Skip to main content

Getting started with Privilege Secure for Discovery

Netwrix Privilege Secure for Discovery finds privileged accounts on Windows and Linux systems and removes standing administrator access. Users request just-in-time access when they need it, so privileged access exists only for the time a task requires. This page introduces the key concepts and the steps of a typical rollout.

Key concepts​

Scan mode

Scan mode reads a system to discover which accounts and groups have administrator access. Scan mode doesn't change anything on the system. Run scan mode first to understand your current exposure.

Protect mode

Protect mode manages the local administrator group on a system. Protect mode removes accounts that aren't marked persistent from the system and stores them in Privilege Secure for Discovery, which grants them back only when needed.

Just-in-time access (JITA)

With JITA, a user requests administrator access to a system for a limited time. The user must also be a member of an Active Directory (AD) group that has permission to access the system. Privilege Secure for Discovery doesn't change Active Directory.

Persistent accounts

A persistent account stays on the system and doesn't require a JITA request. Set service accounts to persistent so that software continues to work after a system enters protect mode.

Offline Access Management (OAM)

OAM maintains a local administrator account on a system, with a password that Privilege Secure for Discovery manages and rotates. Use it when a user can't reach Privilege Secure for Discovery, for example during a network outage. See Offline access management.

Typical rollout​

A rollout moves from visibility to enforcement in stages.

  1. Plan the deployment. Decide whether to use a single node or a three-node cluster, and decide how to recover from a serious failure. See High availability and disaster recovery.
  2. Review the requirements and install the containers.
  3. Add the domain and the service accounts. See Add a domain and Service accounts.
  4. Set up scan mode and review the results on the dashboard and on Insight > Overview.
  5. Add users to Privilege Secure for Discovery before you enable protect mode.
  6. Add the protect account to the local Administrators group on the systems to protect.
  7. Add a test system to protect mode to confirm that just-in-time access works as expected.
  8. Add multiple systems to protect mode with Bulk Actions on Management > Systems. For a large deployment, you can also use bulk onboarding and reporting.
  9. Optionally, roll out protect mode one group at a time. See Freeze mode.

Next steps​