Lithnet Access Manager
PricingRequest a trial or quoteDownloads
v2.0
v2.0
  • Home
  • What's new in Access Manager v2
  • How does Lithnet Access Manager help prevent lateral movement?
  • Access Manager Editions
  • Licensing
  • Change log
  • Installation
    • Getting started
    • System Requirements
    • Downloads
    • Upgrading from Access Manager v1
    • Installing the Access Manager Server
      • Creating a service account for the Access Manager Service
      • SQL installation options
      • Installing the Access Manager Service
      • High availability options
        • Load balancing Access Manager
        • Installing Access Manager in a Failover Cluster
    • Installing the Access Manager Agent
      • Choosing between the Microsoft and Lithnet agents for LAPS support
      • Installing the Access Manager Agent on Windows
      • Installing the Access Manager Agent on Linux
      • Installing the Access Manager Agent on macOS
  • Configuration
    • Setting up Authentication
      • Setting up authentication with ADFS
      • Setting up authentication with Azure AD
      • Setting up authentication with Okta
      • Setting up smart card authentication
      • Setting up integrated windows authentication
    • Deploying Features
      • Setting up Microsoft LAPS for Active Directory
      • Setting up Microsoft LAPS for Azure Active Directory
      • Setting up Lithnet LAPS
        • Preparing the AMS directory
        • Setting the AMS directory for Lithnet LAPS clients
        • Setting up Lithnet LAPS for Azure AD joined and registered devices
        • Setting up Lithnet LAPS for domain-joined devices
        • Setting up Lithnet LAPS for macOS and Linux
        • Setting up Lithnet LAPS for standalone Windows devices
      • Setting up BitLocker access
      • Setting up JIT for computers
      • Setting up JIT for roles
    • Importing authorization rules
      • Import Microsoft LAPS permissions from Active Directory
      • Importing BitLocker permissions from Active Directory
      • Importing local administrator group membership from domain-joined Windows devices
      • Import mappings from a CSV file
      • Importing rules from the Lithnet LAPS web app
      • Performing an offline discovery of local admins
  • Help and support
    • Frequently asked Questions
    • Troubleshooting
    • Quick start guides
      • Getting started with Windows LAPS and Lithnet Access Manager
      • Getting started with Windows LAPS for Active Directory
      • Getting started with Windows LAPS for Azure Active Directory
    • Support Articles
      • KB000001: The Access Manager Agent cannot connect and logs a token-validation-failed error
      • KB000002: Users retain their admin rights after their JIT period expires
      • KB000003: Configuring the Access Manager Agent to manage an account other than 'root' on Linux
      • KB000004: Creating a log file to troubleshoot installation issues with the Access Manager Service
      • KB000005: Access Manager stops working after applying the November 2022 Windows update
      • KB000006: Migrating the Access Manager Database
      • KB000007: Adding JIT groups via Group Policy doesn't work with NTLM Disabled
      • KB000008: AMS is unable to JIT into privileged groups such as Domain Admins
    • Advanced help topics
      • Ports and traffic flows
      • Internet access requirements
      • Access evaluation in Access Manager Service (AMS)
      • Recovering from a lost encryption certificate
      • Script-based authorization
      • Customized auditing with PowerShell notification channels
      • Variables available in audit notification channels
      • Setting up audit templates
      • Backup and Restore
      • Event ID reference
    • PowerShell reference
      • Add-AmsDeviceRegistrationKeyGroup
      • Add-AmsGroupMember
      • Export-AmsServerDiagnostics
      • Get-AmsActiveDirectoryJitOptions
      • Get-AmsComputerAuthorizationRule
      • Get-AmsDevice
      • Get-AmsDeviceRegistrationKey
      • Get-AmsGroup
      • Get-AmsGroupMembers
      • Get-AmsHostConfig
      • Get-AmsJitSchedulerJob
      • Get-AmsLocalAdminPassword
      • Get-AmsLocalAdminPasswordHistory
      • Get-AmsRoleAuthorizationRule
      • New-AmsComputerAuthorizationRule
      • New-AmsDeviceRegistrationKey
      • New-AmsGroup
      • New-AmsRoleAuthorizationRule
      • Remove-AmsComputerAuthorizationRule
      • Remove-AmsDevice
      • Remove-AmsDeviceRegistrationKey
      • Remove-AmsDeviceRegistrationKeyGroup
      • Remove-AmsGroup
      • Remove-AmsGroupMember
      • Remove-AmsJitSchedulerJob
      • Remove-AmsRoleAuthorizationRule
      • Set-AmsActiveDirectoryJitOptions
      • Set-AmsComputerAuthorizationRule
      • Set-AmsDevice
      • Set-AmsDeviceRegistrationKey
      • Set-AmsGroup
      • Set-AmsHostConfig
      • Set-AmsRoleAuthorizationRule
    • Application help pages
      • Access Manager Directory configuration page
      • Access Manager Directory Devices page
      • Access Manager Directory Groups page
      • Lithnet LAPS configuration page (Access Manager Directory)
      • Access Manager Directory Registration Keys page
      • Lithnet LAPS configuration page (Active Directory)
      • Microsoft LAPS configuration page
      • Active Directory configuration page
      • Auditing page
      • Authentication configuration page
      • Computer authorization rules page
      • Role authorization rules page
      • Azure Active Directory configuration page
      • BitLocker configuration page
      • Database configuration page
      • Effective access page
      • Email configuration page
      • IP Address detection configuration page
      • Just-in-time access configuration page
      • Licensing configuration page
      • Rate limit configuration page
      • Host configuration page
      • User interface configuration page
      • Security page
    • Getting Support
Powered by GitBook
On this page
  • Community Edition
  • Enterprise Edition
  • Feature comparison
  • Web Interface features
  • Lithnet Access Manager Agent password management features
  • Just-in-time access features
  • BitLocker features
  • Authentication features
  • Auditing features
  • Infrastructure
  • Authorization features
  • Configuration management features
  • Support

Was this helpful?

