Safeguard Privilege Manager for Windows 4.3 - Administrator Guide

Client-side UI Customization

Privilege Manager supports the text customization of all user-facing dialogs on client computers. In addition to the ability to change the default English dialog text, admins can also create client-side UI customization files for any non-English client language locale.

Language Translation Files

To customize the language used in the client-side UI, one or more translation files must be located in the same folder where the client files are installed, by default: C:\Program Files (x86)\Common Files\Quest\Privilege Manager\Client.

A language-specific translation file must be named as follows: (two_letter_language_code)-pmlang.ini

Example:

• Spanish translation language filename: es-pmlang.ini
• English translation language filename: en-pmlang.ini (used to customize client computers with English locale)
• French translation language filename: fr-pmlang.ini

Privilege Manager will automatically search for the language translation file corresponding to the language locale setting on a client computer. If no translation file is found, default English client-side text strings are used.

A specific language translation file can be used regardless of the Window's local setting. with the use of a registry setting.

• Hive: HKCU\Software\Scriptlogic Corporation\Privilege Authority
• Key: Preferred Language
• Type: REG_SZ
• Value: name of language file; for example: es-pmlang.ini

Of course, the corresponding translation file must exist as described above.

In addition to checking locally on the client computer for language translation files, the Privilege Manager client will atomically copy down (and overwrite existing, if older) language files found on the NETLOGON share.

Using Microsoft tools

You can use Microsoft tools with Privilege Manager for Windows to:

• Install the client using the Group Policy Management Console. For more information, see Using the Group Policy Management Console.
• Create and manage rules using the Group Policy Management Editor in the Group Policy Management Console. For more information, see Using the Group Policy Management Editor.

• Remove local administrator rights using the Active Directory Users and Computers Utility. For more information, see Using the Active Directory Users and Computers utility.

• Report on policies you have applied using the Resultant Set of Policy Wizard. For more information, see Using the Resultant Set of Policy Wizard.

Maintaining a least privileged use environment

Maintain a least privileged use environment by processing self-service elevation requests, using the Console Email Configuration screen, and using group policy settings.

Processing Self-Service Elevation Requests

Monitor and process self-service requests from users using self-service notifications and the Self-Service Elevation Requests screen under the Discovery & Remediation tab. You can approve or deny requests for access to run privileged applications. If approved, an elevation rule will automatically be generated for each request. For more information, see Using self-service notifications and Using the Self-Service Elevation Request Processing Wizard.

Using the Console Email Configuration screen

If you would like an email message to be sent to the user when you have approved or denied their self-service elevation request, you can configure the settings using the Console Email Configuration screen found under Setup Tasks. For more information, see Using the Console Email Configuration screen.

Using Group Policy Settings

Use the Group Policy Settings screens to create custom elevation rules or modify existing ones for your environment. The Advanced Policy Settings tab can also be used to modify the settings for advanced features at the GPO level. These features include client deployment settings, client data collection settings, instant elevation settings, self-service elevation request settings, and privileged application discovery settings.

Database Planning

The goal of this topic is to proactively manage disk capacity as it relates to Privilege Manager. The capacity planning information provided here contains steps to help understand, install, and configure the Privilege Manager database environment.

Eighty percent of database issues deal with disk capacity problems and in many cases, they are caused by failure to adhere to best practices. Failure to adhere to best practices should never happen as these issues are very predictable and could have been prevented with a comprehensive database plan.

This section gives you a breakdown of the Privilege Manager database structure to better understand the database environment and walks through capacity planning best practices to minimize the risk of disk over-utilization.

Privilege Manager Database Diagram

Privilege Manager Tables

Data Storage Estimates

As the number of users grow, some tables will increase in size more rapidly than others. For this reason, the database size will not grow proportionately.

