Skip to main content

Add a domain

Add each Active Directory domain that Netwrix Privilege Secure for Discovery manages. The domain connection lets the product read users, groups, and computers, and scan and protect Windows systems with service accounts.

Prerequisites​

  • Administrator access to Privilege Secure for Discovery.
  • A bind account that can read the directory, a scan mode account, and a protect mode account for the domain. See Service accounts for the permissions that each account needs.
  • A static domain controller (DC) address for the LDAP server. The product tracks changes with the highest committed update sequence number (USN) of one domain controller, and each domain controller counts USNs separately. If a load-balanced connection sends a request to a different domain controller, the product can miss group updates until the next daily full sync.

Add a domain​

  1. Select Configure > Server.

  2. In Domain Configuration, open the Add Domain list, and then select LDAP.

  3. Under Directory Connection Settings, enter the connection.

    The Directory Connection Settings of a new domain

    SettingDescription
    Domain NameThe domain name, such as example.com. Select Detect to fill in LDAP Server, LDAP Port, Search Base, and SSL from the DNS records of the domain.
    LDAP ServerThe fully qualified name of a domain controller.
    LDAP PortThe port of the domain controller, for example 636 for LDAP over SSL.
    SSLUses a secure connection to the domain controller.
    Verify CertificateChecks the certificate of the domain controller. Select SSL first to use it.
    CA Public CertificateThe PEM certificate of the CA that issued the certificate of the domain controller. See Trust a CA for the directory connection.
    Search BaseThe distinguished name where the search starts, such as dc=example,dc=com.
    Directory Authentication MethodSimple Bind, or SASL: Kerberos. See Configure SASL and Kerberos for LDAP.
    Bind DN and Bind PasswordThe bind account, as DOMAIN\Username.

  4. Select Test Connection.

  5. Under Directory Server Failover, decide whether the product tries another domain controller when the configured one is unavailable. See Configure directory server failover.

  6. Under Directory Search Settings, keep the defaults unless Support advises otherwise. Page Size is 1000 and Search Scope is Subtree.

  7. Under Windows Computer Authentication, select the Windows Authentication Method. See Choose the Windows authentication method.

  8. Under Windows Service Account, enter the Scan Mode Account and Protect Mode Account user names and passwords. Enter each user name as DOMAIN\Username, or as user@realm for a Kerberos domain. For a Kerberos domain, also enter the Domain NetBIOS Name.

  9. Under Default Policies, review Scan Mode, Protect Mode, and Offline Access.

  10. Optional: under Linux Service Account, enter the account that the product uses on Linux systems. See Service accounts.

  11. Select Save.

The domain appears in the Domain Configuration list with its connection, status, and default policy.

The Domain Configuration list with a domain and its default policy

Choose the default policies​

The default policies apply to the computers that the product adds to its inventory after you save the domain. They don't change computers that are already in the inventory. A new domain starts with Scan Mode and Protect Mode set to Disabled.

tip

Leave Protect Mode set to Disabled when you first set up a domain. A default of New Accounts: JITA protects every computer that the product imports afterward. Enable protect mode on a system only after the product has scanned it. See Set up scan mode.

Choose the Windows authentication method​

Windows Authentication Method controls how the product authenticates to Windows systems in the domain. NTLM is the default and fits most organizations.

When you select Kerberos, keep the following in mind:

  • The product authenticates with Kerberos only and doesn't fall back to NTLM.
  • Kerberos connects by service principal name (SPN) or fully qualified host name, not by IP address. DNS must return the correct current IP address for each target system.
  • The IP address override field on the Grant Access page doesn't work.
  • Kerberos depends on working reverse DNS lookups. This is a Kerberos requirement and not specific to the product.

The product reads the method from the domain settings each time that it scans or handles a request, so a switch from NTLM to Kerberos needs no restart.

Verify DNS for Kerberos​

  1. Look up the LDAP server name:

    nslookup <ldap-server-name>

  2. Look up the IP address that the first command returned. The result must return the same name.

    nslookup <ip-address-from-first-lookup>

  3. On the host, show the DNS servers that the host uses:

    resolvectl status

Limitations​

  • The product doesn't support LDAP referrals.
  • SASL doesn't work with SSL and requires port 389.