Windows Server directory admin workflow

A workflow for Password Safe

Directory admin accounts in Active Directory hold elevated rights on every domain-joined Windows server. If an attacker steals one of these passwords, they gain broad access across your environment. Rotating these passwords on a schedule and logging every use limits that risk and gives you a clear audit trail.

Scope of this guide

This workflow shows you how to bring Active Directory admin accounts on your Windows servers under Password Safe management. You set up automatic password rotation for those accounts and allow auto-approved RDP sessions for the users who need them. It does not cover Linux servers, network devices, or just-in-time access policies.

Prerequisites

Before you start, make sure you have the following in place.

• You have a BeyondInsight account with permissions to create Smart Rules and manage user groups.
• BeyondInsight and Password Safe is installed and licensed.
• You understand these terms:

• You created a Discovery Scan credential that can read details for services, tasks, systems, devices, users, and databases from Active Directory. Create it at Configuration > Discovery and Vulnerability Management > Credentials.
• You created a functional account that can change passwords on the accounts tied to your Windows servers.
• You created a directory credential that can read the information you need from Active Directory.
• You created a directory query that returns the Windows servers and directory accounts you want to manage.
• You created an access policy that allows approved RDP sessions.
• You created a user group for the people who will request access to these accounts.

Steps

Step 1: Create an asset Smart Group to discover Windows servers

1. In the BeyondInsight console, select Smart Rules in the left menu.
2. Select Create Smart Rule.
3. Select a Category, then enter a clear Name and Description.
4. Under Selection Criteria, select Directory Query, then select Include assets from query.
5. Select your directory query, then turn on Use to discover new assets during scans.
6. Enter how often, in hours, to rerun the query. This captures new servers as they join the domain.
7. Under Actions, select Show asset as Smart Group, then select View assets in a standard asset grid.
8. Select Create Smart Rule.

Step 2: Run a Discovery Scan against the Smart Group

1. On the Smart Rules page, select the vertical ellipsis button for your new Smart Group.
2. Select the option to scan the Smart Group.
3. Select credentials that can read local accounts and services from each asset.
4. Start the scan.

✅

Tip

Schedule the scan to repeat. A recurring scan finds new assets and confirms that local accounts and services on existing assets have not changed. This is the key to a dynamic onboarding process.

Step 3: Create an asset Smart Group to add Windows servers to Password Safe management

1. Select Smart Rules in the left menu.
2. Select Create Smart Rule.
3. Select a Category, then enter a clear Name and Description.
4. Under Selection Criteria, add these two filters:
   • Operating System, contains, windows
   • Asset fields, Domain Name, contains, your domain name
5. Under Actions, select Show asset as Smart Group, then select View assets in a standard asset grid.
6. Add the Manage Assets using Password Safe action and set these values:
   • Platform: Windows
   • Account Name Format: Domain\Username
   • Functional Account: the functional account you created
7. Select Create Smart Rule.

🚧

Important

The Operating System filter groups servers that share the same functional account. The action then ties that functional account to each system. Process this Smart Group repeatedly, especially after each scan finishes, so new servers are added to Password Safe automatically.

Step 4: Create a managed system Smart Group to grant system access to user groups

This step is optional, but it helps you group systems that share the same managed accounts and assign asset-level permissions to user groups. Assets added to Password Safe management appear in the All Managed Systems Smart Group automatically.

1. Select Smart Rules in the left menu.
2. Select Managed System from the Smart Rule Type filter list.
3. Select Create Smart Rule.
4. Select Managed Systems from the Category list.
5. Enter a clear Name and Description.
6. Under Selection Criteria, select Platforms, then select Windows.
7. Under Actions, select Show managed system as Smart Group.
8. Select Create Smart Rule.

Step 5: Create a managed account Smart Group to add accounts to Password Safe management

Start with the built-in Administrator account. After you review your discovery reports, you can add other privileged account names to this Smart Group.

1. Select Smart Rules in the left menu.
2. Select Managed Account from the Smart Rule Type filter list.
3. Select Create Smart Rule.
4. Select Managed Accounts from the Category list.
5. Enter a clear Name and Description.
6. Under Selection Criteria, select User Account Attribute, select Account Name, select equals, then enter Administrator.
7. Set Discover Accounts for Password Safe Management to Yes, then select the Smart Group you created in Step 3 as the source to discover accounts from.
8. Under Actions, select Show managed account as Smart Group.
9. Add the Manage Account Settings action and set the Password Rule, turn on Enable Automatic Password Management, then set the Change Password Time and Change Password Frequency.
10. Select Create Smart Rule.

ℹ️

The Manage Account Settings action onboards the account if the scan finds it on the system. It also controls whether Password Safe rotates the password right away.

Step 6: Create a managed account Smart Group to add directory accounts and link them

1. Select Smart Rules in the left menu.
2. Select Managed Account from the Smart Rule Type filter list.
3. Select Create Smart Rule.
4. Select Managed Accounts from the Category list.
5. Enter a clear Name and Description.
6. Under Selection Criteria, select Directory Query, select Include Accounts from Directory Query, select your query, then turn on Discover Accounts for Password Safe Management.
7. Under Actions, select Link domain accounts to Managed Systems, then select the asset or managed system Smart Group you created in Step 3 or Step 4.
8. Add the Manage Account Settings action, set the Password Rule, then set Enable Automatic Password Management to No.
9. Select Show managed account as Smart Group.
10. Select Create Smart Rule.

ℹ️

You can split these actions across several managed account Smart Groups. Use Child Smart Rule or other criteria for the linking rule if that fits your environment better.

Step 7: Assign user group permissions and roles for account access

In this workflow, your Password Safe users are Requestors with an access policy that auto-approves RDP sessions.

1. In the left menu of the BeyondInsight console, select Configuration.
2. Under Role Based Access, select User Management.
3. Find your user group in the grid, then select the vertical ellipsis button for that group.
4. Select View Group Details.
5. In the Group Details pane, select Smart Groups.
6. In the Smart Groups Permissions grid, select the Smart Group you created in Step 6, then select Assign Permissions.
7. Select Assign Permissions Read Only.
8. Select the vertical ellipsis button for the Smart Group, then select Edit Password Safe Roles.
9. Select the Requestor role, then select your access policy.
10. Select Save Roles.

Verify the results

Confirm that your Windows servers appear under Password Safe > Managed Systems and that the directory admin accounts appear under Password Safe > Managed Accounts. Verify that each directory account is linked to the correct managed system and shows the rotation schedule you set. Then have a member of the user group sign in and confirm they can request an RDP session that approves automatically.

Next steps

• Add more privileged account names to the managed account Smart Group as your reports identify them.
• Schedule the Discovery Scan to repeat so new servers onboard on their own.
• Add directory admin accounts for Linux servers and network devices using the same pattern.
• Define just-in-time access policies to narrow the window in which access is granted.

Related resources

• Add Local Admin Accounts for Windows Servers
• Add Directory Admin Accounts for Linux Servers
• Define Just in Time access policies