You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/kb/1secure/configure_proxy_for_rdp_connections_(installupdate_certificate_to_prevent_rdp_certificate_warnings).md
+20-20Lines changed: 20 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ This article outlines the process for installing or updating a certificate to pr
25
25
26
26
> **IMPORTANT:** The Certification Authority's post-deployment configuration must be completed after installing both prerequisite roles.
27
27
28
-
28
+
29
29
30
30
- The domain must have the **Enrollment Policy** set to enable automatic enrollment and renewal. The **Certificate Enrollment Policy** for user and computer certificates is configured in the **Group Policy** snap-in under **Default Domain Policy** (or another group policy applied to all systems that will access an NPS server on a group-by-group basis). To configure this:
31
31
@@ -39,28 +39,28 @@ This article outlines the process for installing or updating a certificate to pr
39
39
> **NOTE:** If you already have a certificate to install, you can skip to the **Adding the Certificate to Each SbPAM Proxy Server** section below.
40
40
41
41
1. Open **Certification Authority**, open your CA, right-click **Certificate Templates**, and click **Manage**.
42
-
42
+
43
43
44
44
2. In the **Certificate Templates Console**, right-click **Workstation Authentication**, and click **Duplicate Template**.
45
-
45
+
46
46
47
47
3. On the **General** tab, change the name to **Client-Server Authentication** and enable the **Publish certificate in Active Directory** checkbox.
48
-
48
+
49
49
50
50
4. On the **Subject Name** tab, enable the **Supply in the request** radio button.
51
-
51
+
52
52
53
53
5. On the **Extensions** tab, select **Application Policies** and click **Edit**. Click **Add**, then select **Server Authentication**. Click **OK** until you return to the **Properties of New Template** dialog.
54
-
54
+
55
55
56
56
6. On the **Security** tab, select **Domain Computers** and enable the checkbox to allow **Autoenroll**. Click **OK** and then close the Certificate Templates Console.
57
-
57
+
58
58
59
59
7. Back in **Certification Authority**, right-click **Certificate Templates**, hover over **New**, and click **Certificate Template to Issue**.
60
-
60
+
61
61
62
62
8. Select **Client-Server Authentication** and click **OK**.
63
-
63
+
64
64
65
65
9. On the desktop, create a text file named **request.inf** with the following content (replace the **red** text with your server certificate name):
66
66
@@ -95,44 +95,44 @@ This article outlines the process for installing or updating a certificate to pr
11. To sign the certificate request, use your preferred signing mechanism. The following example uses Active Directory Certificate Services (`https://<servername>/certsrv`).
101
-
 
101
+
 
102
102
103
103
Click **Request a certificate**, then click **advanced certificate request**.
104
104
105
105
12. Open the saved certificate signing request (**rdp.csr**) from the previous step in Notepad. Copy the certificate request into the **Saved Request** field. Select **Client-Server Authentication** from the **Certificate Template** dropdown. Click **Submit**.
106
-
106
+
107
107
108
108
Leave other settings at default values, and click **Submit**.
109
109
110
110
13. Select **DER encoded** and click **Download certificate**.
111
-
111
+
112
112
113
113
14. Open the downloaded certificate and select **Install Certificate**. Proceed with all default values and complete the wizard.
114
-
114
+
115
115
116
116
15. To export the certificate, view certificates for the current user by launching **certmgr.msc** using the Windows **Run** menu.
117
-
117
+
118
118
119
119
Right-click the installed certificate (the certificate using the **Client-Server Authentication** template) and click **Export...**.
16. In the **Certificate Export Wizard**, change the **Export Private Key** option to **Yes, export the private key**.
123
-
123
+
124
124
125
125
17. For **Export File Format**, select **Personal Information Exchange - PKCS #12 (.PFX)**. Select the following checkboxes:
126
126
127
127
- Include all certificates in the certification path if possible
128
128
- Enable certificate privacy
129
129
130
-
130
+
131
131
132
132
18. For **Security**, enter a password of your choosing and select the AES256-SHA256 encryption option (3DES is no longer recommended by NIST).
