Pre-10.7.1 Agent Hardening

Users on Privilege Manager v10.7.1 or up should use the new policy named Restrict Account Permissions on Agent Services (Windows). Refer to Agent Hardening 10.7.1 and up for details on the policy used starting with Privilege Manager v10.7.1.

Editing the Agent Service Start / Stop Control (Windows) Policy

  1. Navigate to ADMIN | Policies.

  2. Click on the General Tab.

  3. In the Name field enter Agent Service Start / Stop Control.

  4. Click on the Agent Service Start / Stop Control (Windows) policy.

  5. To customize the Agent Hardening policy navigate to the Parameters tab.

  6. Click Edit.

  7. Under User Services click the + button and use the search field to select the Services to be targeted by the task

  8. Under User Accounts click the + button and use the search field to find the specific user account that has permissions to make changes to the Agent services.

  9. Click Save.

If you require a rollback of the agent hardening due to upgrade issues, use the manual Restore Default Agent Permissions procedure following below.

Restore Default Agent Permissions

If you need to rollback agent hardening on your endpoints, follow these steps to restore the default agent permissions:

  1. Navigate to ADMIN | Config Feeds.
  2. Expand Privilege Manager Product Configuration Feeds.
  3. Expand Thycotic Management Server Core.
  4. Install Reset Agent Service Permissions.

Following the Configuration Feed installation,

  1. Navigate to ADMIN | Policies and select the General tab.

  2. Search for the agent service policies and select to edit.

  3. Disable the Agent Service Start / Stop Control (Windows) policy.

    1. Click Edit.
    2. Deselect Enabled.

    1. Click Save.

  4. Enable the Agent Service Clear Restrictions (Windows) policy.

    1. Click Edit.
    2. Select Enabled.

    1. On the Targets tab specify the computers that need to be targeted by this policy.
    2. On the Triggers tab specify when to run and/or what events will trigger the policy to run.

  5. Click Save.