tion45 CreatingorEditingaRulewiththePropertiesD ialog47 ChangingtheNameofaRule50 ViewingaSettingsReport50 DisablingorEnablingaRule52 WorkingOffline52 EffectsofDisablingRulesorExtensions53 TargetingApplicationsorProcesses54 TargetingbyLocation(PathRule)54 Example:ElevateIEforaWebsite57 Example:ElevateaVisualBasicScript58 Example:ElevateaRegistryMerge59 Example.

3 ElevateaBatchFile60 TargetingbySignature(PublisherRule)61 TargetbyPublisherOnly62 TargetbyAnyDigitalSignatureElement63 TargetingRegardlessofLocation(HashRule)6 4 TargetingbyFolderLocation(FolderRule)67 TargetinganInstallationFilebyLocation(MS I Path Rule)70 TargetingInstallationFilesbyFolderLocati on(MSI FolderRule)72 TargetingthroughInternetExplorer(ActiveX Rule)75 TargetingApplicationsonDemand(ShellRule) 79 TargetingaCD/DVD(CD/DVDRule)81 TargetingApplicationsThatTriggerUAC(UACR ule)82 SelectinganActionforApplicationControl84 ConfiguringCommonOptions86 ConfiguringTokenSecurity88 ModifyingPermissions89 ModifyingPrivileges91 ModifyingProcessSecurity93 ModifyingIntegrityLevel94 ConfiguringExecutionOptions96 TargetingUsersorComputerswithItem-Level Targeting98 GroupingTargetingItemsintoaCollection101 ArrangingtheOrderofRules104 AdvancedTechniques106 CopyingaRule106 PowerBrokerDesktopsUserGuideContentsBeyo ndTrust August17,20126 ManagingMultipleRuleswithaCollection107 RuleProcessingWhenCollectionsArePresent1 09 UsingVariablesinRuleProperties111 EnvironmentVariables111 ProcessandVolatile Variables112 SelectaVariableDialog114 ManagingUserMessages116 CreatingApplicationLaunchDialogs(Applica tionLaunch)117 Example.

4 PasscodeAccessWhenUACIsTriggered120 CreatingBlockedApplicationDialogs(Blocke dApplication)121 CustomizingtheAppearanceofInternetExplor erWhenElevated(IE Elevation)123 CustomizingtheInternetExplorerComponentF ailureDialog(IE Failure)124 CustomizingtheRight-ClickMenuOptions(On- DemandElevation)126 CustomizingtheUACI nformationDialog(UACP romptDetected)127 CustomizingtheInternetExplorerDownloadDi alog130 GeneratingaPasscodetoRespondtoaMessage13 2 GeneratingaPasscode132 ChangingtheKeyPairandKeysPath133 ViewingandManagingReports135 TypesofReportingServicesReports135 ViewingaReportingServicesReport136 AuditingandReportingDashboard136 ActiveXDetailsReport138 ApplicationsbyPathReport139 ApplicationsbyHashReport141 ApplicationsbyComputerReport142 ApplicationHashDetailsReport144 ApplicationPathDetailsReport145 ShellExecutionsReport147 ConfiguringLoggingforDataCollection149 BackingUpaGPO152 EditingtheXMLS ourceCodeofaRule153 Troubleshooting154 RulesHaveNoEffect154 CompatibilityIssueswithSomeApplications1 56 ProblemsRequiringProcess-SpecificAccessR ights156 OtherProblems159 TroubleshootingMechanisms160 EventLogging160 UsingtheEventViewer162 SystemLogEvents163 ApplicationLogEvents164 TracingwithPolicyMonitor165 PolicyMonitor165

