Managing account operations | PAM Technical Documentation (On-Premises)

This section provides insights for managing daily or ongoing operations related to privileged accounts

Viewing account inventory

Viewing accounts inventory from the account management interface.

Login to the system and select PAM from the product navigator.
Navigate to Manage → Click on the Accounts from the Asset Management section.
List of all the accounts will be displayed.

Viewing account group membership

This section explains and demonstrates the procedure of viewing membership of accounts associated with different types of account groups:

Static group: This type of account group allows you to manage account grouping manually like adding or removing an account from the account group.
Rule-based group: This type of account groups works dynamically as per the defined attributes.

To view which accounts are linked to an account group follow the below steps (applicable for both Static and Rule-based account groups).

Login to the system and select PAM from the product navigator.
Navigate to Manage → Click on Account Groups from the Asset Management section.
Click on the Actions button on a desired account group → Select Linked Accounts tab.

Update account attributes

Login to the system and select PAM from the product navigator.
Navigate to Manage → Click on Accounts from Asset Management section.
Click on the Edit button next to the Account on which you desire to change the attributes.
You can change the details and click on the Update button to update the changed details in the system.

Update account attributes in bulk

Sectona PAM platform provides you an option to update multiple accounts in the system manually using the bulk update option. Follow the below steps to bulk update accounts in the system:

Login to the system and select PAM from the product navigator.
Navigate to Manage → Asset Management section select Accounts.
Click on Bulk Accounts and select the Update option.
On the next page → Select the desired Account Category → Interactive Account / Service Account.
Select an Authentication type for your account like Password or Key Based or Key Based + Secret Key.
Tags (optional): Add relevant tags to this user. Refer to the section on Tags for more information about adding context with tags.
Enforce Password Change enable for including the accounts for schedule-based password change job.
Click on the Status bar to keep the accounts active in the system.
Download the Import format by clicking on the Download format button.

Follow the below steps to fill-up the Import format sheet and upload data in the system:

Open the downloaded Import Format file.
Enter the Asset Type, such as Windows Server or Unix Based.
Enter either the Host Name or IP Address.
Enter the DB Instance (optional). This field is required only when onboarding an account for a database asset.
Enter the Account Name and Password.
Enter the Owner field to specify the account owner during bulk import or update.
Enter the Access Key and Secret Access Key only if the account authentication type is Key Based + Secret Key.
Select and copy all the required columns from the spreadsheet.
In the PAM web console, click Next.
Paste the copied data and click Next again.
Review the list of accounts and click Finish to onboard the accounts into the system.

Assigning account to account-group

Accounts can be a part of multiple account groups in the system. Newly added accounts are treated as an account without an account group. The system supports account groups based on static and dynamic attribute-based groups. To add an account to an account group:

Assigning Account to Account Group Using Asset Interface

Click on the Asset Management tab in the sidebar.
Click on Accounts button located in front of the asset you want to assign to a group.
You will now see the accounts linked to this asset and select the action button of account you want assigned.
Select the groups you want to assign to this account.
Click Save.

Assigning Account to Account Group Using Account Interface

Click on the Accounts tab in the sidebar.
Click on action icon and click on Groups.
Select the groups you want to assign to this account.
Click Save.

Link and update multiple assets to account

Navigate to PAM → Manage → Asset Management
Select additional assets to link to the account. If the account doesn't exist on a selected asset, the system will create it.
Unselect linked assets to change the account status to Inactive on those assets.
Select an inactive account to change its status back to Active.
Use the Show Linked Assets Only checkbox to display only assets currently linked to the account.

Linking account to asset in AD security-groups

Microsoft Active Directory allows granular control for controlling which privileged user or accounts can access specific assets or servers. This can normally be performed by enabling settings for Remote Desktop Configuration. If you would like to automatically link privileged accounts with assets as per active directory settings, you can use the AD Asset Linking technique. You will no longer need to link individual accounts to assets.

To map active directory accounts assets, follow the below steps:

Navigate to the Manage section and select the Asset Management option from the sidebar.
Select + Add Asset and fill in the form details or select existing directory server under Asset Category type as Directory Server.
Browse the account group and server group from the list fetched.
Click on the Status bar to activate this mapping.
Click on the Save button.
You need to start the AssetADSyncService service if it is stopped from System Status in the System section found in Platform Configuration.

