System Discovery Prerequisites

The following are parts of system discovery pre-requisites:

  • "Active Directory discovery requirements"
  • "Port scanning discovery requirements"
  • "Additional Windows discovery"

Active Directory Discovery Requirements

The first phase of the Active Directory discovery method looks for systems that are joined to Active Directory. Typically these are Windows systems but there may be Unix systems as well (requirements for Unix systems are detailed below). The target systems do not need to be online for this first phase of discovery and no special requirements are needed.

Active Directory Discovery Requirements for UNIX

UNIX systems are joined to Active Directory with the Delinea Authentication Service. A Server Suite Agent must be installed on the UNIX system. That agent is used to join the AD/LDAP for discovery when finding Unix systems. Systems are discovered by performing LDAP queries to Active Directory.

Port Scanning Discovery Requirements

The first phase of the Port Scanning discovery method is done by checking for open TCP ports on a target system. The systems must be online and the systems may or may not be joined to Active Directory. Once open ports are found, attempts are made to connect to the system. By default, one of the specified discovery accounts must be able to authenticate to the target system.

For Windows systems, read-only remote registry access is required along with the following:

  • Open firewall.
  • Ensure remote registry service is running.
  • Group Policies.
  • Discovery account must be a local admin.

One way to achieve this for systems that are joined to Active Directory is to use a discovery account that is a member of Domain Admins.

  • The Delinea Connector you use for discovery through port scanning must be on version 18.6 or newer. By default, all connectors are used for discovery. Contact Delinea Support to specify the use of specific connectors for discovery.
  • Port scanning requires IPv4 addresses.

For Unix and other systems that have SSH enabled, there are no special requirements. By default, systems that have no known connection credentials are ignored. However, if the "Import systems detected without known credentials" and "Ignore if system name not found in DNS" options are selected, a successful DNS reverse lookup on the system's IP address is required to add the discovered system.

Additional Windows Discovery

For either the Active Directory or Port Scanning methods of discovery, the second phase of discovery may optionally be configured to find additional information about Windows systems:

  • Discovery of local accounts.
  • Discovery of Windows services, scheduled tasks, and IIS Application Pools along with their associated accounts.

Discovery of Local Windows Accounts

To discover local accounts on a remote machine, the discovery engine needs to make remote calls to the Security Account Manager (SAM) database of the target system. On Windows desktop systems such as Windows 10, the discovery account may not have such permissions by default and you may need to update the Local Security Policy to enable this access. The specific policy setting is located under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network access: Restrict clients allowed to make remote calls to SAM.

img

Delinea recommends that you either add the discovery account to this list by clicking the "Edit Security...." button or add the "Authenticated Users" group to this list.

The following requirements are specific to Windows:

  1. As part of the detailed discovery, Privileged Access Service reads the following registry locations:

  2. HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\ParametersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\MachineHKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

  3. To remotely read these registry locations from the target machine, confirm the following:

    1. The "Remote Registry" service must be enabled on the target system.
    2. Certain firewall ports must be opened for the remote registry read to work properly. You can typically add a Windows firewall exception for the "Remote Service Management" group to achieve this.
    3. The first four registry keys referenced above must be added to the list of "remotely accessible registry paths" using either the local or domain group policy that applies to the target machine.
    4. img

  4. In general, you need to have local administrative privileges to remotely read registry from a system. However, you can work around that by enabling certain Group Policy settings that will allow remote access to the registry paths specified in the third pre-requisite.

  5. Since it may not be possible to manually enable the "Remote Registry" service or add firewall exception to each of the systems, you can bulk-apply these settings through group policy.

  6. The discovery account must have local administrative rights on each of the systems being probed for Privileged Access Service to perform a detailed discovery (discover services, scheduled task, and IIS application pools).

  7. Additionally, the firewall rules named “Remote Service Management” and “Remote Scheduled Tasks Management” must be enabled. If you do not have these rules enabled, you cannot perform a detailed discovery on the target system.

  8. In addition to the pre-requisite for running a detailed discovery, discovering IIS application pool requires a few specific ports configurations. See Port Requirements for IIS Applications Pools

A detailed discovery allows you to get more detailed information, such as the accounts associated with IIS application pools, services, and scheduled tasks.

Discovery of Windows Services, Scheduled tasks, and IIS Application Pools

To discover Windows services, scheduled tasks, and IIS application pools, perform the following steps.

"ClosedTo open a port for discovering scheduled tasks:"

"ClosedTo open a port for discovering IIS application pools:"

Discovery of UNIX Local Accounts

For either the Active Directory or Port Scanning methods of discovery, the second phase of discovery may optionally be configured to find local accounts on the system. The discovery account must be able to login to the target system and does not need to be a privileged account.