dave1

Hi Devolutions,

If we perform "Drain" of the node, this does not automatically transfer active connections from the node in drain mode to the node which is still active.

This is an issue when we are performing the update of the gateway nodes, as we need to "kill" the connections going over the node that is about to be updated. And then the user needs to reconnect manually.

Would it be possible to build a mechanism, that would automatically "move" the active connections to the other node if the current node is in drain mode?

Even briefly "disconnecting" the connection, and re-establishing it over the active node would be fine.

Hi Devolutions team

We would like to request that Delinea integration is added to the web interface of the DVLS.

The reason for this is that our supporting partners and vendors could use web interface, and seamlessly retrieve/inject passwords from the Delinea secret server.

This would give us the benefit of:

Faster onboarding of a partner

Partner does not need to maintain the lifecycle of the RDM/Launcher

Partner does not need to "follow" our major version updates of the platform

Hi Devolutions team

We have the following scenario

The account has automatic password rotation set for every 24 hours. This account is stored in Delinea PAM solution.

User opens a connection which is using that account, and then does not close the tab.

He locks his workstation, and returns to his desk tomorrow.

During the night the password was automatically rotated.

He opens RDM or Launcher, and then jus hits "Connect" on the tab - this will then somehow still use cached credentials (basically password from yesterday).

This causes a lockout, if the user attempts to many times.

Can this behaviour be modified please, so that credentials are re-fetched every time a user attempts to connect? We would need this for both clients RDM & Launcher.

Thanks

Hi,

We would need the following information information to be available for custom reporting:

How many licenses are available per license pack, and the expiry date of the license pack.

Which users currently have a license assigned

Hi Sebastien,

But will the license information also be available to be retrieved from the database?

We have built a Metabase reporting for management teams, so we are looking into leveraging that to create license usage/availability reports (among others - such as connections usage, last activity, inactive users etc...).

Good day Devolutions,

We are trying to create a report for management, and for that reason we would like to include the information about the assigned licenses - per user.

At the moment the license data is stored in the "Assigned" column in dbo.UserSecurity table, but it is encrypted..

Could you please make a solution so that we can display the assigned licenses information?

Hi Hubert

As for the point of custom installers, we have no issues with them per se. We are just looking in possibilities on how to decrease our efforts when patching the platform, which we do on very regular basis. As a part of this upgrades we are also pushing out the clients to be updated, meaning we manually need to create a custom installer and use that msi in the deployment. So if we could define the switches for the datasource that would perfectly suit our needs. We are interested in switches from the Data Sources -> General tab.

As for the second part of our conversation, we have dozens of credentials templates for different support partners. The reason to this is due to the policy that secrets should be in Delinea, not in RDM.

Here is an example of one such template:

And normally a new team member of the operations partner just needs to import this template once to his user vault -> when he is onboarded to RDM or Launcher, and he is off to the races.

What we would like to add to the templates functionality would be the possibility:

-That we can define groups, which will automatically receive a pre-defined template.

-That admin can add/edit/remove a secret/entry from a template -> and this will automatically be updated at the user vault of the users.

-Possibility to keep lock secrets from being editable by the user. Example in the upper template would be, that we only allow the user to edit A-Account and User account (since 75% of users are not members of our domain, we cannot use the %USERNAME% environmental variable).

If you would like, we can get on a short call, where i could showcase this?

Hi Francois,

We are already using custom installers, would it be possible to add additional switches for msi packages?

As for the second point - exactly, we would like to have a way to push templates to user's vault.

To put more information about our use case:

We have multiple teams that have their dedicated vaults (only connections are stored in those vaults, no secrets).

For those teams we built different templates that hold shared service accounts ("Delinea secret server (Credential)"). As we are adding new connections (new server or device gets provisioned/installed) we often update templates with new shared service accounts, and then we need to notify the user, to delete the "old" template and import a "new" template where new accounts are added.