5 PowerBrokerDesktopsUserGuideContentsBeyo ndTrust August17,20127 TraceLogging166 ResultantSetofPolicy(RSoP)Reporting167 LoggingMode168 PlanningMode168 WindowsUserEnvironmentLog( )168 StatusMessages169 AppendixA:GroupPolicyPrimer170 BasicGroupPolicyConcepts170 Organization170 GroupPolicyObjectsandStorage170 EditingGroupPolicy171 ApplyingGroupPolicy171 GroupPolicyReporting171 CreatingorEditingaGPO172 AppendixB:AdministrativeTemplateSettings 173 InstallingtheBeyondTrustAdministrativeTe mplate174 GroupPolicyProcessingSettings175 PolicyProcessingSettings176 LicensePolicyProcessingSettings176 LoggingandTracingSettings177 SecurityDriverSettings177 AppendixC:AdditionalTechnicalInformation 180 SecurityContexts180 WMIN amespace181 Glossary183 Index187 PowerBrokerDesktopsUserGuideContentsBeyo ndTrust August17, , ,benefits,functions,uniqueconcepts, , , ,see What' , page 10, ,see GettingStartedwithPowerBrokerDesktops, page 28, ,see AppendixA:GroupPolicyPrimer, page ,see AdditionalInformation, page August17,20129 What' :lAddingorRemovingAdministratorRights Youcanmakeallofthepermissions,privileges , Toprovideauserwithimmediateone-timeacces stoanapplicationrequiringauthentication, ,youcouldprovideaccesstoanapplicationfor asupportprofessionalwhodoesnothaveanend- user ' , WhenaruleisusedtoelevateInternetExplorer , , YoucanuseShellrulestoallowuserstoelevate fileswithanyofthefollowingextensionsonde mand.

6 LEXE(Executablefile)lLNK(Shortcut)lMSI(W indowsInstallerpackage)lMSP(WindowsInsta llerpatch)lMSC(MicrosoftCommonConsoledoc ument)lCPL(ControlPanelitem)lCMD(Windows Commandscriptfile)lPS1(WindowsPowerShell scriptfile)lVBS(VBScriptscriptfile)lWSF( Windowsscriptfile)lBAT(Windowsbatchfile) PowerBrokerDesktopsUserGuideWhat' August17,201210lStreamlinedInterface InthePropertiesdialogsforrulesandcollect ions, , TheHelphasbeenreorganizedtorequirefewerc licks,tobettersupportthetypicalworkflow, : ActionsforApplicationControl Formostruletypes,younowhaveachoiceofacti onsavailable,andyoucanuseactionstoachiev eablacklistingorwhitelistingapproachtoap plicationcontrol. AuditingandReporting PowerBrokerDesktopsAuditingandReportingl etsyoucollectprivilege-relatedeventlogda tafromclientcomputersintoadatabase,andth ensortandfilterthisdataintoreportsabouta pplicationsused,privilegesrequired,howap plicationsarelaunched, , ,youcanviewgraphicalreports.

7 AuditingandReportingImprovements ThelayoutofReportingServicesreportshasbe enimprovedandtheinstallationprocessforAu ditingandReportinghasbeensimplified. Messages ,whenaUACpromptisdetected, ,andcustomizethetextdisplayedincontextme nuswhenend-usersright-clickexecutablefil es(EXE)orWindowsInstallerpackages(MSI). BlockedApplicationDialogs ' August17,201211 ManagementDashboard ,youcanaccessinformation,opentoolsandwiz ards, RuleWizard PublisherRule Thistypeofruleusesanapplication' , RuleCollections , ExpandedWildcardUse :Shell,MSIPath,MSIF older,andUAC(useraccountcontrol). RefinedLookandFeel ManyareasofthePowerBrokerDesktopsuserint erfacehavebeenredesignedtobemoreintuitiv eandfamiliar, ,theItem-leveltargetinginterfacemimicssi milarfunctionsinGroupPolicytools, ' August17,201212 AdditionalInformationFormoreinformationa boutPowerBrokerDesktops, , , ,whenworkingwithanyPowerBrokerDesktopsit em, ,logontotheBeyondTrustwebsite( ),navigatetothedocumentationareaforPower BrokerDesktops,andclicktheRules August17,201213 BeforeContactingTechnicalSupportTip:Isth ePowerBrokerDesktopsclientsoftwarerunnin g?