Sectona automatically onboards any new accounts found in the respective security group. However, assets must be manually added or added as per a specific asset discovery scan job. To exclude the account from AD sync process, tick the Exclude From AD Sync checkbox in Manage Account window.

Configuring account dependencies

Some Windows services and applications depend on specific accounts to function correctly. When the password of a dependent account changes, the updated password may also need to be applied to associated services, files, scripts, scheduled tasks, or IIS application pools.

Sectona PAM allows you to configure account dependencies to perform the required actions before or after a password change, or when a password change fails. You can configure actions such as updating a password, executing a command or script, replacing a password in a file, and managing Windows services, scheduled tasks, and IIS application pools.

Procedure to Configure Account Dependencies

Navigate to PAM → Manage → Go to Asset Management from the sidebar.
Click Accounts to open the Accounts window.
Click the Action icon for the required account.
Open the Dependencies tab to access the account dependency configuration window.
Configure the required dependencies and their associated parameters.

Parameter	Description
Type	Specifies the action to perform for the dependency. Available types include Update Password in Account, Execute Command, Replace Old Password in File, Execute Script, Windows Services, Scheduled Task, and IIS Pool.
Asset	Specifies the asset on which the dependency action must be performed.
Account	Specifies the account associated with the dependency action.
File Path	Specifies the path of the file to be updated when replacing an old password or executing a script.
Parameter	Specifies the parameter to be affected by the dependency action.
Command	Specifies the command to execute for the configured dependency.
Options	Specifies the action to perform on supported dependency types, such as Start, Stop, Restart, or Update Password, where applicable. These options can be used for Windows services, scheduled tasks, and IIS application pools.
Ignore if Failed	Determines whether the password update process should continue when a dependency update fails. If disabled, the password update process stops when any dependency update fails. If enabled, the system continues updating the remaining dependencies even if one dependency update fails. In both cases, a notification and SIEM alert are generated for the failed dependency.
Active	Indicates whether the account dependency is currently active.

View session initiated by account

To audit any configuration changes by administrators of the system you can track by clicking on the Action icon corresponding to the account and then choose Session Activity.

Parameter	Description
ID	The unique session ID
Username	The entity who accessed the session
Asset Type	The type of asset
Hostname	The hostname of the asset
IP address	The IP address of the asset
Account	The account that was accessed
Login Time	The login time of the account
Duration	The total duration the account was accessed
Activity	Displays the activity graph of the corresponding session

Changing an account password

Method 1:

Follow any one of the methods to change the user account password.

Login to system and select PAM from the product navigator.
Navigate to the "Manage" and click on the Asset Management from the sidebar → Asset.
Click on the 'Account' button of that Account linked with the asset whose password you would like to change.
The listed accounts linked with that asset will be displayed.
Now, click on the edit button of the existing account to change its password.
Enter the new password in the defined field and click on Update.

Method 2:

Login to system and select PAM from the product navigator.
Navigate to the "Manage" and click on the Asset Management from the sidebar → Account.
Click on the 'edit' button of that Account whose password you would like to change.
Enter the new password in the defined field and click on Update.

View password change history

This section describes how to view and filter password change history for an account in PAM. The Password History section allows administrators to review password change and reconciliation activities based on the selected date range and status.

Navigate to Manage → Asset Management → Accounts.
Select the required account to open its details.
Navigate to the Password tab and select History.
Specify the From and To dates to filter history records by date range.
Select the required Status from the dropdown to filter records by their execution status.
Click the Refresh icon to apply the selected filters and view the matching records.

The history table displays the following details:

Field	Description
Type	Specifies the password operation, such as Change or Reconciliation.
Processed On	Displays the date and time when the operation was processed.
Initiated By	Displays the service or user that initiated the operation.
Status	Displays the execution status of the operation, such as Success.

To view the details of a password change or reconciliation operation:

In the History tab, locate the required record.
Click the timestamp in the Processed-On column to view the associated log details.
Review the log information, which includes the operation performed and its timestamp.

Viewing account activity

To view the account activity done by users and administrators, you can track by clicking on the Action button corresponding to the account and choosing the View Account Activity option from the drop-down list. It will display a roadmap of account activities on the screen.

Account activity option shows the following details in a timeline chart

Account created
Account Modified
Password Checkout
Password Changed/Reset
Session Taken

Icon	Title
	Edit
	Accounts
	Action