74 docs tagged with "kb"

Resolve the Access Denied error in the ActionServiceWorker log when connecting to a non-domain-joined Windows resource by enabling remote PowerShell authentication.

Recently created Active Directory objects may not appear in Privilege Secure until a domain sync runs. Verify the sync status and run a manual sync.

Add Microsoft Entra ID as a SAML Authentication Connector by configuring the Enterprise Application and completing the Configuration Wizard.

Add a VMware vCenter website to the Privilege Secure Browser Extension by creating an Activity, a Website Resource, and an Access Policy.

Add AD FS as an OpenID Connect authentication connector in Privilege Secure, including the AD FS setup, CORS, and claim rules.

Add Active Directory Federation Services (AD FS) as a SAML authentication connector by configuring AD FS first, then adding the connector in Privilege Secure.

Add an IIS outbound rewrite rule that sets Cache-Control for JavaScript files to reduce SAML login failures caused by repeated large ReactJS downloads.

Add Microsoft Entra ID as an OpenID Connect (OIDC) Authentication Connector by registering an app in Entra ID and configuring Privilege Secure.

Import resources into Netwrix Privilege Secure for Access Management from a CSV file of DNS hostnames, select a Service Account, and monitor host scanning.

Import a new license key file into Netwrix Privilege Secure for Access Management using the web interface or PowerShell.

Shows how to change the Active Directory OU where Netwrix Privilege Secure creates users by editing the appsettings.json file in the ProgramData directory.

Change the password of the built-in Admin account in Privilege Secure, including the required Domain field setting and what happens after the change.

Change where Privilege Secure stores session recordings and web recordings, for example when the install drive is running low on space.

Fix a Cisco SSH session that fails with a key exchange algorithm mismatch by adding older key exchanges and ciphers to the proxy's sbpam_ssh.json.

Configure a custom RADIUS Authentication Connector, enable external RADIUS authentication in appsettings.json, and assign the connector to users and groups.

Configure a Duo RADIUS proxy server as an MFA provider for Privilege Secure by editing authproxy.cfg and verifying the authentication settings.

Set up multiple Privilege Secure servers that use a single PostgreSQL server, with TLS configured for all network traffic to the database server.

Configure PostgreSQL high availability (HA) with NPS.HaMgr.exe, and upgrade an HA server pair and remote service nodes, including encryption keys.

Export and import Netwrix Privilege Secure encryption keys across multiple servers to enable high availability (HA) configurations.

Directories to exclude from antivirus and endpoint protection on Netwrix Privilege Secure servers and registered remote nodes for optimal performance.

Integrate Netwrix Privilege Secure with Microsoft Local Administrator Password Solution (LAPS) so activities can use the built-in Administrator account.

Deploy and configure the Web App Launcher to publish websites as RemoteApps through Remote Desktop Services, including settings and launch examples.

Configure Netwrix Privilege Secure integration with Microsoft Remote Assistance, including Group Policy configuration and activity setup.

Create a custom BYOV connector to check out service accounts with the "Internal" managed type, with an optional checkin script that rotates the password.

Duplicate the Linux platform to create a Palo Alto (PAN-OS) platform, then set up the service account, resource, activity, and access policy for SSH sessions.

Create a least-privilege service account and sudoers.d file so Privilege Secure can onboard Linux resources and run workflows without root.

Configure a service mesh between Privilege Secure application servers, including HA and key exchange prerequisites, node registration, and replication.

Edit rdp_template.txt on a Privilege Secure server to change default RDP settings such as resolution and redirection. Back up the file before upgrades.

Disable keystroke logging and SSH session screen recordings in Privilege Secure, and delete existing recordings for a specified time window.

Disable Multi-factor Authentication (MFA) for individual users or groups in Privilege Secure. Disabling MFA is not recommended per security best practices.

Resolve the 'Domain could not be reached' error during an AD sync with Use TLS enabled by checking LDAP ports and domain controller certificates.

Disable the Lock terminal title option in MobaXTerm Bookmark Settings so the SSH Session Extension countdown displays in the session tab.

Fix ERRCONNECT_SECURITY_NEGO_CONNECT_FAILED on Windows RDP sessions by changing the SecurityLayer or NLA settings, or the Proxy Service configuration.

Fix Privilege Secure authentication failures after Microsoft KB5082142 changes the default Kerberos encryption type to AES-only.

Export the PostgreSQL database, RDP/SSH recordings, configuration files, and encryption keys from an existing server and import them to a new server.

Export the Activity Log from Privilege Secure to a CSV file using a PowerShell script that calls the SbPAM API and handles MFA tokens.

Bulk-clear the "WinRM Disabled" flag on Windows resources managed by Netwrix Privilege Secure using a PowerShell script and the SbPAM API.

