73 lines
4.0 KiB
Markdown
73 lines
4.0 KiB
Markdown
WSG has a limited support role in Developer -D Accounts for Workstation Privileged Access and the implementation process
|
||
"-D" was designed, planned and configured by FSD
|
||
Escalation to WSG should only occur when trouble shooting steps indicate there is specific issues with Active Directory.
|
||
|
||
Below is an overview of the Configuration, Provisioning and Troubleshooting recommendation
|
||
|
||
Overview of -D Accounts Admin Access on Workstations
|
||
|
||
**Configuration**
|
||
FSD\DMG CREATES 2 GROUPS IN LOCATION
|
||
ad.cbp.dhs.gov/AccessControl/Groups Security/Developer Group Accounts (-D)/
|
||
SG-[SITE CODE]-Developer
|
||
SG-[SITE CODE]-Developers-PCs
|
||
|
||
FSD\DMG creates a Group Policy for the target Site Code And Linked to the Target SITE OU
|
||
GPO Name:[SITE-CODE]-WRKST-ADMIN-D
|
||
The group policy is configured:
|
||
A Security filter assigned to the SG-[SITE CODE]-Developers-PCs group
|
||
Computer Setting:
|
||
Restricted Group Policy for local Administrator to include "SG-[SITECODE]Developers" Group
|
||
Linked to the Target SITE OU, ensuring precedence is correct so it is the last Group Policy applied
|
||
|
||
**Provisioning**
|
||
Users request a -D account through Service Now "**UAR – Privileged (-M, -D) Account Request"**
|
||
[Service Catalog - Service Portal (servicenowservices.com)](https://cbpprod.servicenowservices.com/sp?id=sc_cat_item&sys_id=1e0681361bc02890378eda49bc4bcb9f)
|
||
|
||
Upon Approval, the TSD provisions the -D account , placing the account in the correct Site SG-[SITE CODE]-Developers group in which the Users workstation exists
|
||
The Users target Workstation is placed in the correct SG-[SITE CODE]-Developers-PCs in which the Users workstation exists
|
||
The User -D Account tab , “Log On To…” must have the target workstation added to the “Log On To…” Logon Workstations configuration item
|
||
|
||
|
||
**Trouble shooting steps with escalation hierarchy**
|
||
|
||
**(TSD)**
|
||
**Verify**
|
||
The User is in the correct SG-[SITE CODE]-Developers group
|
||
The Users Workstation is in the correct SG-[SITE CODE]-Developers-PCs group
|
||
The User -D Account tab , “Log On To…” has the target workstation added to the “Log On To…” Logon Workstations configuration item
|
||
The User Workstation object is located in the correct OU to receive the correct Group Policy
|
||
|
||
TSD can and should handle "Disabled by CBP System Security 4/12/2024 inactive 30 days". Simply unlock the account and delete/clear the description. As this is most commonly caused by not verifying/not using Zscaler.
|
||
|
||
**(FSD )**
|
||
The Workstations must be receiving the Group Policy
|
||
|
||
Verify the Workstation is receiving the[SITE-CODE]-WRKST-ADMIN-D group policy
|
||
The Workstation object must be located in the correct OU to receive the correct Group Policy
|
||
|
||
Failure of Polices applying to a single Client indicates a client issue which should be resolved by FSD
|
||
|
||
Logon to the Target workstation and run CMD as an Administrator
|
||
At the command prompt run
|
||
GPRESULT /SCOPE COMPUTER /Z
|
||
|
||
Review results,
|
||
The [SITE-CODE]-WRKST-ADMIN-D group policy should be under "Applied Group Policy Objects"
|
||
If Seen, and the user still does not have Admin permissions, they are not in the correct SG-[SITE CODE]-Developers
|
||
|
||
If the Applied Group Policy Objects is found under "The following GPOs were not applied because they were filtered out"
|
||
The Workstation is not in the correct SG-[SITE CODE]-Developers-PCs
|
||
|
||
More Verbose error checking ,at the Elevated command prompt run GPRESULT /H C:\TEMP\GPRESULTS.HTML
|
||
Review the HTML file for any client errors, resolve the client errors
|
||
|
||
If the [SITE-CODE]-WRKST-ADMIN-D group policy is not seen at all, the Policy is most likely not configured correctly or does not exist
|
||
|
||
HTML report indicates GPO corruption -Escalate to DMG
|
||
|
||
**(DMG)**
|
||
The Group Policy must be configured correctly and linked to the correct OUs
|
||
|
||
**(WSG)**
|
||
Group Policies are failing to get applied to an the Entire Site. |