Integrating SailPoint with Windows Local

Use the Windows Local connector to manage Windows Local user accounts. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Windows Local connector. After it is successfully configured, your organization can aggregate and provision accounts for Windows Local users.

Supported Features

The Windows Local connector supports the following features.

Account Management

• Aggregate and refresh Windows Local users as accounts
• Add or remove entitlements
• Add or remove Windows Local groups to non-local (domain) users. See Advanced Settings for configuration.
• *Password Management
• *Provision Accounts
  • Create, update, delete
  • Enable, disable, unlock, and change password

Entitlement Management

• *Access Certifications (certification of entitlements connected to accounts)

Permission Management

• Execute native before/after scripts for provisioning requests

For more information on features, refer to Source Features.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Supported Versions

The Windows Local connector supports the following versions of Microsoft Windows.

• Microsoft Windows Server 2022
• Microsoft Windows Server 2019
• Microsoft Windows Server 2016

Prerequisites

• IQService must be installed on the Windows system. Follow the instructions in the IQService Administrator's Guide to install IQService. For more information, refer to Installing and Configuring IQService.

  Important

  IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to Configuring TLS and Client Authentication for IQService.

• Start the remote registry service on the managed system.

• Allow an exception for File and Printer Sharing in the Windows firewall.
• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• Ensure that the account being used to configure the connection has Administrator privileges on the Windows host machine.

• Deselect Disable NonLocal Lookup and Disable Qualifying Local Objects before running the account aggregation to provision the non-local (domain) users. For more information, refer to Advanced Settings.

  Note

  To view non-local (domain) users userName in the format of "domainName\saMAccountName", deselect Disable Qualifying Local Objects before running the account aggregation. For example, domainName\TestUser1.

Administrator Permissions

The service user account should be a member of the Administrators group on the managed Windows host computer.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.