Technical Tip: Restricting access for FSSO TSAgentConfig on Windows OS to specific account or user group

After the installation of Fortinet SSO Terminal Service Agent is completed on Windows machine, to restrict access on TSAgentConfig.exe to a specific user/service account or user group :

• Locate the TSAgentConfig.exe file under the path C:\Program Files (x86)\Fortinet.
• Right-click on TSAgentConfig and select Properties.
• In the 'TSAgentConfig Properties' window, select the 'Security' tab and then select the 'Advanced' button.
  
  

   

• In the 'Advanced Security Settings for TSAgentConfig' window, select the 'Disable Inheritance' button.
  
  

• In the 'Block Inheritance' window, select 'Convert inherited permissions into explicit permissions on this object'.
  
  

   

   

• Back in the 'Advanced Security Settings for TSAgentConf' window, it is now possible to remove unrelated user accounts or user groups. After removing required users, select 'Apply'.
  
  

• At this point a required user group or specific user can be added by selecting 'Add' button.
• In the new window 'Permission Entry for TSAgentConfig' select 'Select a principal'.
  
  

   

• In the field 'Enter the object name to select' enter required user/service account or user group name. Validate username or user group by selecting 'Check Names' button, after successful validation the username or user group name will be underlined. Select 'OK' to close the window.
  
  

   

• In 'Permission Entry for TSAgentConfig' window select required access rights for the user or user group that has been selected in previous step, then select 'OK'.
  
  

• In the 'Advanced Security Settings for TSAgentConfig' window newly added user or user group and their access rights are visible. Select 'Apply', and 'OK'.
  
  

• Same information as in previous step can be verified in 'TSAgentConfig Properties' window, select 'OK'.
  
  

   

• At this step Access Restriction is completed.
• To verify the restriction, login to windows machine where FSSO TS Agent has been installed, using a user account that is not member of the user group to which access rights has been granted earlier. By trying to access TSAgentconfig.exe, the following message should appear.