Transcription
NETWRIX ACCOUNT LOCKOUTEXAMINERADMINISTRATOR’S GUIDEProduct Version: 4.1July 2014Copyright 2014 Netwrix Corporation. All Rights Reserved.
Netwrix Account Lockout Examiner Administrator’s GuideLegal NoticeThe information in this publication is furnished for information use only, and does not constitute acommitment from Netwrix Corporation of any features or functions, as this publication may describefeatures or functionality not applicable to the product release or version you are using. Netwrixmakes no representations or warranties about the Software beyond what is provided in the LicenseAgreement. Netwrix Corporation assumes no responsibility or liability for the accuracy of theinformation presented, which is subject to change without notice. If you believe there is an error inthis publication, please report it to us in writing.Netwrix is a registered trademark of Netwrix Corporation. The Netwrix logo and all other Netwrixproduct or service names and slogans are registered trademarks or trademarks of NetwrixCorporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks andregistered trademarks are property of their respective owners.DisclaimersThis document may contain information regarding the use and installation of non-Netwrix products.Please note that this information is provided as a courtesy to assist you. While Netwrix tries toensure that this information accurately reflects the information provided by the supplier, please referto the materials provided with any non-Netwrix product and contact the supplier for confirmation.Netwrix Corporation assumes no responsibility or liability for incorrect or incomplete informationprovided about non-Netwrix products. 2014 Netwrix Corporation.All rights reserved.Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 2 of 35
Netwrix Account Lockout Examiner Administrator’s GuideTable of Contents1. INTRODUCTION . 41.1. Overview . 41.2. How This Guide is Organized . 42. NETWRIX ACCOUNT LOCKOUT EXAMINER OVERVIEW . 52.1. Key Features and Benefits . 52.2. Product Architecture and Workflow . 53. INSTALLING NETWRIX ACCOUNT LOCKOUT EXAMINER . 73.1. Deployment Options . 73.2. Installation Prerequisites . 73.2.1. .Hardware Requirements . 73.2.2. .Software Requirements . 73.3. Installing Framework Service and Administrative Console . 73.4. Installing Help-Desk Portal . 84. CONFIGURING ENVIRONMENT . 104.1. Enabling Audit Policy . 104.2. Configuring IIS . 135. CONFIGURING NETWRIX ACCOUNT LOCKOUT EXAMINER . 175.1. Configuring Managed Domains List . 175.2. Configuring Email Notifications . 185.3. Configuring Remote Control . 206. ACCOUNTS MANAGEMENT . 226.1. Administrative Console Overview. 226.2. Help-Desk Portal Overview . 236.3. Assigning Security Roles . 257. EXAMINING ACCOUNT LOCKOUT REASONS . 277.1. Running the Examination . 277.2. Interpreting Examination Results . 30A APPENDIX: SUPPORTING DATA . 33A.1 Netwrix Account Lockout Examiner Registry Keys. 33Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 3 of 35
Netwrix Account Lockout Examiner Administrator’s Guide1. INTRODUCTION1.1. OverviewThis guide is intended for system administrators and integrators, and for Help-Deskoperators. It contains an overview of the Netwrix Account Lockout Examinerfunctionality, instructions on how to install and setup the product, and step-by-stepprocedures for account management operations.Note:Procedures and screenshots in this guide apply to Windows 2003 systems. Ifyou are running a different Windows version, paths and dialogs may vary slightly.1.2. How This Guide is OrganizedThis section explains how this guide is organized and provides a brief overview ofeach chapter. Chapter 1 Introduction: the current chapter. It explains the purpose of thisdocument, defines its audience, and explains its structure. Chapter 2 Netwrix Account Lockout Examiner Overview contains anoverview of the product, lists its main features and explains itsarchitecture and workflow. Chapter 3 Installing Netwrix Account Lockout Examiner lists all installationprerequisites and contains detailed instructions on how to install NetwrixAccount Lockout Examiner Framework Service, the Administrative Consoleand the Help-Desk Portal. Chapter 4 Configuring Environment explains how to configure InternetInformation Services on different Windows versions, and how to enable theAuditing Policy for the Account Lockout Examiner to function properly. Chapter 5 Configuring Netwrix Account Lockout Examiner contains detailedinstructions on how to configure the product through the AdministrativeConsole. Chapter 6 Accounts Management explains how to perform accountmanagement operations (account unlocks and password resets) through theAdministrative Console and the Help-Desk Portal. Chapter 7 Examining Account Lockout Reasons provides instructions on howto examine accounts for possible lockout reasons and explains how to readand interpret examination results. A Appendix: Supporting Data contains a list of product registry keys withtheir values and descriptions.Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 4 of 35
Netwrix Account Lockout Examiner Administrator’s Guide2. NETWRIX ACCOUNT LOCKOUT EXAMINER OVERVIEW2.1. Key Features and BenefitsNetwrix Account Lockout Examiner is a client-server application that runs as aservice and allows efficient handling of account lockout issues. The product performsthe following tasks: Monitors Security Event Logs on specific domain controllers in the network,and detects account lockouts in real-time. Automatically notifies specified recipients on account lockouts. Automatically scans system services, scheduled tasks, mapped networkdrives, COM/DCOM objects and Windows terminal sessions. Unlocks accounts on the domain controllers where they were locked (e.g.when the service account has been updated or a network drive has beenremapped), and allows Active Directory to replicate this change to otherdomain controllers.2.2. Product Architecture and WorkflowNetwrix Account Lockout Examiner consists of a server component (Netwrix AccountLockout Examiner Framework Service) and two client components (the LockoutExaminer Administrative Console and the Help-Desk Portal): Netwrix Account Lockout Examiner Framework Service: a service thatprocesses requests sent by the Help-Desk Portal or the Lockout ExaminerAdministrative Console. Lockout Examiner Administrative Console: allows configuring the productand performing account lockout examinations, account unlocks andpassword resets. Help-Desk Portal: a web application that allows help-desk operators toperform account lockout examinations, account unlocks and passwordresets.Note:Help-Desk Portal is available only in Netwrix Account LockoutExaminer Enterprise edition.A typical Netwrix Account Lockout Examiner workflow is as follows: A system administrator installs and configures Netwrix Account LockoutExaminer components. If a user account is locked out due to an invalid logon attempt, the systemdetects the lockout event and, if requested, examines its reasons. Upon a user’s request, a help-desk operator or an administrator requestsan account unlock operation from the Help-Desk Portal or theAdministrative Console respectively. The Framework Service performs the requested operation on the manageddomain.Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 5 of 35
Netwrix Account Lockout Examiner Administrator’s GuideFigure 1: below illustrates Netwrix Account Lockout Examiner workflow:Figure 1:Account Lockout Examiner WorkflowCopyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 6 of 35
Netwrix Account Lockout Examiner Administrator’s Guide3. INSTALLING NETWRIX ACCOUNT LOCKOUT EXAMINER3.1. Deployment OptionsNetwrix Account Lockout Examiner can be installed on any computer in your domainthat has network access to your domain controllers.It is not recommended to install Netwrix Account Lockout Examiner on a domaincontroller, because it can raise the CPU load and memory usage.3.2. Installation PrerequisitesThis section lists all hardware and software requirements for the computer wherethe Framework Service and the Administrative Console are going to be installed andthe computer where the Help-Desk portal is going to be installed.Note:3.2.1.The Framework service must be installed on a domain computer.Hardware RequirementsBefore installing Netwrix Account Lockout Examiner, make sure that your systemmeets the following hardware requirements:Table 1:Account Lockout Examiner Hardware RequirementsProduct ComponentRequired HardwareFramework Service /Administrative ConsoleHelp-Desk Portal3.2.2. 30 MB of free disk space 256 MB of RAMN/ASoftware RequirementsThe table below lists the minimum software requirements for the Netwrix AccountLockout Examiner components. Make sure that this software has been installed onthe corresponding machines before proceeding with the installation.Table 2:Account Lockout Examiner Software RequirementsProduct ComponentFramework Service /Administrative ConsoleHelp-Desk PortalRequired SoftwareWindows XP SP3 or above with .NET 3.5 SP1 Windows XP or above with .NET 3.5 SP1 IIS 6.0 or above3.3. Installing Framework Service and AdministrativeConsoleTo install Netwrix Account Lockout Examiner Framework Service and theAdministrative console, perform the following:Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 7 of 35
