NEW: Microsoft Vulnerabilities Report 2022 - Read the Findings of Our Annual Report Read Now

  • Partners
  • Support
  • Careers
  • English
    • Deutsch
    • français
    • español
    • 한국어
    • português
BeyondTrust
  • Products

    Privileged Password Management

    Discover, manage, audit, and monitor privileged accounts and credentials.

    • Password Safe
    • DevOps Secrets Safe
    • Privileged Access Discovery Application

    Endpoint Privilege Management

    Enforce least privilege across Windows, Mac, Linux, and Unix endpoints.

    • Windows and Mac
    • Unix and Linux
    • Active Directory Bridge

    Secure Remote Access

    Centrally manage remote access for service desks, vendors, and operators.

    • Remote Support
    • Privileged Remote Access
    • Privileged Access Discovery Application

    Cloud Security Management

    Automate the management of identities and assets across your multicloud footprint.

    • Cloud Privilege Broker

    BeyondInsight

    Experience the industry’s most innovative, comprehensive platform for privileged access management.

  • Solutions

    Use Cases

    • Cloud Security
    • Compliance
    • Cyber Insurance
    • Digital Transformation
    • Endpoint Security
    • Operational Technology
    • Ransomware
    • Service Desk Efficiency
    • Zero Trust

    Industry Applications

    • Financial Services
    • Government Agencies
    • Healthcare
    • Law Enforcement
    • Manufacturing
    • Schools & Universities

    Solutions

    The BeyondTrust Privileged Access Management portfolio is an integrated solution that provides visibility and control over all privileged accounts and users.

  • Resources

    Learn

    • Blog
    • Customer Stories
    • Competitor Comparisons
    • Datasheets
    • Demos
    • Glossary
    • Podcast
    • Whitepapers

    Attend

    • Events
    • Go Beyond
    • Training
    • Webinars

    Support

    • Changelog
    • Professional Services
    • Technical Documentation

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

  • Company
    • About
    • Leadership
    • Core Values
    • Partners
    • Careers
  • Watch Demo
  • Contact Sales

Privilege Guard Activity Viewer

October 20, 2017

  • Blog
  • Archive

The new Activity Viewer in Privilege Guard 3.6 (Edit: now Defendpoint) is an advanced diagnostics tool to help with refining Privilege Guard policies. It allows you to connect to any client, local or remote, and view all recent activity that the Privilege Guard Client has performed.

How It Works

Every application, task and script which is executed is evaluated by the Privilege Guard Client, to assess whether a policy has been assigned to manage that execution. The settings are scanned for matching rules, and if a match is found then the associated action (elevate, block, audit, etc) is applied. If no match is found, then the execution is allowed to continue unmanaged.

Occasionally you may experience an unexpected outcome to an execution; an application was blocked when it should have been allowed, an installation did not run with admin privileges when it should have, a script was not audited. Depending on the complexity of your Privilege Guard settings, or the scope of your implementation across multiple GPOs, it may not always be convenient or viable to follow perceived logic of the policy using the Privilege Guard Management Console.

This is where the Activity Viewer can help.

Using the Activity Viewer

To monitor the activity of a particular client, first you have to enable activity logging. This is achieved by opening the Activity Viewer and using the Control option to Enable Logging:

Once logging has been enabled, simply recreate the unexpected behavior (i.e. run the execution again), and the Privilege Guard Client will record every decision it makes to determine the outcome.

Next, connect the Activity Viewer to the client to retrieve the logs. You do this by creating a Snapshot:

A snapshot is an audit of activity up to the point that you collected it. Snapshots can be saved locally, and can be used to compare against other snapshots; ‘before’ and ‘after’, to see the effects of configuration tweaks, and test that you get the behavior you are expecting.

Once the logs have been collected, each request is displayed, in the order they were executed. The Activity Viewer lets you group, order and filter the request list to suit your requirements, and layouts can be saved for use in other snapshots.

Example

In the example below, a standard user attempted to download and install the Adobe Reader Installer, but instead of the installation being automatically elevated, it is being blocked by the ‘catch-all’ rule Local Group Policy.Block UAC. By using the Activity Viewer to monitor the user running the installation, you can see that the installation is failing to match the Local Group Policy.Elevate policy, due to a mismatch in the Product Version Min validation rule.

This may have been due to a requirement that the minimum version allowed by the IT Department was 3.4.0.0, but in this case it was misconfiguration in the policy. A simple change to the policy so that the Check Min Version value is set to 3.3.0.0 would then result in the installer matching the Elevate policy.

Once deployed, the Activity Viewer can be used again to ‘test’ the new policy, which confirms that the policy is now functioning as expected.

Summary

The Privilege Guard Activity Viewer simplifies the process of monitoring Privilege Guard activity, providing real-time diagnostics on how Application Rules, Policies and Filters are being evaluated on client computers.

Introducing Defendpoint

Edit: Privilege Guard has now evolved into the brand new security suite, Defendpoint, which encompasses Privilege Management, Application Control and Sandboxing. For more information, please visit www.avecto.com/defendpoint.

Photograph of Kris Zentek

Kris Zentek, Senior Product Manager

Kris Zentek is a Senior Product Manager at BeyondTrust, focusing on Endpoint Privilege Management solutions. Based in the UK, he has over 20 years of experience working in the cybersecurity industry.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Whitepapers

Microsoft Vulnerabilities Report 2022

Whitepapers

Cybersecurity Insurance Checklist

Whitepapers

Privileged Access Management: PAM Checklist

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support
  • Cloud Privilege Broker

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Podcast
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press
BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2022 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.