If there would a possibility to create templates, that automatically get deployed and updated to user groups, that would fit our needs. Preferably, the template would be "locked" for editing for the users - so that only DVLS administrators or specific group can edit.

As we have many users that have RDM and Launcher client we would like to avoid manual configuration of data sources and credentials templates.

Can you look into option to implement this, to add additional switches in the installer, so that data source can be defined during the silent installation?

Can you include a way to push "mandatory" template to user groups? For instance, currently, user must manually import a template to his user vault. And if there is a change to the template, he needs to delete the current template and re-import a new one.

Currently our vaults do not contain any secrets. Users import credentials template to their user vault. The template holds secret lookups for Deliea PAM.

Thanks christian, but we need a self-service report for the management team.

Good day Devolutions!

Could you please incorporate a security report, where we could pick a group or a specific user, and see the effective permissions that they have on the vaults and folders/entries?

Currently we are tracking the applied permissions in an excel spreadsheet, which is time consuming and needs to be double checked against the vaults.

The requested report would make it much more easier and efficient when auditing the access rights...

Hi Francois,

Would it also be possible to include some trends and statistics?

Such as Maximum concurrent sessions that were established through the gateway?

Historical statistics based on date/time connections were established? Like per day/week/month?

How many users are active or inactive (did they login in the last 180/90/60/30/15 days)?

What client user logged in with, version of the client, and the OS of the workstation?

Yes, exactly. that what you described.

A summary of the usage, for the management to see how much the platform is actually been used.

If there could be a section which also shows how many connections were established via Devolutions Gateway, that would also be very handy.

Good day Devolutions

Could you please create an activity report / dashboard for management?

Where they could see how much the Devolutions platform is being used - per user and per user group?

Currently we are exporting activity logs, and then adjusting the data through excel. The idea is that we show total actions per user and group (Opened session, viewed password, Entry edited, etc)

We have multiple use cases for this report

to show the usage of RDM platform by our supporting partners and internal users

to show how many RDM entries our automation script has edited (by pulling data directly from SNOW and HALO ITSM platforms)

Good day Devolutions

We would like that in the csv export of the Report - Login History, the field "Version" is also included.

Currently this only exists when viewing the report in the Web GUI, but not after we export that report in csv. Please see Attachments.

A report showing every user, which client, OS and version he used, on his last login. That information plus the date of last login would be of great help to our management, when checking high amounts of users.

Another solution for us would be if you could integrate support for NDI screen capture?

https://ndi.video/tools/screen-capture

Yes that is correct.

Would it be possible to separate the session recording and session shadowing? As two separate features?

Session recording - creates permanent recording files.

Session shadowing - not to hold any permanent files, so it does not consume disk space? Just provides live view?

For instance, we have a shared account which is always logged in to the server. So we can open a VNC connection to it at any time, without causing screen locks (that RDP does).

Could we use that VNC connection, but only to "view" the screen, no need for recording or to control of the machine. Basically just a remote screen emulator.

Good morning Devolutions team

We have several screens used for monitoring and visualizing running systems. Our objective is to have the ability to view the current screen of a remote machine without allowing the user initiating the connection to make any changes—essentially receiving a live video stream only.

Would it be possible to achieve this functionality using the RDM Agent in the future (is it perhaps on the roadmap)?

We are aware of the session shadowing feature available in the latest release of Gateway. However, we have some concerns:

• If the session remains active and unterminated for an extended period (potentially several months for certain OT systems), the recording file may become significantly large.

• The current video quality is not ideal for our needs.

A session shadowing option without recording, coupled with improved video quality, would also be sufficient.

We would like to request the feature to have an application password for DVLS console, when only Gateway companion is installed on a server, without the DVLS. In our environment the DVLS servers are installed on different nodes.

We know that local admins can find and edit the gateway configuration file, but that takes significantly higher effort and research, to change the settings than just opening DVLS console, and changing some of the settings by "mistake".

HI Jeff.

Any update from the development team?