Access Manager Editions

PreviousHow does Lithnet Access Manager help prevent lateral movement?NextLicensing

Last updated 1 year ago

Was this helpful?

Community Edition

Access Manager Community edition is our core offering, that contains all the features that an organization need to help defend themselves from lateral movement-based attacks. You can provide your users full access to Microsoft LAPS passwords and request just-in-time admin access to computers all from the convenience of their browser.

Community edition is completely free for any organization of any size to use.

Enterprise Edition

Enterprise edition customers can deploy the Lithnet Access Manager Agent, which enables LAPS support for devices that aren't joined to your Active Directory domain. The agent runs on Windows, macOS, and Linux, and supports Azure Active Directory joined and registered devices.

Enterprise edition also enables additional functionality, such as support for high availability, and advanced custom authorization rules.

See the page for information on how to trial or purchase an Enterprise Edition license.

Feature comparison

Web Interface features

The Access Manager web interface is the main feature of the product that your support staff and end users will be interacting with.

Feature
Community Edition
Enterprise Edition

Access to local admin passwords set by the legacy Microsoft LAPS agent

Access to local admin passwords set by the new Microsoft Windows LAPS agent

Access to local admin passwords set by the Lithnet Access Manager Agent 1

Access to BitLocker recovery passwords

Just-in-time administrative access to Windows computers

Just-in-time access to custom roles

Limited to 3 roles

'Read aloud' function for passwords (where supported by the browser)

Phonetic display of passwords

Access to local admin password history 3

Show the local admin username 3

Trigger LAPS password change when the password has been accessed 4

Lithnet Access Manager Agent password management features

Enterprise edition customers benefit from the following capabilities when they deploy the Lithnet Access Manager agent to their devices to manage LAPS passwords.

Feature
Community Edition
Enterprise Edition

Manage local admin passwords of domain-joined devices and store them in Active Directory (domain-joined Windows clients only)

Manage local admin passwords of non domain-joined devices and store them in the Access Manager database

Limited to 100 devices

Encrypted storage of passwords

Retain historical local admin password history

Support for domain-joined Windows devices

Support for non-domain joined Windows clients

Limited to 100 devices

Support for macOS devices (Intel and arm64)

Limited to 100 devices

Support for Azure AD joined Windows 10 and higher devices

Limited to 100 devices

Support for Azure AD registered Windows 10 and higher devices

Limited to 100 devices

Support for Linux distributions (x64, arm64, arm32) 2

Limited to 100 devices

Just-in-time access features

Feature
Community Edition
Enterprise Edition

Just-in-time administrative access to Windows computers

Just-in-time access to Active Directory role-based groups

Limited to 3 roles

BitLocker features

Feature
Community Edition
Enterprise Edition

Read BitLocker recovery passwords from AD

Authentication features

Access Manager supports several authentication mechanisms. You can use a modern authentication provider like Azure AD or Okta to add MFA support to your Access Manager instance.

Feature
Community Edition
Enterprise Edition

Support for Integrated Windows Authentication

Support for OpenID Connect

Support for WS-Federation

Support for smart-card authentication

Auditing features

Feature
Community Edition
Enterprise Edition

Log events to the Windows event log

Send audit notifications via webhooks

Send audit notifications via email

Send audit notifications via custom PowerShell scripts

Infrastructure

Feature
Community Edition
Enterprise Edition

Multi-domain support

Cross-forest trust support

Single-server deployments

Windows Failover cluster deployments

Load-balanced deployments

Authorization features

Feature
Community Edition
Enterprise Edition

ACL-based authorization

Custom PowerShell script-based authorization

Global rate-limiting on requests

Import Microsoft LAPS permissions from Active Directory

Import BitLocker recovery password permissions from Active Directory

Import local admin permissions from computers

Import permissions from CSV file

Import LAPS permissions from the Lithnet LAPS Web App

Configuration management features

Feature
Community Edition
Enterprise Edition

Manage AMS groups from the UI

Manage AMS groups from PowerShell

Manage AMS devices from the UI

Manage AMS devices from PowerShell

Manage AMS registration keys from the UI

Manage AMS registration keys from PowerShell

Create and modify authorization rules using the UI

Create and modify authorization rules using PowerShell

Support

Feature
Community Edition
Enterprise Edition

Community support via GitHub

Enterprise support by Lithnet

  1. Requires the use of the Lithnet Access Manager Agent

  2. Requires the use of the Lithnet Access Manager Agent or the Microsoft Windows LAPS client

  3. Not supported when using the Microsoft Windows LAPS client and storing the password in Azure AD

Learn more about .

See the page on for more details

licensing
the differences between the Microsoft and Lithnet LAPS Agents
supported Linux operating systems