Database size calculation uses the following rules:

1. The Activity table generates one thousand records per user.
2. The number of Computer records are equal to the number of user records.
3. 20 reports represent one user.
4. The DatabaseVersion table should be one record irrespective of the number of user in the environment.
5. The DataError table is estimated to be twenty records to one user.
6. The DeployedRules table should generate twenty records per one user.
7. The Discovery table should generate roughly thirty records per user.
8. The number of Domain table records are set to one per user.
9. Twenty ElevationRequest records are generated per user.
10. There are ten Schedule_report records per user.
11. There are ten Reports_SharedFilters per user.
12. Twenty Rule records are generated per user.
13. One user record exists in the User table per user.

Database Hardware and Software Requirements

It is recommended that databases above 6876.4MB or 10,000 users (Table 2 displays the database size as it relates to the number of users in the database environment) install the full SQL Server version. Any database size below 6000MB should be adequate to run SQL Server Express with room to grow before an upgrade to the full version of SQL Server is required.

NOTE: SQL Server Express databases have a size capacity limit of 10,000MB.

When it comes to computing capacity and maximum memory there is also a bottleneck where different SQL Server installs would not be able to take advantage of processing power and large memory storage.

Auto-Growth

Privilege Manager uses the default auto-growth configuration settings that comes installed on SQL Server. This setting sets the initial database size of SQL Server to 3MB, then grows it by 1MB every time the data limit is exceeded. The log file starts at 2MB and is set to grow by 10% increments until the disk is full.

Even though the default auto-growth configuration settings will work for Privilege Manager, it may not be the most appropriate configuration for all environments (especially for customers exceeding 10,000 users).

Every time the database grows it takes a performance hit. In SQL Server storage terms, 1024K is 128 pages; pages are stored in 8K blocks. For Privilege Manager, which is going to potentially load millions of records, growing the data file of a database every 128 pages incurs a large performance hit, especially since SQL Server’s I/O requests are a major bottleneck.

Additionally, since auto-growth allocates chunks of data at a time it is easier for the database to become fragmented. With that in mind it is recommended to update the auto-growth settings.

The table below displays the recommended settings based on the size of the network environment. These values are not set in stone but are based on database growth rates of your specific environment. The rule of thumb is to set this value to one eight the estimated database size. Ideally you should use auto-grow as a failsafe and use alerts or monitoring programs to monitor file sizes and grow files proactively. This helps you avoid fragmentation and permits you to shift these maintenance activities to non-peak hours.

How to change auto-growth on SQL Server 2014

To change the auto-growth settings:

1. Start SQL Server Management Studio.
2. Highlight, then right click the PAReporting database and navigate to Properties.

   

3. In the left Panel, select Files from the Database Properties dialog. The Properties window will be used to change Auto-growth.
4. Identify the PAReporting name under Logical Name and change the Auto-growth based on table 5 above. In this example, we have set the auto-growth to 430MB and a max size of unlimited and left the log file to grow my 10% to a limit of 20971252MB. 430 is roughly one eighth of the 3,439.9MB database size for the 5000-user environment.

   

Initial database size

When Privilege Manager is installed it uses the default file and log size specified by SQL Server. The specified file size is 3MB for the database and 2MB for the database logs. As these files fill up and exceed the initial file size there are performance implications from growing this file and fragmentation of the data on the disk.

To prevent these performance issues, it is recommended that if the database is expected to grow to a specific size in a month double that value and use it for the initial size. For example, if the database is expected to grow to 2000Mb in a month, set the initial database size to 4000Mb. This will reduce the number of auto-growths and lessen fragmentation because a larger allocation means more database related information can be accessed from the same disk location. Table 6 below breaks down the recommended initial size for the database based on a range of 1 to 100,000 users for the different database size estimates.

How to change the Initial Size on SQL Server 2014

To change the Initial Size settings:

1. Start SQL Server Management Studio.
2. Highlight, then right click the PAReporting database and navigate to Properties.

   

3. In the left Panel, select Files from the Database Properties dialog. The Properties window will be used to change the Initial Size.
4. Identify the PAReporting name under Logical Name and change the Initial Size based on table 5 above.

   

   In this image, we have set the Initial Size (MB) to 13,752.8MB. This value is 2 times the size of the database.