8 , ( ) ,see TracingwithPolicyMonitor, page ,see TroubleshootingMechanisms, page August17, , + ,clickAddIncident,enterthedetailsrequest ed, August17,201215 ProductOverviewInmanyorganizations, , , ,usersaregivenrightstoonlytheresourcesth eyneed, ,allusersareassignedLeastPrivilegedUserA ccounts(LUA). ,intheWindows environment, (GroupPolicyitems) , , August17,201216 Inadditiontoapplicationrules,youcancreat erulesthatapplytosystemtasksandprocess, , (OU).Bycustomizingaccessinthisway, , , ,runningwithintheGroupPolicyManagementEd itorinWindowsServerorWindows,displaysass howninthefollowingexample:Inthisexample, thePowerBrokerDesktopsnodeisselectedunde rComputerConfiguration,Policies, ,Policies, , August17, : Elevation-Theactofassigningadministrator rightstoaprocessoraprocedure, (fromauser spointofview) ProcessToken-Aprocesstoken(sometimescall edanaccesstoken) ,theoperatingsystemverifiestheuser , :Modify,ReadandExecute, Privileges-Thesecontroltheaccesstosystem -wideresourcesonacomputer, ,loadingandunloadingofdevicedrivers,ands huttingdownthecomputerareexamplesofuserp rivileges.

9 (GPOs),whicharelinkedtoActiveDirectoryco ntainerssuchassites,domains,ororganizati onalunits(OUs). August17, (.MSI)thatalsocontainstheGroupPolicyclie nt-sideextension(CSE)andtheWindowsManage mentInstrumentation(WMI)namespaceforrepo rtingtheResultantSetofPolicy(RSoP), , :lNosecondaryaccountsarerequired(unlike RunAs stylesolutions). , ,clickingCustomerSupportCenter, ,youcanperformapplicationcontrolandmodif ysecurityassociatedwiththeapplicationorp rocesssuchaspermissionlevels,privileges, , ,rulesapplied, August17,201219 ByusingPowerBrokerDesktopsrules, , ,manageusermessages,generatereports, ,creatingrulesandcollections,managinguse rmessages, ' August17,201220 Formoreinformation,see ViewingtheManagementDashboard, page August17,201221 ManageApplicationandProcessSecuritywithR ulesWhenyouusePowerBrokerDesktopstomanag eapplicationandprocesssecuritywithrules, youcantargetapplicationsandprocesses;per formapplicationcontrol;modifypermissions ,privileges,andintegritylevelforanapplic ation.

10 , :lApplicationsorWindowsInstaller(MSI)pac kagesbasedontheirfilepathorfolderlocatio n, ,specificinstallationsinitiatedthroughIn ternetExplorer, ,see DeterminingtheTypeofRuleNeeded, page ,theactionperformedbyallruleswastorunthe targetedapplicationwithacustomtokenforwh ichyouspecifiedpermissions,privileges, ,mostruletypesincludeachoiceofactions, ,see SelectinganActionforApplicationControl, page August17, ,youcanaddsecuritygroupstoorremovesecuri tygroupsfromtheapplication sgroupmemberships, ,see ModifyingPermissions, page , , ,see ModifyingPrivileges, page sintegritylevel, ,see ModifyingIntegrityLevel, page , ,withinasingleGPOyoucanincludesimilarrul escustomizedforselectedusersandcomputers , August17,201223 TheNewItemmenuoftheItem- ,theItemOptionsmenuprovidesaccesstoboole anoperatorssuchasAND/ , ,youcanaccomplishselectiveruleapplicatio nsuchas:PowerBrokerDesktopsUserGuideProd uctOverviewBeyondTrust August17,201224 ElevatethesecurityofapplicationX, , ,see TargetingUsersorComputerswithItem-Level Targeting, page ,toprovideauserwithimmediateone-timeacce sstoanapplicationrequiringauthentication , ,youcouldprovideaccesstoanapplicationfor asupportprofessionalwhodoesnothaveanend- user ' , ,see GeneratingaPasscodetoRespondtoaMessage, page , ,password,andjustificationcanberequested , (EXE)oraWindowsInstallerpackage(MSI).