Least privileges for Active Directory JIT group elevation

On this page

Devolutions Server allows just-in-time (JIT) group elevation by using an Active Directory account as a PAM provider. This article describes the steps to delegate control to said PAM provider in the Active Directory Users and Computers console.

To manage domain administrator accounts as privileged accounts in the PAM module, grant the PAM AD provider account access to the AdminSDHolder. See Creating Management Accounts for Protected Accounts and Groups in Active Directory for step-by-step instructions.

Steps

  1. Open the Active Directory Users and Computers console.

  2. Right-click on the Organizational Unit (OU) containing the privileged accounts or a higher OU level to encompass all OUs in which the PAM provider account should have the ability to rotate account passwords, and select Delegate Control....

Delegate Control option
Delegate Control option
  1. In the Delegation of Control Wizard, click on Next to reach the Users or Groups dialog. There, choose the account to use as the PAM provider account in Devolutions Server before clicking on Next.

Choose PAM provider
Choose PAM provider
  1. In Tasks to Delegate, select Create a custom task to delegate, and click on Next.

Create a custom task to delegate option
Create a custom task to delegate option
  1. In Active Directory Object TypeOnly the following objects in the folder, select the Group objects item. Then, tick both Create selected objects in this folder and Delete selected objects in this folder checkboxes, and click on Next.

Active Directory Object Type
Active Directory Object Type
  1. In Permissions, tick the Property-specific checkbox. Find and enable the Write Members permission, and click on Next.

Enable the Write Members permission
Enable the Write Members permission
  1. Click the Finish button to complete te delegation process.

Recap of the newly granted permission
Recap of the newly granted permission
Devolutions Forum logo Give us Feedback