Enable, disable, or configure Offline Access Management on a computer
POST/computers/:computerId/offline-access-management
Sets the computer's Offline Access Management (OAM) policy, which creates and manages an alternate local administrator account, optionally disables the built-in administrator, and rotates their passwords. Only POST is routed.
enabled is required and must be a boolean (or true/false when urlencoded); anything else is 422 Invalid value. "enabled" must be true or false.
If the computer already has an OAM strategy and the body contains only enabled, just the on/off state changes.
Otherwise the policy is rebuilt from strategy (default os-best-practice; an unknown value is 422):
| Strategy | use_alternate_admin | manage_built_in_admin_password | disable_built_in_admin | jita_or_persistent_users_can_access_passwords |
|---|---|---|---|---|
os-best-practice | true (fixed) | true (fixed) | true (fixed) | false (fixed) |
managed-built-in | false (fixed) | true (fixed) | false (fixed) | optional, default false |
custom | required | required | required | optional, default false |
For the two named strategies, supplying a boolean that contradicts a fixed value returns 422 One or more conflict with named strategy: [<field>]; for os-best-practice
that includes jita_or_persistent_users_can_access_passwords: true. For custom,
the three required booleans must be present, manage_built_in_admin_password cannot be false unless
use_alternate_admin is true, and disable_built_in_admin cannot be true unless use_alternate_admin
is true.
break_glass_account_name_template defaults to S1_ALT_ADMIN. Each ? is replaced with a random letter or digit (for example FXBG_???? gives FXBG_kmNI); * is not a wildcard. The chosen name is stored as break_glass_account_name
and is kept while the template still matches it.
Not supported on domain controllers (422 PasswordManagementNotSupportedError), and cannot be enabled while Scan is disabled for the computer (422 PasswordManagementNotSupportedError, 'Cannot enable Offline Access Management policy when Scan is disabled.'); disabling while Scan is off succeeds.
Required role: superadmin or admin.
Request
Responses
- 200
- 401
- 403
- 404
- 422
Policy saved.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).
No record has the :id in the path (the id is malformed or unknown). The body is the bare text Invalid <Type> ID (for example Invalid Computer ID, Invalid User ID) with Content-Type text/html; charset=utf-8, not JSON. Some routes return an empty body.
The request could not be processed, for example an id that is not a valid object id.