Users and groups

The Users & Groups page lists every account that has access to the console. An account is onboarded when you add it to this page. Onboarded users sign in to manage policies or run sessions. Onboarded groups give their members the same access.

To open the page, select Users & Groups in the left navigation. The same list also appears as the Users tile on the dashboard. See Dashboard.

Account types

The list shows four types of account.

Type	What it is	Add it with
User	An Active Directory (AD) user	Add domain users and groups
Group	An AD group. Members sign in with their own accounts.	Add domain users and groups
Application	An account for an automation tool that calls the REST API. It can't sign in to the console.	Add application users
Local User	An account stored in the Privilege Secure database. It doesn't depend on AD.	Add and manage local users

You can also group accounts into collections to grant the same rights to a set. See User and group collections.

Toolbar

The toolbar has these controls:

• Add: Opens a menu with New Domain User, New Application User, and New Local User.
• Remove: Removes the selected accounts. The button stays disabled until you select a row.
• Search: Filters the list to rows that match the text you enter.
• Type: Shows one type only. The values are All, User, Group, Application, and Local User.
• License: Shows licensed or unlicensed accounts. The values are All, Licensed, and Unlicensed.
• Last Login: Shows accounts whose last sign-in falls between a start date and an end date.
• Refresh: Reloads the list.

The Licenses counter at the top right of the page shows the licenses in use and the licensed total, for example 7 / 50. The list also shows the number of results.

Columns

Column	Shows
TYPE	An icon for the account type.
NAME	The account name. Select the name to open the account's details page. See User and group details. An account with no display name shows <null>.
USER NAME	The sAMAccountName value. Groups leave this blank.
USER PRINCIPAL NAME	The user principal name (UPN). Groups leave this blank.
LICENSED	Whether the account uses a license. For a group, a badge such as x2 shows how many members are licensed. Hover over it to see the count, for example "2 users licensed".
EMAIL	The email address, if the account has one.
LAST LOGIN	The date and time of the last sign-in. A group shows N/A until a member signs in.
LOCKED	Whether the account is locked. See User and group details. The column marks the account as locked for an administrator lock and also while a failed-sign-in lockout is in effect.
ACTIVE SESSIONS	The number of sessions in progress.
SCHEDULED SESSIONS	The number of sessions scheduled for a later time.
ACCESS POLICIES	The number of access policies that include the account. See Access policies.

You can resize the columns and sort each one in ascending or descending order.

Remove users and groups

Removing an account takes away its console access.

warning

Export any records you need from the Activity Log before you remove the user.

To remove an account:

1. Select Users & Groups in the left navigation.
2. Select the checkbox for each account to remove.
3. Click Remove.
4. Confirm the warning.

For example, to remove a contractor who has left, export the user's history from the Activity Log, select the row, click Remove, and confirm.

Removing a user deletes the user's sign-in record, which frees the license that the user used. The Licenses counter counts every user record, including local and application users. Privilege Secure checks the licensed total only when it creates a new user, so the counter can show more licenses used than the total.

For how licenses are counted, see Licensing.