133
133
134
134
> **IMPORTANT:** For **File to Export**, the file name **must** be **rdp.pfx**. If it is named anything else, importing the .pfx file on each proxy server will not work.
135
-
135
+
136
136
137
137
19. This certificate can now be imported to each SbPAM Proxy Server.
138
138
@@ -148,7 +148,7 @@ This article outlines the process for installing or updating a certificate to pr
148
148
"C:\Program Files\Stealthbits\PAM\ProxyService\sbpam-proxy.exe" ca import -p [PATH]\rdp.pfx
149
149
```
150
150
151
-
151
+
152
152
153
153
3. The new certificate has now been imported to an SbPAM Proxy Server. Repeat this process for all SbPAM Proxy Servers if using more than one. (The default installation of SbPAM uses one proxy service on the SbPAM server itself; however, additional proxy services can be distributed.)
Copy file name to clipboardExpand all lines: docs/kb/1secure/troubleshoot_failed_action_service_connections_to_windows_resources_(psremotingwinrm).md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -86,7 +86,7 @@ There are Group Policy settings used to filter the origin of WinRM requests via
86
86
87
87
Learn more about the **Allow remote server management through WinRM** Group Policy setting in [Configure Remote Management in Server Manager − Enabling or Disabling Remote Management ⸱ Microsoft 🡥](https://learn.microsoft.com/en-us/windows-server/administration/server-manager/configure-remote-management-in-server-manager#enabling-or-disabling-remote-management).
88
88
89
-
89
+
Copy file name to clipboardExpand all lines: docs/kb/accessanalyzer/access-information-center-not-reporting-attribute-changes.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ Ensure that differential scans for AD Inventory are enabled and running. This wi
37
37
38
38
- To enable differential scanning of AD Inventory, enable the **Collect only updates since the last scan** option in the query configuration as shown below:
39
39
40
-
40
+
41
41
42
42
- For further information on customizing the `AD > 1-AD_Scan` job, please visit: https://docs.netwrix.com/docs/auditor/10_8
Due to the change from IIS to a new web server, subdomain users will now need to include their domain prefix before their username when logging in.
33
33
34
-
34
+
35
35
36
36
> **NOTE:** You can create a more uniform and consistent log-in experience across all domains connected to the AIC by leaving it as is and requiring the domain prefix.
Copy file name to clipboardExpand all lines: docs/kb/accessanalyzer/collecting-ad-summary.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,9 +31,9 @@ Licensing of Netwrix Access Analyzer is based on the quantity of enabled AD user
31
31
To find this data:
32
32
33
33
1. Ensure **.Active Directory Inventory** has recently run or run now. Navigate to **Jobs** > **.Active Directory Inventory** > **1-AD_Scan** and click **Run Now**
4. Open `\NAA_Migration\NAA\Web\webserver.exe.config` and copy the content between `<appSettings></appSettings>` and paste it in place of the `<appSettings></appSettings>` block in `%SAInstallDir%Web\webserver.exe.config`.
6. Open the Netwrix Access Analyzer application and follow through the Access Analyzer Configuration Wizard, selecting **Choose a StealthAUDIT root folder path to copy from** if prompted.
1. See the following for more information on the Netwrix Access Analyzer Configuration Wizard: [Access Analyzer Initial Configuration](https://docs.netwrix.com/docs/accessanalyzer/12_0)
121
121
122
122
7. After completing the Configuration Wizard, the Access Analyzer Application should open automatically.
123
123
124
124
8. In the Access Analyzer Console, navigate to **Settings** > **Reporting**, and set the **Website URL** to contain the new console server's name.
9. If using Windows Authentication to connect Access Analyzer to its database (click **Settings** > **Storage**), open `services.msc` and set the **Netwrix Access Analyzer Web Server** service to log on as a **Windows** service account with appropriate permissions on the Access Analyzer database.
Copy file name to clipboardExpand all lines: docs/kb/accessanalyzer/disabling-the-server-header.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ This article explains how to disable the server header in Netwrix Access Analyze
30
30
> **NOTE:** Banner grabbing is the process of capturing banner information, such as application type and version, that is transmitted by a remote port when a connection is initiated. For more information, see Banner Grabbing ⸱ NIST 🔗
0 commit comments