Privilege Control for Servers

Privilege Control for Servers (PCS) brings IBM Security's Privileged Access Management (PAM) capabilities to the servers and computer endpoints in your corporate network. Typically, before starting to use PCS, you would have a standard environment and components already deployed for the Verify Privileged Identity Platform and Verify Privilege Vault.

This page gives a brief description of the services provided by PCS. They are explained in more depth in the rest of this documentation.

Privilege Control Agent and Platform Agent

For PCS to work, you must install agents on the computers that the Verify Privileged Identity Platform is to manage.

Agents are software that runs on an endpoint and connects directly to Verify Privileged Identity Platform, which acts as its control plane. Agents send self-discovery, asset, and activity data to the platform, and receive policies to govern authorization on that machine such as login and privilege elevation. Agents enforce policies locally, brokering privileged logins and elevated actions and reporting the results back to the platform for audit.

Use one of the following:

• Privilege Control Agent - The legacy type of agent, which has been used by all regular customers not participating in a private preview.

• Platform Agent - Currently only available in private preview. A next-generation agent for Privilege Control for Servers (PCS).

Privilege Control Agent

On non-Windows computers, Privilege Control for Servers consists of the core Privilege Control Agent (adclient), related libraries, and optional tools. The Privilege Control Agent enables local host computers—most commonly Linux or UNIX—to join an Active Directory domain. After the agent is deployed on a server, that computer is considered a managed computer, and it can join any Active Directory domain you choose.

When a PCS-managed computer joins an Active Directory domain, the computer essentially becomes an Active Directory client. It relies on Active Directory and the Verify Privileged Identity Platform to provide authentication, authorization, policy management, and directory services. The interaction between Active Directory and the agent on the local computer is similar to the interaction between a Windows system and its Active Directory domain controller, including failover to a backup domain controller if the managed computer cannot connect to its primary domain controller.

For information about the Privilege Control Agent, see Setting Up PCS with Privilege Control Agent.

Platform Agent

This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.

The Platform Agent is a peer or successor agent to the existing Privilege Control Agent. The Platform Agent is for PCS customers who wish to better handle cloud-first use cases. The Platform Agent, unlike the Privilege Control Agent, does not join an Active Directory domain. It enrolls directly with Verify Privileged Identity Platform and uses the same policy in the platform as the Privilege Control Agent. The Platform Agent is best suited to Windows and Linux (non-UNIX) environments with cloud-first deployments. While it can support Active Directory users and groups, if joining to a domain is required, the Privilege Control Agent is a better choice. For more information on the Platform Agent, see Privilege Control for Servers with Platform Agent.

Comparison Summary of Agent Types

The table in this section summarizes the available features of each type of agent.

Functionality	Privilege Control Agent	Platform Agent
Platform Authority	Active Directory	Verify Privileged Identity Platform
Infrastructure Required	Platform Engine Audit Collector Command Relay AD Connector	Platform Engine if remote access through PRA is desired; see Verify Privileged Identity Platform Engine Management AD Connector if AD users are desired; see IBM Security AD Connector
Identity Support (See Identity Providers)	Active Directory Users Local Users	Any IdP integrated with Verify Privileged Identity Platform Local Users
Supported PCS Policy (See Setting Up Policies)	Endpoint Login Local Admin Granular Privilege Elevation Emergency Access	Endpoint Login Local Admin Granular Privilege Elevation Additional policy types to be supported in future versions
Supported Operating Systems	See Privilege Control Agent Supported Operating Systems	See Platform Agent Supported Operating Systems and System Requirements. Does not support UNIX in initial private preview release.

Choosing an Agent Type

One or more Privilege Control Agents and Platform Agents can be deployed in the same platform tenant or environment. However, they can not be installed on the same machine, so you must choose which agent best supports the needs of your organization for a given endpoint.

The Privilege Control Agent is best suited for traditional on-premises deployments where resources are tied to Active Directory (AD) access. For example, if you want to join your Windows, Linux, and UNIX endpoints to AD domains and automatically provide your users with Kerberos tickets for access to domain resources like SMB shares or file servers without re-authentication, choose the Privilege Control Agent.

The Platform Agent is best suited for cloud environments or where a mixture of on-premises and cloud deployment exists. For example, if you want to be able to enforce MFA and provide logon and privilege elevation access to users from many different identity platforms such as Entra, AD, Okta, and Verify Privileged Identity Platformsimultaneously on Windows and Linux endpoints, choose the Platform Agent.

Kerberos ticket network access is not supported by the Platform Agent on Linux.

Agent Management

The platform provides administrators with techniques for managing agents, including settings, updates, and uninstallation. The way you manage agents depends on which type of agent you need to manage. For more information:

• To manage Privilege Control Agents, see Managing Agents.

• To manage Platform Agents, see Managing Agents (Platform Agent).

Policies

Policies provide users with machine-level (server) permissions for logging in to remote computers and servers managed by Verify Privileged Identity Platform and performing elevated actions on them. By assigning machine-level policies, you can ensure that each asset adheres to compliance standards, maintaining both security and efficiency across your network.

Policies can contain both Platform Agent and Privilege Control Agent targets. However, the Privilege Control Agent can only provide enforcement for AD-based users.

The way you create policies depends on which type of agent is targeted by the policy. For more information:

• To write policies for Privilege Control Agent, see Setting Up Policies.

• To write policies for Platform Agent, see Setting Up Policies (Platform Agent).

Inventory

The inventory service delivers a user-friendly, asset-centric perspective of computers within your infrastructure. It empowers the user to readily view and manage assets, and to launch remote sessions directly on computers that have been discovered through the Verify Privilege Vault discovery service (for Privilege Control Agent; the Platform Agent uses a different discovery method).

For more information about the platform inventory service, see Inventory.

Engine Management

(Applicable when using the Privilege Control Agent)

The Verify Privileged Identity Platform manages and protects endpoints using small software packages called engines. The platform’s Engine Management feature provides administrators with a single interface for managing these engines, which are automatically updated and maintained after installation — removing the need for separate installers and management processes that are traditionally necessary on individual machines.

For more information, see Verify Privileged Identity Platform Engine Management.

Audit Collector

(Applicable when using the Privilege Control Agent)

Audit Collectors transmit machine-level audit data to the Verify Privileged Identity Platform, so recorded activities and events can be presented and examined. The Audit Collectors function as intermediary services that receive and compress activities captured in real time from agents deployed on audited computers.

An agent on each audited machine captures user activities and forwards them to a designated Audit Collector. When the agent cannot establish a connection with a collector—for example, when computers hosting the collector service are offline for maintenance—the agent temporarily stores the session data locally, then transfers it to a collector once the connection is reestablished. The collector then transmits this data to the Verify Privileged Identity Platform.

We recommend setting up at least two Audit Collectors to ensure uninterrupted auditing. Additional collectors can be deployed at any point for additional resiliency or improved scale.

For more information, see Audit Collector Workload.

Command Relay

(Applicable when using the Privilege Control Agent)

The Command Relay facilitates communication between the Verify Privileged Identity Platform and your environment through an SSH connection. Its primary function is to dispatch commands along with their parameters to be executed within your environment. The Command Relay requires a service account that can modify your domain so the proper administrative policies can be added.

PCS does not support FIDO2 MFA.

For more information, see Command Relay Workload.

Next Steps

For information about how to install and set up the Privilege Control Agent and PCS, see Setting Up PCS with Privilege Control Agent.