Netwrix Account Lockout Examiner Administrator’s GuideProcedure 1.To install the Framework Service and the AdministrativeConsole1.Run the ale setup.msi installation package.2.On the Service Account page, specify the account that will be used to accessdomain controllers in the managed domains and click Next.Note: This account must be a member of the Domain Admins group in allmanaged domains, or have the following rights:3. Administrator’s access to the target workstations. Unlock account right (for more information, please refer to thefollowing article: How to Delegate the Unlock Account Right). Manage auditing and security log right (for more information, pleaserefer to the following article: Manage auditing and security log). Read access to Security Event Log on the monitored domaincontroller(s) (for Windows Server 2003 or later). For more information,please refer to the following article: How to set event log securitylocally or by using Group Policy in Windows Server 2003. Read access Security on themonitored domain controller(s).Follow the instructions of the wizard to complete the installation.A shortcut to the Administrative Console will be added to your Start menu (Start All Programs Netwrix Account Lockout Examiner)3.4. Installing Help-Desk PortalInstall this product component if you want your Help-Desk personnel to be able toperform account management operations remotely. The Help-Desk Portal providesthe same functionality as the Administrative Console (except for configurationoptions and the possibility to examine an account for possible account lockoutreasons on a specified workstation).To install Netwrix Account Lockout Examiner Help-Desk portal, perform the followingprocedure:Procedure 2. To install the Help-Desk Portal1.Run the ale web setup.msi installation package.2.On the Help-Desk Portal Parameters page: In Web Site and Virtual Directory Name, specify the web site and thevirtual directory in the local IIS where the Help-Desk Portal is going to beinstalled. In Account Lockout Examiner server, specify the DNS of the computerrunning Netwrix Account Lockout Examiner Framework Service.3.Follow the instructions of the wizard to complete the installation.4.On the domain controller, in the Active Directory Users and Computers snap-in(Start Administrative Tools Active Directory Users and Computers),navigate to the computer where the web portal is installed, right-click it,Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 8 of 35
Netwrix Account Lockout Examiner Administrator’s Guideselect Properties from the popup menu, open the Delegation tab and enablethe Trust this computer for delegation to any service option.5.Restart the computer where the web portal is installed.The Help-Desk Portal is installed in the virtual directory (Default Web site) in theInternet Information Services running on the local computer. The shortcut to theHelp-Desk Portal will be added to your Start menu (Start All Programs Netwrix Account Lockout Examiner Help Desk Portal)Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 9 of 35
Netwrix Account Lockout Examiner Administrator’s Guide4. CONFIGURING ENVIRONMENT4.1. Enabling Audit PolicyTo effectively troubleshoot account lockouts, you must enable auditing at the domaincontroller level for the following events: Account Management Logon Events Account Logon EventsTo do this, perform the following procedure:Procedure 3. To enable the Audit Policy on the domain controller1.Navigate to Start Programs Administrative Tools Group PolicyManagement.2.In the Group Policy Management console, expand the domain name Domains your domain name Controllers node:Figure 2:Forest:DomainGroup Policy Management: Domain Controllers3.Right-click Default Domain Controllers Policy and select Edit from the popupmenu.4.In the Group Policy Object Editor, under Computer Configuration, expand theWindows Settings Security Settings Local Policies node and select theAudit Policy node:Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 10 of 35
