Can I segment access on a given machine?

[toddd]

Can I create an SQL SA group alongside an L-Admin group where a given machine is the member of both groups (machine has a local A and is running SQL server) such that the individual retrieving an L-Admin password for that machine does not also have access to the SA password on that machine? The groups seem to be machine driven unless I am missing something.

[Chris]

You are correct that the list is machine driven. To these means you would also be correct that if someone has access to any of the systems on any list they would have access to all password associated with that machine, including SQL accounts.

Ultimately you have two choices, one is to add machines into the second list manually such as server_name-SQL and then manually input the SQL passwords. This works fine if you don't want RPM to manage those passwords aside from storing them. Or your second choice is to use username filtering.

Username filtering works like this, you have granted groupX the rights to recover passwords for a group of systems but you would like to limit the accounts that they can recover passwords for and all of those accounts have the same or similar names.

To setup recovery filtering, open Random Password Manager and go to SETTINGS | MANAGE WEB APPLICATION | MANAGE DELEGATION.

On the "Account Management" dialog, click the "Account Masks" button in the lower right portion of the dialog.

On the "Account Masks" dialog, click the ADD button to create an account mask. First, highlight the user or group you would like to add the mask for then add the account mask. THe account mask allows for the use of wildcard characters such as * or ? as in admin* or admin??.

Creating a mask like this defines which accounts the users can see or recover. This means, if you selected the group domain\help_desk and specified an account mask of administrator, they could only recover account named administrator from the groups that they have been delegated access to.

Hope that helps!