Skip to main content

Register Linux systems with a domain service account

You can set one Linux service account for a domain. Netwrix Privilege Secure for Discovery then uses that account for every Linux system in the domain that you register without credentials, so you don't enter a user name and password for each system.

Prerequisites​

  • The Linux systems are in the domain and the product has found them in Active Directory (AD).
  • The account meets the requirements in Linux registration prerequisites.
  • You can sign in to the product as an administrator.

Choose the account type​

The format of the user name decides who creates the account:

FormatMeaning
DOMAIN\UsernameA domain account that already exists. The product doesn't create it. Systems must resolve and authenticate it, for example through SSSD. The account can use a password only, not an SSH key.
UsernameA local account. At registration, the product creates it on each system with the password that you enter, or uses it if it exists.

Set the domain Linux service account​

  1. Go to Configure > Server.

  2. In Domain Configuration, select the arrow next to the domain to expand it.

  3. In the Linux Service Account section, enter the user name in Username (Domain or Local), for example CORP\svc-netwrix.

  4. Enter the password in Password.

    The Linux Service Account section of a domain, with Username and Password fields

  5. Click Save.

Fill in both fields or leave both empty. If you fill in only one, the product shows Linux Service Account must be filled or left blank entirely.

Register systems with the account​

Register a Linux system and leave out the registration user name and password. Only administrators can do this. If the domain has no Linux service account, registration fails and asks for credentials. For the methods, see Register Linux systems by using the API.

A system keeps its own credentials if it already has them. Systems that you registered with credentials before you set the domain account continue to use those credentials. There is no supported way to move a system's own stored credentials to the domain service account: scans keep using the system's own credentials, even if you register the system again. Contact Netwrix Support.

Set the directory bridging solution​

Set the solution that the system uses, such as SSSD, with one of these methods:

  • On the Grant Access screen, use the Directory Bridging setting of the system.
  • In the Quickstart tool, set Set Directory Bridging Strategy and Set Directory Bridging Domain in the report. See Report and update systems.
  • Call the API.

For the available solutions, see Linux systems and Active Directory.