This document outlines how to set up the TechIDAgent.Windows, which runs on each domain controller, or a standalone workstation, to create and manage identities for technicians.
Note: TechIDAgent should only be installed on one domain controller in a domain, typically the primary DC.
Definitions:
Target Machine – Domain Controller, or a machine, where identities will be managed
Client ID – Guid assigned by RuffianSoftware in the form XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX where X is an alphanumeric character.
If you don’t have one, Request a Client ID. Use the same Client ID for all TechIDAgent, TechIDAgent.EntraID, or TechIDClient installations.
TechIDAgent.zip – Downloadable archive from Ruffian Software containing all required executables.
Install Folder – Directory on the Target Machine where the domain service files reside (default: C:\Program Files\RuffianSoftware)
Steps:
At this point the domain will be assigned to the “All Domains” domain group in the TechIDPortal and any techs and rights assigned with “All Domains” in a DomainTechRights group will be created.
In general, TechIDAgent.exe is run to set options that are used by the service later when it runs. Options can be set on separate lines to ease scripting and installing. The complete command line help can be seen from the command line with “TechIDAgent.exe help“.
The options listed on this page are for the most recent version of TechIDAgent.exe. Some older versions don’t support all these options. All options are of the format ABC or XYZ value where ABC is an option to set with no additional parameters and XYZ requires an additional commandline parameter value. See “start” and “clientguid” above.
- help – Show this helpful output
- show – show all options that are set.
- install – Install the TechIDAgent service
- uninstall – Uninstall the TechIDAgent service
- start – start the TechIDAgent service(same as “net start TechIDAgent”)
- stop – stop the TechIDAgent service(same as “net stop TechIDAgent”)
- update – shortcut for the commandline: stop uninstall install start. See update documentation for how to do this.
- JustInTime – (version 4.0 and newer) make all accounts controlled by this instance be Just-In-Time accounts
- Managed – (version 4.050 and newer) make all the accounts controlled by this instance be managed accounts (this is the default)
- clientguid value – Specify the ClientGuid to use when accessing the TechIDPortal
- domainguid value – Specify the DomainGuid to use when accessing the TechIDPortal (This is unique to each domain, and should ONLY be set when migrating a domain controller)
- OU value – Specify the OU to create tech accounts in the form x.y.z… where x is the top level OU, and y is a child OU of X, and Z is a child OU of Y, etc… (use “reset” to return to default value) https://ruffiansoftware.com/ad-ou-feature-in-domainservice-piece-of-techidmanger
- leaf value – (version 5.0 and newer) Specify the leaf that accounts for this Agent will be on. The Leaf must already exist in the TechIDPortal, and the name must be an exact match, otherwise the request is ignored. The use of quotes (“…”) is recommended. https://ruffiansoftware.com/trees-and-leaves-or-leafs/
- agentgroup value – (version 5.0 and newer) Specify the AgentGroup name that this Agent should join by default. The AgentGroup must already exist in the TechIDPortal, and the name must be an exact match, otherwise the request is ignored. The use of quotes (“…”) is recommended.
- domain value – (version 4.073 and newer) Specify the “Alternate UPN Suffix” to use when creating techs’ users. This only needs to be specified if you have alternate UPN suffixes setup on a DC and want to use one of those to create techs’ users.
- friendlyname value – Specify a searchable string for use in the TechIDClient that is specific to this domain or machine
- rmmname value – Specify a searchable string for use in the TechIDClient that is specific to this domain or machine (This is NOT the name of the RMM used on this machine)
- force – Run once in this context and exit (for testing only – do not use without explicit direction to do so from Ruffian Software)
- displayname value – Specify the format used to set the Display Name in AD for managed tech accounts (use “reset” to return to default value) https://ruffiansoftware.com/username-feature-in-domainservice-piece-of-techidmanger
- username value – Specify the format used to make the UserName for managed tech accounts (use “reset” to return to default value) https://ruffiansoftware.com/username-feature-in-domainservice-piece-of-techidmanger
- accountdescription value – Specify the format used to set the Account Description in AD for managed tech accounts (use “reset” to return to default value) https://ruffiansoftware.com/username-feature-in-domainservice-piece-of-techidmanger
- phone value – Specify the format used to set the phone number in AD for managed tech accounts (use “{blank}” to not set the phone number)
- email value – Specify the format used to set the phone number in AD for managed tech accounts (use “{blank}” to not set the email)
- company value – (version 5.0 and newer) Specify the company name for techs in AD. This defaults to the UserNameAddon from the TechIDPortal.
