Global accounts
Use of global accounts
Global accounts allow you to store user data in a central location, which you can access repeatedly. Global accounts can be stored in various places within the ACMP Console, whenever you need to authenticate yourself to a client or the Active Directory, for example. Global accounts have the advantage that the data (domain, username and password) do not have to be changed at every point and they only have to be customised once when a change is made. All the necessary information is stored centrally and is available to you in the respective application areas.
Of course, you can also use specific installation accounts in addition to global accounts. Specific accounts must be set up individually each time and filled with the information.
Warning:
Global accounts are not multi-tenancy capable! This means that the accounts can be seen and used by other users.
Areas of application
Below you will find a location for the work within the ACMP Console for the respective application areas, as well as a short description and possible notes.
| ACMP area | Description | Note |
Distributed File Repositories (System > Distributed File Repositories) | When a new file repository is created, the ACMP Server accesses the file repository using the authentication of an account (account). This ensures that the stored user account has the required rights. | Depending on the selected connection type, the user interface may look slightly different. Choose from the following file repository connection types:
|
Settings for Active Directory (System > Settings > ACMP Server > Active Directory) | To read the information from the Active Directory, a user account with read access for all domains is required. If you want to use multiple domains, existing or newly added global accounts can also be used to make continuing domain queries. | |
Settings for the agent installation and network discovery account (System > Settings > ACMP Agent > General) | The user account stored here is used to distribute the ACMP Agent to the computers within your network. The account is also used for network detection, which is used in the ACMP Agent Installation. Therefore, give this account sufficient rights for the Remote Procedure Call (RPC), which enables the call of functions for other address spaces. | The Check rights on target computers option allows you to ensure that all computers found in the network are first checked to see if the specified account has sufficient rights for installation. Tick the box if you want to use this check. |
Use of a global account in the network (install ACMP Agent on selected computers) (Client Management > Agent Distribution > Network > Push ACMP Agent to selected computers) | Using the action Install ACMP Agent on selected computers you can select machines or entire domains or workgroups by highlighting them in the console beforehand. Initiate the installation and select a global or specific account that has sufficient rights. | As soon as you open the window, the Use specific account option is displayed as the preselected installation account. |
Use of a global account on the network (install ACMP Agent on a specific computer) (Client Management > Agent Distribution > Network > Push ACMP Agent to specific computer) | Use ACMP Agent Install on specific computer to install the Client on a single machine. To do this, you need to know the network name and enter it manually. | As soon as you open the window, the Use specific account option is displayed as the preselected installation account. |
Use of a global account in the network (Install in IP range) (Client Management > Agent Distribution > Network > Push to IP range) | If you want to install the ACMP Agent on all devices in a specific IP range, you can enter a valid IPv4 address here (including start and end IP). | As soon as you open the window, the Use specific account option is displayed as the preselected installation account. |
Display settings for the display in the ACMP Kiosk (Client Management > ACMP Kiosk > Add > Content selection for Kiosk Select entry > Wizard Page „Visibility“ | When adding a new Kiosk entry, you can define the environment settings for displaying an entry and thus determine its visibility. The global account is only available for selected options. | You can also access a global account based on the following criteria:
|
Adding a new product in Licence Management (Licence Management > Products > Add > Wizard page Product metric „Metric type: User CAL/ Device CAL > Next > Automatic consumers > Add a LDAP Query (Computer) or (ACMP Query (Clients)) | Add a user-based LDAP Query for the new product in the Licence Management. This stores the account for searching the Active Directory, which you can then access. | The assignment of consumers is done via the product metric. To assign a global account, you must select either User CAL or Device CAL. |
Client Command UI Interaction (UI Automation) oder Client Command Shell execute Command (Client Commands > Create > UI Automation > UI Interaction > Tab „Run as“) and (Client Commands > Create > Processes and Shell > Shell execute command > Tabs „Connection“ and „Run as“) and (Client Commands > Create > Execute PowerShell script > „Run as“) | The commands can be used to automatically store global accounts that are taken into account when Client Commands are executed. |
Manage global accounts
To use a global account, you must be in one of the areas of the ACMP Console described above. It is not possible to access the global accounts from anywhere else. Depending on the user interface you are using, you can either use an existing global account or add a new account. Access partially determines which options are available. For example, the Active Directory allows you to use multiple domains. These are managed by global accounts so that multiple domains can be queried.
Add global accounts
Note:
You can add a global account in the areas using the Add button.
If you want to access an account via the Active Directory (System > Settings > ACMP Server > Active Directory), the action field is called Link. Click Add. A new window opens with the properties of the login information. Enter the domain, username and password that you want to use. Then decide whether you want to use encryption for the global account. You can only choose from the two options None and SSL/TLS. If you select the latter, the transmitted data will be encrypted. Additional information can be stored under the description. For example, you can use a short sentence to describe which special rights or access the domain should have (e.g. it is an account with reading rights). Tick the box under Use static IPs if you want to enable this option. This activates the section below: The domain controller and global catalog IPs.
The main purpose of the two IP types is to exclude a level in the network communication, since otherwise the IP would be found and addressed on a machine. By storing the IP address, the domain controller or global catalog is addressed directly:
- Domain Controller IP: If it is not possible for the ACMP Server to reach the domain controller by name, you can store the static IP address here.
- Global Catalog IP: If the ACMP Server cannot access the Global Catalog by name, you can enter the static IP address here.
With the activation of the option ‘Use static IPs’, the DNS queries are not used for communication, but the configured static IPs. It makes sense to use a static IP (Domain Controller IP or Global Catalog IP) if, for example, the domain controller cannot be resolved by Windows' own mechanisms. Otherwise, you can leave the field disabled.
Properties of the credentials
Note:
Please note that you can only use LDAPS in ACMP if both the server and the console are in the same domain, otherwise the certificates will not be transferred. If you are in a workgroup, LDAP may work, but not the encrypted variant (LDAPS), because a domain is required for this.