Creating a network right

In the preceding section, you saw how you can provide a user with a desktop that has elevated privileges on a local computer (the Windows client computer in this case). However, using administrative privileges on your local Windows client computer does not give you privileges on a remote computer. In this section, you create a network access right that gives a user administrator privileges on a remote computer.

To illustrate network access rights using the local Windows client computer and a remote computer, you must install the Centrify agent for Windows on the remote computer and join that remote computer to the zone you created in Creating the first zone (for example, Headquarters).

You can use the domain controller or another computer as the remote computer for this exercise. Install the Centrify agent for Windows on the computer that you are using as the remote computer and join that computer to the Headquarters zone before proceeding.

If you are using only one Windows client computer for the evaluation and cannot install the agent on the domain controller or another remote computer, you should skip this exercise.

To prepare for the exercise that demonstrates this feature:

Install the Centrify agent for Windows on the computer that you are using as the remote computer.

See Installing the Centrify Agent for Windows for more information.
Log on to the remote computer with your administrator account and create a folder on the C: drive named ShareFolder.
Select the folder, right-click, then select Properties.
Click the Sharing tab, then click Share.
Select Find people, type “back” to search for and select the built-in Backup Operators group, then click OK.
Right-click the Backup Operators group and set the Permission Level to Read/Write, then click Share.
Click Done, click Close to exit, then log off the remote computer as the administrator.
Log on to the local Windows client computer as amy.adams.
Try to open ShareFolder on the remote computer.
Verify that Windows tells you that you do not have sufficient permissions, then click Cancel.

To create a network access right and add it to the DesktopAdmin role:

Log on to the local Windows client computer with your administrator account and open Access Manager.
Create the new network access right.
- Select Windows Right Definitions > Network Access, right-click, then select New Network Access.
- Type ShareAccess as the name of the new access right on the General tab.
- Click the Access tab, select Self with added group privileges, then click Add Built-in Groups.
- Select the Backup Operators group, then click OK.
- Select Re-authenticate current user to require users to authenticate their identity when they use a role with this right, then click OK.
- Select Require multi-factor authentication If you would like to enable multi-factor authentication for the right.
Before you enable multi-factor authentication, you should be aware that multi-factor authentication for Centrify-managed Windows computers relies on the infrastructure provided by the Privileged Access Service. For more information on preparing to use multi-factor authentication, see the Multi-factor Authentication Quick Start Guide.
Add the new right to the existing DesktopAdmin role.
- Under Role Definitions, select the DesktopAdmin role, right-click, then select Add Right.
- Select the ShareAccess right in the list, then click OK.
Assign the role to a selected computer in the zone.
- Expand the zone to Computers > computer name> Role Assignments node. If you are using a local and remote computer for this exercise, select the remote computer for making the role assignment.
- Select Role Assignments, right-click, then select Assign Role.
- Select DesktopAdmin in the list of roles, then click OK.
Assign the role to an Active Directory group.
- Click Add AD Account.
- Change the Find filter from User to Group to search for and select the group you created for the evaluation (for example, Eval Group), then click OK.
- Verify that the account is included in the Accounts list in the Assign Roles dialog box, then click OK.
- Open the Privilege Elevation Service Settings (from the Agent Configuration shortcut > Centrify Privilege Elevation Service > Settings), click the Troubleshooting tab, then click Refresh to get the latest authorization information.