How to onboard Windows Server with special rights system ?

As Paulo144 mentioned, using the API is likely the best way to automatically onboard these types of systems. To get started with the API, you can find example scripts in the Password Safe Resource Kit under the folder \API Samples\. You can download the Resource Kit from the Downloads section of the Customer Portal.

Additionally, the API documentation is available in the Docs section. Here’s a direct link to the Password Safe API: https://docs.beyondtrust.com/bips/docs/password-safe-api. and the BeyondInsight API: https://docs.beyondtrust.com/bips/docs/beyondinsight-api

Depending on your environment, you may be able to use Quick Rules (“Add to SmartGroup” in the UI) to provision Password Safe users access to managed accounts and systems. For more details, refer to the [API: POST QuickRules] in the API documentation.

We have this same issue. My solution is to link every elevated rights account (server admin accounts) with every system in BeyondTrust. Roughly 1800 servers and 300~400 or so elevated rights accounts. I then wrote a Word document explaining how to Favorite your server list from the Directory Linked Accounts list.

I did, however, manage to get the domain admin accounts to only show the domain controllers. I created a smart rule to get all the domain controllers and a group to give the results of the smart rule to the domain admin accounts. In short, it doesn’t have to be a 1 for 1 mapping, you can get a group of servers belonging to an application and map the application support staff to those servers with one or two smart rules. 

My go-forward plan is to only deal with people who request it. Those who request it will get just their servers the same way I did the domain admins. 

My stretch goal is to figure out a way to automate it so that the current security groups that control admin rights on servers are mapped properly. 

The one thing that bit me in the backside was the smart rules. If your asset belongs to a default smart rule to link the asset to everyone and you try to link your account to just a couple systems, the default give it to everyone smart rule will still hand you all the systems. I dealt with this by creating security groups in AD and adding assets to the groups and then running a smart rule to manage from that. I’m handling service accounts the same way for password management.

With Password Safe, you have 2 levels of “this account on this system” for directory accounts:

1. the account is linked to the system.  Many customers stop here with their configuration.

2. a managed account smart rule with an “Asset Smart Rule” critiera included.
3. for dedicated admin accounts, you *also* have the role of logon user as an unexpected 3rd criteria.  Remember that Dedicated Account Mapping rules are globally applied.

(yes I know I said 2 and gave 3, by design).

How I set this up is:

1. Add the servers into security groups in AD based on the team that owns the servers (or use the API or installed software + smart rules to apply attributes), so that I can build Asset Smart Rules for access control by asset. Such as “ACL: Production Linux MySQL Servers”
2. onboard dedicated accounts with a dedicated account smart rule, but also add an attribute to that rule’s recipients of “Account Status: Mapped” (I have an alternate rule that searches for disabled accounts and clears the “Account Status” and sets it to “Disabled”, so that accounts get unmapped properly as they are offboarded).
3. Link accounts globally as ​@rhagerm  mentioned.
4. Create an Access Account Smart Rule with at minimum 2 criteria as below. This rule will show ALL linked accounts but only on the servers in question. (Access: Dedicated Accounts on Production Linux MySQL Servers)
   1. Asset Smart Rule <servers that this team should access, such as “ACL: Production Linux MySQL Servers”
   2. Assigned Attribute: Account Status: Mapped
5. Assign the Production LInux MySQL DBA role in User Management rights to request only the accounts on the “Access: Dedicated Accounts on Production Linux MySQL Servers” Smart rule.

Because there are only 5 people in the role that can request those accounts, only 5 dedicated accounts show up, and only each user sees only their own dedicated account, and only against the appropriate servers.  No accidental overprovisioning like ​@rhagerm  sees and no need to additionally train your users.  All of the above except for item D can be done via the API, for advanced or scale situations.