Netwrix Account Lockout Examiner Administrator’s GuideFigure 3:5.Group Policy Object Editor: Audit PolicySet the Audit Account Management parameter to ‘Success’, and Audit LogonEvents and Audit Account Logon Events to ‘Failure’.If you want examination results to contain the names of processes that causedaccount lockouts, you must also enable the Failure Audit Logon policy for themonitored domain. To do this, perform the following procedure:Note: To return process names, the All domain controllers option must beselected in the Accound Lockout Examiner Administrative Console (fordetails, refer to Step 3 of Procedure 10 To add a domain or a domaincontroller).Procedure 4. To enable the Audit Policy on the domain1.Navigate to Start Programs Administrative Tools Group PolicyManagement.2.In the Group Policy Management console, expand the Forest: domain name Domains your domain name node:Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 11 of 35
Netwrix Account Lockout Examiner Administrator’s GuideFigure 4:Group Policy Management3.Right-click the Default Domain Policy node and select Edit from the popupmenu.4.In the Group Policy Object Editor, under Computer Configuration, expand theWindows Settings Security Settings Local Policy node and select theAudit Policy node:Figure 5:5.Group Policy Object Editor: Audit PolicySet the Audit logon events parameter to Failure.Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 12 of 35
Netwrix Account Lockout Examiner Administrator’s Guide4.2. Configuring IISFor Netwrix Account Lockout Examiner to function properly, you must configure theInternet Information Services (IIS). Perform one of the procedures below dependingon your Windows version: To configure IIS on Windows XP To configure IIS on Windows Server 2003 To configure IIS on Windows 7 / Windows Vista / Windows 8 To configure IIS on Windows Server 2008 / 2008 R2 To configure IIS on Windows Server 2012Note: You need to configure IIS only if you plan to use Help-Desk Portal thatis available with Netwrix Account Lockout Examiner Enterprise edition.Procedure 5.To configure IIS on Windows XP1.Navigate to Start Control Panel Add or Remove Programs.2.Click on Add/Remove Windows Components.3.Select Internet Informational Services (IIS) and click Details.4.Make sure that the Common Files and the Internet Information ServicesSnap-In options are selected and click OK to install these components.Procedure 6.To configure IIS on Windows Server 20031.Navigate to Start Settings Control Panel Add or Remove Programs.2.Click on Add/Remove Windows Components.3.Select Application Server and click Details.4.Make sure that the Internet Information Services (IIS) option is selected andclick OK to install this component.Procedure 7.To configure IIS on Windows 7 / Windows Vista / Windows 81.Navigate to Start Control Panel Programs Programs and Features Turn Windows features on or off.2.Expand the Internet Information Services World Wide Web Services Application Development Features node and make sure the ASP.NET option isselected.3.Under World Wide Web Services, expand the Common HTTP Features nodeand make sure that the Static Content option is selected.4.Under World Wide Web Services, expand the Security node and make surethe Windows Authentication option is selected.5.Click OK to install the selected components.Procedure 8.To configure IIS on Windows Server 2008 / 2008 R21.Navigate to Start Run and launch the Server Manager snap-in by typingserver manager.2.Select the Roles node and click on Add Roles on the right:Copyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this document? www.Netwrix.com/feedbackPage 13 of 35
Netwrix Account Lockout Examiner Administrator’s GuideFigure 6:3.Server ManagerIn Add Roles Wizard, click on Server Roles on the left, select Web Server(IIS) and click Next:Figure 7:Add Roles Wizard: Select Server RolesCopyright 2014 Netwrix Corporation. All Rights ReservedSuggestions or comments about this docum
Note: Help-Desk Portal is available only in Netwrix Account Lockout Examiner Enterprise edition. A typical Netwrix Account Lockout Examiner workflow is as follows: A system administrator installs and configures Netwrix Account Lockout Examiner components. If a user account is locked out due to an invalid logon attempt, the system
