BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Organizing your PowerBroker Desktops Rules

Posted October 20, 2012    Peter McCalister

When tackling a project to remove administrator privileges from users, it is critical to understand what applications and tasks will be impacted. Some things just break or won’t function properly when users are no longer administrators. Of course, PowerBroker Desktops is designed to elevate those apps and tasks that require administrator privileges so that there is no impact on end user productivity. PowerBroker Desktops has the ability to automatically discover apps in your environment that require administrator privileges so that most of the work is done for you. During the audit, you may discover dozens of apps in your environment that require administrator privileges, but some apps may only be needed by certain departments or certain individuals. PowerBroker Desktops provides you with the most comprehensive organization capabilities to simplify the management of your rule set, and make it as easy and intuitive as managing the Windows file system.

There are several different ways to organize your policies, and due to the capabilities that PowerBroker Desktops provides, the sky is the limit on how you decide to organize your rules. In this blog post, I’ll discuss several common ways of organizing your rules.
One way to organize your rules in a flat format. All the rules are simply placed in in one Group Policy Object (GPO), linked at a high level in Active Directory (AD) and applied to everyone in the organization.

You can still use Item-Level Targeting to filter the rules to groups of users based on a number of different criteria like IP Address Range, Site, OU, hardware profile, etc. Item-Level Targeting can be applied to Collections and to individual rules as well.

The downside to this design is that it is difficult to find rules in what could be a lengthy list, and it is also makes it hard to figure out just who is getting what rules.

A better way is to use Collections to organize your rules, much like you use folders to organize your files in Windows. You can use Collections to organize your rules based on what you want them to do. To do this, you simply select the action when you configure your collection.

You can do this for each action you wish to implement, and all of the rules that you place into the collections will inherit the action from its collection.

You can take Collections even further by organizing by Role and then by Action.

collections, no action is enforced, it is simply a folder, but in the second level of collections, actions do get enforced. So, in this example, the “Sales” collection is a container that sets no action and the second level folders, like “Elevate” would enforce an action. All rules placed in the second level folder would inherit the action specified at its collection level.

Additionally, you will want to apply Item-Level Targeting at the first level collection, like “Sales” to target all child Collections and Rules to the Sales Group.

You can go even further with Collections, because there is no limit to how many Collections you can nest. Take a look at this screenshot where I am organizing based on Location, then by Role, then by Action, then by type of application:

Keep in mind that all of the Collections and rules can have Item-Level Targeting applied so that no matter complex your environment is currently organized, PowerBroker can fit.

As I mentioned earlier, the sky is the limit. With the unique organizational capabilities that Collections, Actions, and Item-Level Targeting provide, PowerBroker Desktops makes managing even the largest sets of rules easy.

Tags:
,

Leave a Reply

Additional articles

PowerBroker Password Safe Password Age Report

Reshaping Privileged Password Management with Password Safe 5.2

Posted July 21, 2014    Martin Cannard

Today, we’re pleased to unveil the latest edition of our privileged password management solution, PowerBroker Password Safe. I’ll start with a brief intro of what’s new and then tell you a little about the driving factors behind Password Safe development. New features for mitigating password risk and ensuring accountability enterprise-wide Here’s the 10,000-foot overview of…

Tags:
, , ,
PowerBroker for Windows tamper protection

PowerBroker for Windows 6.6 Tamper Protection

Posted July 18, 2014    Morey Haber

I have a bone to pick: Stopping an administrator from performing an action on a system is futile endeavor. As an administrator, there is always a way to circumvent a solution’s from tampered protection. Really! By default, Windows administrators have unrestricted access to the system – and even though an application, hardened configuration, or group policy…

Tags:
, ,
PowerBroker for Windows can be configured to automatically identify the end user’s language preference

Implementing Least Privilege Around the World with PowerBroker for Windows

Posted July 17, 2014    Morey Haber

BeyondTrust recognizes that international, multilingual businesses have unique operating challenges, especially when it comes to implementing enterprise software. PowerBroker for Windows is a least-privilege solution often deployed across thousands of systems spanning multiple geographies and protecting users of diverse backgrounds. Earlier this year, PowerBroker for Windows introduces new data privacy features for EMEA and APAC,…

Tags:
, ,