Import a single-object replication action step into Privilege Secure to speed up AD replication. Applies to releases before 3.7CU1 (3.7.1250).

The High Availability Configuration tool returns "Index was outside the bounds of the array." when the NPS Rest URL has no port. Specify port 443 in the URL.

Install a valid certificate on the Privilege Secure IIS website and update service configuration files to use the certificate DNS name.

Integrate Privilege Secure activities with Microsoft Remote Desktop Services (RDS) to launch interactive app sessions with temporarily higher privileges.

Integrate Privilege Secure with Netwrix Auditor by exporting the certificate, creating a connection profile and policy, and enabling it in monitoring plans.

Create a custom "Send Slack Message" action step with a Slack app and the provided addon, then import it into Privilege Secure activities.

Fix the "Invalid MFA code" login error by syncing the system time between the Privilege Secure server and clients.

Shows how to register the sbpam-url protocol handler so a local SSH client opens automatically from the Netwrix Privilege Secure user interface.

Lists the privileges the MS SQL Server service account needs for regular usage, installations, and upgrades of Privilege Secure with a SQL backend.

Find where Privilege Secure stores logs, locate the directory with the %PROGRAMDATA% variable, and see what each primary log file records.

Provisioning can take over 30 seconds when the WinRM HTTP setting prefers HTTPS and no certificate is available. Switch to HTTP or use a certificate.

Add a service account and a non-domain-joined Windows computer as a resource in Privilege Secure, and troubleshoot failed scans.

Move the PostgreSQL 16 data directory (PgDataDir) to a new location, including the registry updates and service steps. Repeat on each High Availability server.

Perform an in-place upgrade of the Privilege Secure Postgres 12 backend for build updates, scheduled outside regular operational hours.

Onboard macOS devices into Privilege Secure so users can connect over VNC through a RealVNC RemoteApp on an RDS host.

Onboard TACACS-enabled network devices to Privilege Secure by creating a custom Platform and a service account, then importing the devices from a CSV.

Respond to RDP session timeouts caused by strict Group Policy idle timeouts, for sessions started from the UI or through DirectConnect.

Register the sbpam-url SSH protocol handler to launch external SSH clients automatically, with example commands, replacement strings, and registry keys.

Regenerate the JWT signing certificate for Privilege Secure when instructed by Netwrix Support, using the key generator and re-registering services.

Replace the SSH pre-authentication banner with custom text by editing sbpam_ssh.json on every Privilege Secure server.

Reschedule IIS app pool recycling for the Privilege Secure web service to off-peak times so recycling is less likely to interfere with its services.

Fix the "Invalid Connection String" error for DirectConnect strings in mRemoteNG, caused by saved RDP credentials for the Proxy Server.

Resolve the SSH error "no common algorithm for key exchange" on Cisco resources by adding a key exchange algorithm to sbpam_sshclient.json.

Fix failed Actions caused by a Group Policy that disables remote shell access: verify the GPO and registry value, then set the GPO to Enabled or Not Configured.

Resolve failed "Sync AD Domain" actions after upgrading from Privilege Secure 3.5 or earlier to 3.6 or later by re-entering the service account password.

Explains why Netwrix recommends not joining Privilege Secure servers to a managed domain and lists the security risks of doing so.

Set up an approval workflow so a Slack channel receives approval notifications from Privilege Secure, using the channel's email address.

Verify service status, restart services, and re-register services to clear the service warning in the Netwrix Privilege Secure web UI.

Reduce the Windows CRL retrieval timeout through Group Policy so proxy SSL handshakes do not fail on servers without internet connectivity.

Fix the "Timeout during reading attempt" error during Entra ID synchronization in Privilege Secure by increasing the Command Timeout to 3600.

Resolve the "User Id Mismatch" login error caused by a user stored in a cookie by logging out of all sessions and clearing browser cookies.

Troubleshoot failed Action Service connections to Windows resources by checking PSRemoting and WinRM, ports, Group Policy, and permissions.

Explains what Microsoft KB5082142 changes in Kerberos encryption defaults, why most environments are unaffected, and where accounts can still be relying on RC4.

Disable WebDAV in the Privilege Secure IIS web.config to stop UI errors, such as HTTP 405 Method Not Allowed, that WebDAV causes.

Shows how to configure Privilege Secure Proxy Service to use non-standard RDP and SSH ports by editing sbpam_rdp.json and sbpam_ssh.json.

Use the Database Configuration tool (DbCfg.msi) to change the Postgres password used by Privilege Secure and vault the new password securely.

Example Task Automation script that finds and replaces strings in a file on a target resource, using a PowerShell script you can modify.