Enterprise Administration Guide › Implementing Privileged Accounts › How to Set Up Privileged Accounts › Create a Privileged Account

Create a Privileged Account

You create privileged accounts to manage account passwords on managed and disconnected systems. You use privileged accounts to let users check out and check in privileged account passwords, create a privileged account.

To create multiple accounts, use the Discover Privileged Accounts wizard to search for privileged on the endpoints. If you want to create a single account, provide the privileged or service account details in this window.

Follow these steps:

1. In CA Access Control Enterprise Management, click Privileged Accounts, Accounts, Create Privileged Account.

   The Create Privileged Account: Select Privileged Account page appears.

2. (Optional) Select an existing privileged account to create the privileged account as a copy of it, as follows:
   1. Select Create a copy of an object of type Privileged Account.
   2. Select an attribute for the search, type in the filter value, and click Search.

      A list of Privileged Accounts that match the filter criteria appears.

   3. Select the object you want to use as a basis for the new privileged account.
3. Click OK.

   The General tab of the Create Privileged Account task page appears. If you created the privileged account from an existing object, the dialog fields are prepopulated with the values from the existing object.

4. Complete the following fields in the General tab:

   Account Name

   Defines the name you want to refer to this privileged account by.

   Note: Mainframe systems such as RACF, ACF, and Top Secret, use case-sensitive user names. Enter the account name in capital letters.

   Disconnected Account

   Specifies whether the account originates from a disconnected system.

   If you select this option, PUPM does not manage the account. Instead, it acts only as a password vault for privileged accounts of the disconnected system. Every time you change the password, also change the account password on the managed endpoint manually.

   Account Type

   Specifies whether the account is a shared (privileged) account or a service account.

   Note: When you create a service account, PUPM does not attempt to change the account password.

   Endpoint Name

   Specifies the name of a defined endpoint where your privileged accounts reside. CA Access Control Enterprise Management lists only those endpoints that are of the type you specified.

   Endpoint Type

   Specifies the type of endpoint where your privileged or service accounts reside.

   Container

   Specifies the name of the container for the privileged or service account. A container is a class whose instances are collections of other objects. Containers are used to store objects in an organized way following specific access rules.

   Password Policy

   Specifies the password policy you want to apply to the privileged or service account.

   Password

   Defines and verifies the password to use with the new privileged account.

   Note: The new password must comply with the password policy you specify.

   Check out Expiration

   Defines the duration, in minutes, before the checked out account expires.

   Exclusive Account

   Specifies whether only a single user can use the account at any one time. An exclusive account is a restriction imposed on a privileged account that limits use of the account to a single user at a time.

   Change Password on Check Out

   Specifies whether you want CA Access Control Enterprise Management to change the password of the privileged account every time it is checked out.

   Note: This option does not apply to service accounts.

   Change Password on Check In

   Specifies whether you want CA Access Control Enterprise Management to change the password of the privileged account every time it is checked in by a user or a program, or when the checkout period expires.

   Note: If the account is not exclusive, CA Access Control Enterprise Management generates a new privileged account password only when all users have checked in the account.

   Note: This option does not apply to service accounts.

   Login Application Check Out Only

   Specifies whether to allow password check out only if a login application is defined for the endpoint.

   Note: When this option is enabled, the user cannot display or copy the password to a clipboard.

   Click Submit.

   CA Access Control Enterprise Management creates the new privileged account.