Method for controlled and audited access to privileged accounts on computer systems
First Claim
Patent Images
1. A method for allowing a user to temporarily gain access to a privileged account on a computer system to perform a maintenance task, the method being a replacement for a conventional switch user command, comprising:
- receiving a switch user command login with a user id and an account name as an argument;
retrieving a list of privileged account names;
determining whether the account name is in a list of privileged account names and diverting the user to the conventional switch user command prompt if the account name is not in the privileged account list;
otherwise,determining whether the user id is in a list of user ids having permission to access privileged accounts and allowing access to the account if the user id is in the list of user ids having permission to access privileged accounts;
prompting for a reason for accessing the account;
recording a reason for accessing the account;
notifying a manager of the privileged account of the login;
recording keystrokes in a log file while logged into the account;
terminating the login;
and notifying the manager of the privileged account of the login termination.
1 Assignment
0 Petitions
Accused Products
Abstract
A method that provides access to Privileged Accounts to users with Privileged Account access permission. A message is sent to a Privileged Accounts manager when a user logs into a Privileged Account. The user must enter a reason for access. All keystrokes are logged. At the conclusion of the user session, the log file is closed and another message is sent to the Privileged Accounts manager. The log file may be sent to the manager at this time or saved for a batch transfer periodically.
599 Citations
8 Claims
-
1. A method for allowing a user to temporarily gain access to a privileged account on a computer system to perform a maintenance task, the method being a replacement for a conventional switch user command, comprising:
-
receiving a switch user command login with a user id and an account name as an argument; retrieving a list of privileged account names; determining whether the account name is in a list of privileged account names and diverting the user to the conventional switch user command prompt if the account name is not in the privileged account list;
otherwise,determining whether the user id is in a list of user ids having permission to access privileged accounts and allowing access to the account if the user id is in the list of user ids having permission to access privileged accounts; prompting for a reason for accessing the account; recording a reason for accessing the account; notifying a manager of the privileged account of the login; recording keystrokes in a log file while logged into the account; terminating the login; and notifying the manager of the privileged account of the login termination.
-
-
2. A method for allowing a user to temporarily gain access to a privileged account on a computer system to perform a maintenance task, the method being a replacement for a conventional switch user command, comprising:
-
receiving a switch user command login with a user id and an account name as an argument; retrieving a list of privileged account names; determining whether the account name is in a list of privileged account names and diverting the user to the conventional switch user command prompt if the account name is not in the privileged account list;
otherwise,determining whether the user id belongs to a privileged group located in a group list on the computer system having permission to access privileged accounts; denying access to privileged accounts and notifying the manager if the user id does not belong to the privileged group, otherwise, allowing; prompting for a reason for accessing the account; recording a reason for accessing the account; notifying a manager by email of the access of the privileged account of the switch user login along with the name of a first log file; recording keystrokes in the first log file while logged into the account; recording keystrokes in a duplicate log file while logged into the account; determining whether the first log file was tampered with and if so recording that the first log file was tampered with in the duplicate log file and transmitting the duplicate log file to the manager; terminating the switch user login; and notifying the manager by email of the privileged account of the switch user login termination. - View Dependent Claims (3, 4, 5, 6, 7, 8)
-
Specification