There are a few components that make PAM work, which are as follows:
- Active Directory management forest: A management forest is used to manage the existing forest(s) via one-way trust. Customers who already have a secured management forest, sometimes called a "red" forest, can use this management forest for PAM. If you only have a single forest, you need to create a new management forest.
- PAM Client: This is a PowerShell cmdlet or custom solution that uses the PAM REST API, such as the open source PAM API portal we will discuss later.
- MIM service: This is used as the PAM request and approval pipeline.
- MIM database: This holds MIM resources (objects), attributes, and requests.
- PAM services: These are the PAM REST API, PAM component service, and PAM monitoring service.
- PAM REST API: This is only used by a custom PAM client and provides a mechanism for PAM interactions such as roles, requests, request approvals, and session operations.
- PAM component service: In Windows 2012 R2 deployments, this is a Windows service that looks for requests that are expired and removes the shadow account from the SID History-enabled group residing in the trusted domain. It interacts directly with Active Directory and not with the MIM service. The PAM component service is unnecessary in Windows 2016 server deployments.
- PAM monitoring service: This is a Windows service that reads the corporate forest(s) and duplicates specific changes that are done in the corporate forest(s) to the privileged forest or to the MIM service.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.