NetIQ to Ship Change Administration Tool

NetIQ will ship a new Windows-based tool next week aimed at simplifying user change administration.

Change Administrator 1.0 provides a more granular level of user rights assignment than Active Directory alone, according to statements by San Jose, Calif.-based NetIQ.

"Domain administration of groups on servers has become problematic [keeping track of] who does what and what they have access to," says Jim McGrath, NetIQ's senior director for product management.

Change Administrator is designed to enable IT managers to delegate administration of servers on a role-based model that is both "granular" and "time-based," according to company statements. It also provides for so-called "just-in-time" permissions.

The package helps manage complexity by enabling a "super administrator" to create "proxy" accounts for lower-level administrators that enable them to perform specific tasks. Rather than assigning expanded privileges to the administrators' own native accounts, the proxies provide the necessary permissions.

"You would keep your regular account [and instead] we will create and maintain a separate account [and] when you're not using it, we take it out of use," McGrath says.

That includes time-based credentials. For instance, it may be entirely appropriate for an administrator to be performing particular tasks in the middle of the workday but perhaps not in the middle of the night. The idea is to ensure that unmanaged changes are limited, while not crippling the staff during a crisis. Additionally, Change Administrator documents who did what in emergency situations so that postmortem analysis can be performed.

But making providing centralized control of who makes changes and what those changes are only deals with half of the problem. In NetIQ's model, Change Administrator becomes the hub through which all administration tasks and details are handled, making it the logical point at which to draw log data and reports.

It's not surprising, then, that NetIQ has a second tool in development to provide regulatory and audit compliance tracking and reporting. Change Guardian, due out later this year, will provide logging and reporting capabilities when combined with Change Administrator, officials say.

However, Change Administrator does provide reporting capabilities. The package provides reports on who can access which servers at what times, which servers those accounts can access, and who made which changes. It also generates reports tied to specific trouble tickets or change requests.

Change Administrator 1.0 runs on Windows Server 2003, Windows XP Professional (any Service Pack level), and Windows 2000 Server (SP4 or higher), and requires Microsoft SQL Server 2005. Pricing starts at $2,000 per server.

About the Author

Stuart J. Johnston has covered technology, especially Microsoft, since February 1988 for InfoWorld, Computerworld, Information Week, and PC World, as well as for Enterprise Developer, XML & Web Services, and .NET magazines.


  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.

  • After High-Profile Attacks, Biden Calls for Better Software Security

    Recent high-profile security attacks have prompted the Biden administration to issue an executive order aiming to tighten software security practices across the board.

  • With Hybrid Networks on Rise, Microsoft Touts Zero Trust Security

    Hybrid networks, which combine use of cloud services with on-premises software, require a "zero trust" security approach, Microsoft said this week.

  • Feds Advise Orgs on How To Block Ransomware Amid Colonial Pipeline Attack

    A recent ransomware attack on a U.S. fuel pipeline company has put a spotlight on how "critical infrastructure" organizations can prevent similar attacks.