為什麼TPAM會使用49154, 49155 port 連接受管目標主機?

49154 and 49155 是 Windows Server 內部定義的RPC dynamic port，當TPAM使用TCP/135和受管目標主機初始連接後，接下來會使用RPC dynamic port來做後續的連接。

WMI / DCOM from DPA/TPAM will need access to TCP/135 to initiate communication on the target. The subsequent conversation then continues on a random negotiated port.
On Windows 2003/XP this would be in the range 1025 - 5000 on Windows 7/Windows 2008 and above : 49152 - 65535.

TPAM的標準功能會使用WMI/DCOM access  target，沒有強制關閉的方式。

如果要避免TCP/135, 49154, 49155 的使用的話，

1. 請確認沒有使用下列功能

- Managing service account passwords ("Change password for Windows Service started by this account" ticked)
- Managing scheduled task passwords ("Change password for Scheduled Tasks started by this account" ticked)
- Restarting a service ("Automatically restart such Services" ticked)
- Using Account Discovery on the target
- Using Event Capture on PSM sessions (Privileged Session Manager)

2. 請確認每套windows server的 System->Deteils->Information-> 填寫Computer Name(用大寫英文字母)，如果沒有填寫TPAM會使用WMI連接目標主機獲取主機名稱。

參考資訊:
1. How to configure RPC dynamic port allocation to work with firewalls
2. https://support.oneidentity.com/kb/123021/ports-used-by-windows-or-windows-active-dir-platforms
3. https://support.oneidentity.com/tpam/kb/230930/which-tpam-features-use-wmi-and-which-do-not-

TPAM - request申請單的生命週期與簽核

TPAM 中的申請單會有一個屬性，稱為狀態(Status)。從申請開始到使用結束，生命週期中有下方這些狀態。

• Pending Approval - waiting for authorized approver/s to approve the request.
• Active/Approved - the request has been approved and is within the release duration window.
• Approved - the request has been approved but the request date/time is in the future.
• Denied - the request was denied by the approver/s.
• Canceled - the submitted request conflicts with a request that has already been approved for the same time period or the requestor decides to cancel the request prior to accessing the password. The request will also be cancelled if the ticket number entered on the request requires validation, and fails.
• Expired - the release window for the password has passed or the requestor is done accessing the password and expires the request early.
• Extended - the release has been extended past the original requested duration.

當申請者提出request，核准者會收到郵件通知。點選下方的URL Link即可登入系統簽核該張申請單。

當表單已經被簽核過，表單狀態變更了，再次點擊URL Link進入TPAM系統，會發生什麼狀況?  以下做個小測試:

Pending Approval

Approved

Expired

Denied

當一張Request申請單，還沒有結束他的生命週期，卻遇到了權限變更，有時候直接點選URL進行簽核會遇到問題，如下方幾個貼圖。這時候回到TPAM登入後的首頁，點選Pending Approval進行表單簽核即可。

Firefox:

 IE:

TPAM - 新增群組成員時發現都是反白的無法點選變更

以下兩個情境，各有不同的Group and UserID 管理方式。

1. 群組與UserID是從LDAP帶過來的，這種方式無法透過TPAM修改群組成員(反白)。須在AD新增成員到OU，TPAM會透過Auto Discovery 做sync。

2. 如果是在TPAM手動建立的Group，則可以增加Local Useror LDAP User到此Group。