Pre-requisite
- You must have Quickpass agent installed on an Active Directory server for your customers in Quickpass.
Description
Quickpass provides alerts for auditing key events for privileged accounts in Active Directory. Current events audited include New Privileged accounts. Currently imported Administrator Accounts disabled and Accounts deleted are also listed.
Privileged accounts are defined as Active Directory Accounts that are a member of the following privileged security groups.
No. |
Group Name |
---|---|
1 |
Allowed RODC Password Replication Group |
2 |
Cert Publishers |
3 |
Cloneable Domain Controllers |
4 |
DNSAdmins |
5 |
DNSUpdateProxy |
6 |
Domain Admins |
7 |
Enterprise Admins |
8 |
Enterprise Key Admins |
9 |
Group Policy Creator Owners |
10 |
Protected Users |
11 |
Schema Admins |
12 |
Access Control Assistance Operators |
13 |
Account Operators |
14 |
Administrators |
15 |
Backup Operators |
16 |
Certificate Service DCOM Access |
17 |
Cryptographic Operators |
18 |
Distributed COM Users |
19 |
Event Log Readers |
20 |
Hyper-V Administrators |
21 |
Incoming Forest Trust Builders |
22 |
Network Configuration Operators |
23 |
Print Operators |
24 |
RDS Endpoint Servers |
25 |
RDS Management Servers |
26 |
RDS Remote Access Servers |
27 |
Remote Management Users |
28 |
Replicator |
29 |
Server Operators |
30 |
Storage Replica Administrators |
31 |
Terminal Server License Servers |
32 |
Windows Authorization Access Group |
In order to reduce the number of emails sent out, alerts are now generated hourly for all types of Alerts recorded in the previous hour as a summary email. All 3 types of Alerts are now included in 1 email.
Summary Heading
New Privileged Account Email Alert
Privileged Account Deleted Email Alert
Privileged Account Disabled Email Alert
Instructions
1. Login to the Quickpass dashboard at https://admin.getquickpass.com
2. Click the Alerts menu on the left hand side
3. In the Alerts menu click the ADD EMAIL TO NOTIFY button in the top right of the screen.
4. Type in a valid email address and click Save when done.
Note: You can add up to 10 emails one at a time.
The email will now show at the bottom of the Alerts menu
5. Select the Privileged Account Auditing alerts by enabling the toggle switch next to the Privileged Account Auditing section.
Notes:
- Any options that are enabled in this section will apply to all of the Customers with Active Directory agents installed.
Comments
0 comments
Please sign in to leave a comment.