Lithnet Access Manager
PricingRequest a trial or quoteDownloads
v1.0
v1.0
  • Home
  • How does Access Manager help prevent lateral movement
  • Access Manager Editions
  • Licensing
  • Change log
  • Installation
    • Downloads
    • Creating a service account for the Access Manager service
    • Choosing between the Microsoft and Lithnet agents for LAPS support
    • Installing Access Manager
      • Access Manager Agent
      • Access Manager Service
  • Configuration
    • Setting up Authentication
      • Setting up smart card authentication
      • Setting up authentication with ADFS
      • Setting up authentication with Azure AD
      • Setting up authentication with Okta
    • Deploying features
      • Setting up Microsoft LAPS
      • Setting up Bitlocker access
      • Setting up Just-in-Time access
      • Setting up password encryption and history
      • Installing in a Failover Cluster
      • Integrated Windows authentication
    • Importing authorization rules
      • Importing BitLocker permissions
      • Importing local administrators group membership
      • Importing Microsoft LAPS permissions
      • Importing mappings from a CSV file
      • Importing rules from Lithnet LAPS web app
  • Help & Support
    • Frequently asked Questions
    • Troubleshooting
    • Getting Support
  • Advanced help
    • Advanced help topics
      • Access evaluation in Access Manager Service (AMS)
      • Performing an offline discovery of local admins
      • Script-based authorization
      • Backing up Access Manager
      • Recovering from a lost encryption certificate private key
    • Application help pages
      • Active Directory
      • Audit variables
      • Auditing Page
      • Auditing scripts
      • Authentication Provider
      • Authorization Page
      • BitLocker Page
      • Effective Access Page
      • SMTP Server Settings
      • High Availability Page
      • Proxy Settings
      • Jit Access Page
      • Licensing-Page
      • Local Admin Passwords Page
      • Rate Limits Page
      • User Interface Page
      • Web Hosting Page
Powered by GitBook
On this page
  • Prerequisites
  • Step 1: Create a service account
  • Step 2: Prepare an SSL certificate
  • Step 3: Download and install the AMS service
  • Step 4: Configure the web host
  • Step 5: Configure your authentication provider
  • Step 6: Configure the Web User Interface
  • Step 7: Configure Email server
  • Step 8: Configure Rate Limits
  • Step 9: Configure IP Detection
  • Step 10: Configure Active Directory permissions
  • Step 11: Configure Auditing
  • Step 12: Configure support for local admin password, just in time access, and Bitlocker

Was this helpful?

  1. Installation
  2. Installing Access Manager

Access Manager Service

Prerequisites

In order to install the Access Manager Service, the following prerequisites must be met;

  1. Windows Server 2012 R2 or later

  2. .NET Core Desktop Runtime 3.1.4 or later installed

  3. ASP.NET Core Hosting Bundle 3.1.4 or later installed

  4. An SSL certificate for the AMS web site

Step 1: Create a service account

The Access Manger Service needs to run under the context of a domain user account. We strongly recommend using a group-managed service account for this purpose. We've created a guide for setting up a GMSA which includes a script to get you up and running quickly.

Do not grant any specific permissions to this account and most certainly don't add it to super-privileged groups like Domain Administrators. As you go through the setup process, you'll be given scripts to delegate permissions specific to the functionality you want to enable.

Step 2: Prepare an SSL certificate

Determine the host name you will use to access AMS and request an SSL certificate from your certificate provider. Install the certificate in the 'personal' store of the local computer.

Step 3: Download and install the AMS service

  1. Download the latest version from the releases page.

  2. Download and install the .NET Core Desktop runtime and the ASP.NET Core hosting bundle, or if your server has internet access you can let the installer download and install these for you

  3. Run the AMS installation package. Follow the prompts to install the application and provide the service account created in step 1 when prompted.

Step 4: Configure the web host

Run the Access Manager Service configuration tool. You'll be prompted to set up the web host.

Click the Select from store... button and select the certificate you installed in step 2.

Validate that the ports are correct, and click File, then Save.

More information on configuring the web host

Step 5: Configure your authentication provider

AMS supports several different authentication providers. Read the guide on configuring authentication and choose an authentication provider. We strongly recommend using a modern authentication provider that supports strong authentication and can enforce multi-factor authentication. While integrated windows authentication is provided, we recommend you only use this for testing purposes.

The following pages will guide you through the process of configuring the relevant authentication provider for use with Access Manager.

  • Setting up authentication with Azure AD

  • Setting up authentication with Okta

  • Setting up authentication with ADFS

Step 6: Configure the Web User Interface

Configure the user interface as per your organization's requirements. You can customize the name of the application, provide your own logo and even provide some custom policy text for the access request page.

More information on user interface settings

Step 7: Configure Email server

You'll need to configure an outbound mail server in order to receive audit alerts via email.

More information on email settings

Step 8: Configure Rate Limits

In order to ensure that your service is not used inappropriately, you can place limits of the number of requests a user can make in a given time. You should set these high enough that your users are not going to encounter rate limit issues under normal usage, but low enough to limit the impact of inappropriate or malicious usage of the service.

More information on rate limiting

Step 9: Configure IP Detection

If you put AMS behind a reverse proxy or load balancer, you'll need to configure IP address detection. This is to ensure that AMS logs the correct IP address in audit logs, and applies rate limiting correctly.

More information on IP address detection

Step 10: Configure Active Directory permissions

From the Active Directory tab, check that the AMS service account is a member of the Windows Authorization Access Group and Access Control Assistance Operators built-in groups within each domain. This is required for the AMS service account to be able to calculate access permissions for users and computers within these domains.

You will need to restart the service to pick up the new group membership in the local domain.

Don't worry about the schema section at this stage, if you need to deploy any schema changes the appropriate feature guide will direct you to do so.

More information on configuring Active Directory

Step 11: Configure Auditing

AMS has a powerful auditing engine that allows you to receive notifications when access is granted or denied to a user. AMS logs audit events to the Windows event log all the time, but you can also send audit events via email, through a custom PowerShell script, or even to Slack or Microsoft Teams using a web hook.

More information on Auditing

Step 12: Configure support for local admin password, just in time access, and Bitlocker

Now that you have the core application set up, you can configure the Access Manager features you are interested in;

  • Setting up Microsoft LAPS

  • Setting up password encryption and history

  • Setting up JIT access

  • Setting up BitLocker access

PreviousAccess Manager AgentNextSetting up Authentication

Last updated 3 years ago

Was this helpful?

!