How Lithnet Access Manager works
Access Manager comprises two parts: the Access Manager Service and an optional Access Manager Agent. The service is a web app installed on a server in your environment that allows your users to securely request admin access to your devices. The agent is installed on your Windows, macOS and Linux fleet to provide additional capability like LAPS password management, and our RapidLAPS passwordless login capability.
How each feature works
LAPS passwords
Access Manager reads your Windows LAPS passwords from Active Directory and Microsoft Entra ID. Install the optional Access Manager agent, and it manages the device's password and stores it, encrypted, in Access Manager. Either way, your team types a computer's name in the web app and gets the password.
RapidLAPS
RapidLAPS works on Windows devices that run the Access Manager agent. When someone chooses RapidLAPS at the Windows logon screen or at the Run as administrator prompt, the agent shows a QR code. An authorized person scans the code with their phone, or goes to the address on the screen and enters the PIN, then signs in and approves the request in the web app. Once the request is approved, the Access Manager server encrypts and delivers the password to the agent running on the device. The agent then passes the LAPS password to Windows, and completes the login.
Just-in-time admin access to computers
You set up rules that say who can be an admin on which computers, and for how long. Your admins then request just-in-time access in the web app when they need it, and Access Manager adds them to that computer's local Administrators group through an Active Directory group, then removes them when the time is up.
Just-in-time access to roles
You turn any Active Directory group into a role, and set up rules that say who can request it and for how long. Your admins then request the role in the web app when they need it, and Access Manager adds them to the group and removes them when the time is up.
BitLocker recovery keys
Access Manager reads the BitLocker recovery passwords that Windows backs up to Active Directory. On Windows devices that are joined to Microsoft Entra ID or not joined to a domain, the Access Manager agent backs up the recovery keys to Access Manager. Your service desk then has one place to find the recovery key for any Windows device.
Security model
Access Manager protects some of the most sensitive credentials in your organization, so security is built into every part of it. Every request is authenticated, authorized, rate limited and audited, and every secret that Access Manager stores is encrypted.
- Authorization
- Rules grant access to LAPS passwords, BitLocker keys and just-in-time access for specific computers, containers and groups.
- Sign-in
- Users sign in through your identity provider, so your MFA and conditional access policies protect every sign-in.
- Rate limits
- You can set rate limits per user and per IP address.
- Audit
- Access Manager audits every request made in the web app, whether it succeeds or not. Each audit event records the user, the computer and the source address. Access Manager writes the events to the Windows event log and can send them to your SIEM, email, Slack or Teams.
- Secrets at rest
- Access Manager encrypts every secret that it stores. The Access Manager agent encrypts each password on the device before it sends it, with industry-standard AES-256 encryption, and Access Manager keeps the password encrypted until an authorized user requests it in the web app. The other secrets in its database, such as connection credentials, are encrypted too.
- Signed code
- Windows installers are signed with Lithnet Pty Ltd's Extended Validation code-signing certificate from DigiCert and carry a trusted timestamp. macOS packages are signed by Lithnet Pty Ltd (Apple Team ID 5DK86QQXK3) and notarized by Apple. Linux RPM and DEB packages, and the APT and YUM repositories, are signed with our GPG keys. Each release has a signed release manifest that lists the SHA-256 hash of every package.
Learn more
Our documentation covers every part of Access Manager in detail, from system requirements and installation to authentication, authorization and auditing.
Get started today
Professional starts at USD 750 a year, including 100 devices and support from Lithnet.
The free trial unlocks every feature for 30 days on a free installation.