- SetMsdsSupportedEncryptionTypes value – (version 5.0 and newer) set the value for msDSSupportedEncryptionTypes in AD for techs in AD.
- ClearMsdsSupportedEncryptionTypes – (version 5.0 and newer) don’t set the value for msDSSupportedEncryptionTypes in AD for techs in AD. This is the default.
- loglevel value – Specify the loglevel used to 0 (less) to 10 (more)
- cmdline – run continually as if running as the service (for testing only – do not use without explicit direction to do so from Ruffian Software)
- gui – show a graphical user interface for setting options
- servicename value – when rotating the sharedusername password also stop this service, set this service entries password, and start this service. This requires a shareduser setup, and is only valid on the commandline after a “shareduser”
- autologon – set this computer’s autologon password to this shareduser. This requires a shareduser setup, and is only valid on the commandline after a “shareduser”
- hideonloginscreen – prevent techs’ local accounts from showing on the windows login screen. If using this option on a non-domain joined machine for local accounts read Login Screen Changes.
- showonloginscreen – show techs’ local accounts on the windows login screen
- HourToRun value – 24 hour based hour in which runtime changes passwords (default is 0). This can be a comma separated list of hours to run in (i.e. “0,9,18” will at midnight, 9 am, and 6 pm).
- RunAfterMiss – If the HourToRun window is missed, then run as soon as the machine is capable.
- RunInWindow – Only run during the HourToRun window. Don’t run at other times (this is the default).
- forceshortnames – force the use of user names with length no more than 20 character
- allowlongnames – allow the use of user names with any length (this is the default behavior)
- PasswordLength value – override TechIDPortal password length setting for just this domain (range is 8-128) (use “reset” to return to using TechIDPortal value)
- UseWordListPassword – (version 5.438 and newer) override the TechIDPortal option and use words to build a password instead of fully random passwords
- UseRandomPassword – (version 5.438 and newer) override the TechIDPortal option and use only random characters to build a password instead of the word list.
- UseDefaultPassword – (version 5.438 and newer) use the TechIDPortal options for building passwords
- WordCount value – (version 5.438 and newer) override the TechIDPortal option on minimum number of words to use to build a word list password (range is 2-20) (use “reset” to return to using management console value)
- GuaranteedRight value – (version 5.438 and newer) set a right that is always granted to tech’s accounts on this agent. Even when an account is disabled (and all other rights are removed) this right will be assigned. Think about the “Protected Users” AD Group. This can be a single right or a comma separated list of rights.
- version – print out the version of this TechIDAgent.exe
- host value – specify the address of the TechIDHost if using self-hosted TechIDManager (normally left blank)
- InstallLAPS – Install TechIDAgent and tell it to only run a shared user setup, and do not run the default unique user setup of TechIDAgent.
- SharedUser name – Create a shared user setup for TechIDAgent and control the password for the name user. This will show up as an agent with the MachineName\name in the TechIDPortal. All options after this on the command line apply only to this named instance.
- Instance name – Create a unique user setup of the TechIDAgent. This can be used to control the username formatting for a subset of techs in a co-managed setup. This will show up as an agent with the MachineName\name in the TechIDPortal. All options after this on the command line apply only to this named instance.
- RemoveInstance name – Remove the unique user setup with the given name.
- RemoveSharedUser name – Remove the shared user setup with the given name.
- DoNotRun – Cause the current setup (as specified earlier on the commandline) to not run. This leaves all the data intact for the instance and it can be set to run later with “DoRun”.
- DoRun – Cause the current setup (as specified earlier on the commandline) to be run. This is the default for all setups that are created.
Here is some documentation on the setups/instances and how to use them. https://ruffiansoftware.com/instances-in-domainservice/
Here is some documentation on converting a PAM setup/instance to a shared/LAPS setup/instance. https://ruffiansoftware.com/convert-pam-to-laps/
local– (removed in Version 5.144)make local accounts on this machine.Will not error, but currently has not effect.nonlocal– (removed in Version 5.144)make domain accounts on this domain controller (local and nonlocal are mutually exclusive options.Will not error, but currently has not effect.
