cau - epm tion and agent deployment v3設(shè)置定義代理部署

EPMFundamentals:

SetDefinitionand

AgentDeploymentCyberArkUniversityPrivilegedManagementImplementationWorkflowServerInstallationAgentDeploymentSilentApplicationDiscoveryPolicyCreationExceptionManagementReportingAUDITINGPOLICIESDISCOVERYDEPLOYMENTINSTALLATIONObjectivesThissessionwilltakeyouthroughdeployingtheEPMagenttoendpoints:SetManagement/AccountManagement/

AccessDelegationEPMManagementConsoleUIDeployingAgentsAgentSelf-ProtectionSetManagement/AccountManagement/

AccessDelegationLogicalcontainerforcomputersandpolicies

Self-contained:Settingsmadetoaspecificsetaffectthatsetonly

Administratorsareboundtosets,determiningwhocanmanagewhichgroupsofmachinesandpoliciesCanbeusedtoreplicategeographicalororganizationalconsiderationsinEPM

SetsAccountManagementAccountAdministratorsGeneralEPMSettingsSetManagementUserManagementSetAdministratorsAgentDeploymentPolicyManagementCreatingFirstSetInordertomanagecomputersintheenterprise,asetmustbecreated

SelectSetManagement

andthenAccountManagement

FromtheCreatedropdown,chooseCreateSetCreatingFirstSetEnterinformationfornewset,includingSetName,SetDescription,

EmailAddress

andTimeZone

ClickonOK

AccountManagement-DefiningSetAdministratorsNext,wewilldefinetheAdministratorsforthenewset

ClickonUsers,notethepredefined“CyberArkEndpointPrivilegeManager”ADgroup

SelectCreate,CreateUserDefiningSetAdministratorsClickonAllowtomanageSetsClickonSelecttoopenSelectUsersorGroupsdialogClickonAdvanced…formoresearchoptionsEnterfirstcharactersofname,clickOKandNextDefiningSetAdministratorsSelectRoleforrelevantSetsfortheUserRoleManagementThestandardrolesare:FullControlSetAdminViewOnlySetAdmin

AdditionalRolescanbeaddedintheRoleManagementtabbyclickingonRoleandthenCreatenewRoleEPMManagementConsoleUI

MajorComponentsManagingSetsLoggingonasasetadministratorgivesadifferentviewNotethedifferentoptionsnowavailableinthenavigationpane.Note:IfInboxesdonotappearorisgrey,browsetohttps://<ServerName>/UserSets.aspxDashboardTheSummaryareagivessetadministratorsadashboardshowinganoverviewofpolicyusageandcomputerassets.ApplicationGroups&PoliciesTheInboxandPoliciesareasaretheheartoftheCyberArkEPMsolution.Policyautomationisenabled,policyeventsarecapturedandpoliciesarecreatedhere.End-UserUIGUIelementssuchasdialogboxes,pop-ups,balloonmessagesorwebpagescanbecustomized,updatedandenhancedusingtherichtextandgraphicseditingfunctionsfoundintheEnd-UserUIsection.AdvancedOptionsfortheCyberArkEndpointPrivilegeManagerServerandAgentcanbecustomizedintheAdvancedsection.DeployingAgentsAgentDeploymentTheCyberArkEPMAgentmustbedeployedtoallcomputersthatyouwanttomanage.

TheagentisinstalledusingacustomizedMSIinstaller,availablebyclickingonMyComputersthenDownloadAgentInstallationPackageAgentDeploymentMethodsTwomethodsforinstallingtheEPMagentonWindows:Automatedsoftwaredeploymentusinggrouppolicyorthird-partysoftwaredistribution(Mostcommonforlargeenterprisecustomers)Manuallyeitherbysupportstafforend-users(localadminrightsarerequiredforthisapproach,usefulforremoteusers)

Ineachcase,thecustomizedinstallerneedstobeusedasitcontainsinformationpointingtheclienttotheEPMserverandacorrespondingset

Alsonotethatthereareseparateinstallersavailableforx86andx64WindowsclientsaswellasMacAgentDeploymentviaSoftwareDistributionThecustomizedMSIinstallercanbeinstalledusingexistingdeploymentmethodslikeanyotherinstallerGrouppolicydistribution3rd-partysoftwaredeploymentsystem,suchasSCCM(SystemCenterConfigurationManager),LanDeskorAltirisStandardMSIinstallercommandline,e.g,

MSIEXEC/ICyberArkEPMAgentSetup_71(Set1)X64.MSI/qn

ExtraswitchesinCyberArkEndpointPrivilegeManagerServerUserGuideManualInstallationThecustomizedMSIinstallercanbedistributedmanually(e.g.viaemail)andinstalledmanuallyUsefulforremoteordisconnectedusersInstallationneedstoberunasadministratorUserscandouble-clickontheMSIfiletolaunchanattendedinstallationorusethestandardMSIinstallercommandline,e.g.

MSIEXEC/ICyberArkEPMAgentSetup_71(Set1)X64.MSI/qn

ExtraswitchesinCyberArkEndpointPrivilegeManagerSolutionGuideAddingEPMAgenttoStandardOSimageEachEPMend-pointhasauniqueagentIDwhichisrequiredtocommunicatewiththeEPMserver.

Whenusingimagecloningtoinstallmachines,thisagentIDmustberemovedbeforetheinitialimagecloneiscreated,otherwisemultiplemachinesusingthesameagentIDwillcauseconflicts.AddingEPMAgenttoStandardOSimageFollowtheprocedurebelowtoincludetheEPMagentinstandardOSimage.InstallagentontemplatePCwithOSimageRemovecontentofTracefolderC:\ProgramFiles\Cyberark\EndpointPrivilegeManager\Agent\TracesRemoveAgentID

entryfromHKEY_LOCAL_MACHINE\SOFTWARE\Viewfinity\AgentRecordGoldimageAftertheimageisdeployed,anewAgentIDwillbegeneratedautomaticallywhentheagentlaunchesforthefirsttime.MyComputersViewNomatterhowtheagentisinstalled,machineswillstarttoappearinMyComputers.

PossibletoapplyfiltersandgroupbyOUAgentSelf-DefenseGeneratingSecureTokenEPMSelf-defenseblocksusersfromstoppingagentprocesses,deletingormodifyingagentfilesfromdisk,andupgradingoruninstallingtheAgent.AsecuretokenisneededtocarryouttheseoperationsClickonMyComputers=>UpgradeorUninstallAgentRight-clickonagivenmachineandGenerateSecureTokenforallComputersorGenerateSecureTokenforselectedComputerGeneratingSecureTokenSetdesiredexpiryandclickonGenerateCodeisthendisplayedinGeneratedSecureTokenfieldUsingSecureTokenOpenelevatedcommandpromptandnavigatetoC:\Program

Files\Cyberark\EndpointPrivilegeManager\AgentRunthefollowingcommand:

vf_agent.exe