RBAC built for the people who run a PAM platform
Every security platform has user roles. Most do the minimum: admin, operator, viewer, maybe a custom role tier and call it RBAC. That works until you’re running a real PAM and User Activity Monitoring deployment, at which point you need to express things like: “Sarah can view monitoring results for the Finance Endpoint group but not Engineering, can’t see clipboard text, can approve One-Time Password requests, can’t disable the default admin, and her permissions inherit from the Supervisors user group except when overridden by her own grants.” Generic RBAC doesn’t fit that shape; you either over-grant and hope, or you write workarounds. Competitors at this layer handle similar problems with their own permission models, but with varying granularity. Syteca’s permission model is built around exactly the operations a UAM/PAM admin needs: administrative permissions that gate platform-wide actions, Endpoint permissions that gate per-Endpoint operations, User-to-User access scoping for restricting which endpoint users’ monitoring results a Management Tool user can see, and three user types (internal, Active Directory, application account) that share the same permission engine.Use Syteca user management when you need to:
- Implement separation of duties between platform admins, investigators, and operations staff — with permissions granular enough to express the real boundaries.
- Inherit AD user groups automatically — domain group → Management Tool user group → user, so new hires get correct access on day one.
- Restrict which endpoint users a given investigator can monitor (the “User-to-User” model) — useful for legal-team segmentation, regional separation, or contractor isolation.
- Scope an investigator to only the sessions where an alert fired, so granting access to one incident doesn’t grant access to everything else recorded on that endpoint — see Which sessions a user can see.
- Enforce 2FA per user — TOTP via any authenticator app — with admin-managed reset for lost devices.
- Harden the default admin by disabling it entirely once other Administrators are configured — eliminates the “default admin compromise” attack surface.
- Wire applications into Syteca via Application Account users through the Application Credentials Broker for service-to-service automation.
All user and user group management requires the administrative User Management permission. In Multi-Tenant mode, users and user groups are completely independent per tenant.
The default admin and tenant model
By default, Syteca ships with one administrator — loginadmin, password set during Application Server installation. The default admin has every permission required to work with the system and is the technician in Multi-Tenant mode, with the ability to create tenants. Once another admin is configured, the default admin can be disabled to harden the deployment.
Three user types
Five default user groups
Every Syteca deployment ships with four user groups:
You can add custom user groups for finer-grained role definitions — see Add a user group below.
Permission inheritance
A user can belong to multiple user groups. When a user is in a group:- They inherit every permission granted to that group.
- Inherited permissions can only be removed by removing the user from the group they can’t be revoked individually on the user.
- The user can also have their own permissions in addition to inherited ones.
Open the Users page
Sign in to the Management Tool, click Users in the left navigation. Users are listed grouped by the user groups they belong to. Each row shows:
The Users page - users listed under the groups they belong to, with PAM seat toggle and lock/unlock status visible per row.
Add a user
1
Open Add User
On the Users page, click Add User in the top right.
2
Pick the user type
On the User Type tab of the Adding New User page, click one:
- Add an Internal User will create a local Management Tool account.
- Add an Active Directory User / User Group will add an existing AD user or user group.
- Add Application Account will create an account for the ACB API. Not available in SaaS.
If an Active Directory user already belongs to two or more AD user groups in Syteca, that user can’t add themselves as an independent user — only other administrators with appropriate permissions can.
3
Fill in user details
On the User Details tab, complete the form depending on user type:Click Next.
- Internal user
- Active Directory user/group
- Application Account
- Login must be unique. (In Multi-Tenant mode, users of different tenants can share the same login.)
- Password at least 8 characters, with at least one lowercase letter, one uppercase letter, one numeric character, and one special character. Cannot contain more than 3 consecutive identical characters or the user’s login name.
- First Name / Last Name / Description optional, max 200 characters each.
- Email is required for the user to receive an automatically generated one-time password.
- Enable two-factor authentication on login force the user to set up TOTP 2FA on first sign-in.
Internal and Active Directory users can also call the ACB API. Enable Allow this user account to be used by external applications in the Application Account Settings section of this tab, and the same Client ID / Client Secret and Refresh Token sections appear. See Set up a user account.
4
Assign user groups
On the User Groups tab, select the groups this user will belong to. Click Next.
The user is automatically added to the All Users default group — this can’t be changed.
5
Set administrative permissions
On the Administrative Permissions tab, select the administrative permissions to grant the user directly (in addition to any inherited from groups).Click Next.
You can only add new permissions on top of group-inherited ones. To remove inherited permissions, remove the user from the relevant group.
6
Set Endpoint access
On the Endpoint Access tab, for each Endpoint or Endpoint group:Click Next.
- Click the Edit Permissions icon on the right.
- In the Endpoint Permissions window, select which Endpoint permissions to grant.
- Click Save.
Two of these permissions decide which sessions the user can see: Viewing All Monitoring Results reveals every session on the Endpoint, and Viewing Alerted Sessions reveals only those containing a triggered alert. Neither lets the user open a session on its own. See Which sessions a user can see.
7
(Optional) Set User-to-User access
On the User Access tab, restrict which endpoint users’ monitoring results this Management Tool user can see. If you leave this empty, the user sees sessions for all endpoint users they have Viewing Monitoring Results permission for.To restrict:
- Click Add User on the right.
- Pick the Domain / Computer Name and User / User Group from the drop-downs. Use
*as a wildcard. - Click the Add icon to commit.
The drop-downs only show domains, computers, users, and groups already seen by Syteca during monitoring — but you can also type new names directly.
Settings here apply to all sessions for the added endpoint users — past and future. Exception: if you add a domain group, only sessions recorded after adding the group are accessible.
8
(Optional) Assign a PAM seat license
After saving, on the Users page, toggle the PAM column on for users who need Password Management and Account Discovery — see PAM seat licenses.
9
Finish
Click Finish in the bottom right. The new user appears on the Users page.
Edit a user
1
Open the user
On the Users page, click the Edit User icon next to the user.
2
Make your changes
Edit the user details, group memberships, permissions, Endpoint access, and User-to-User access on the corresponding tabs — same as when adding a user.
3
Reset 2FA (if needed)
A Reset 2FA button appears next to the Enable two-factor authentication on login checkbox — but only after the user has already signed in and set up 2FA, and only for the tenant admin and Management Tool users with the User Management permission. Click it to delete the user’s 2FA profile, useful when the user has lost both their phone and their 2FA recovery code.
4
Save
Click Finish to save and exit, or Next to save progressively across tabs.
The Delete User button appears in the bottom left when editing — see Delete a user below. For the default
admin user, the Disable User button replaces Delete User — see Disable the default admin.Lock and unlock users
User accounts can be locked automatically (after too many failed sign-ins — see Brute-force lockout) or manually by an administrator.- Lock a user
- Unlock a user
On the Users page, click the Lock User icon on the right of the user. Click Confirm in the pop-up.
Delete a user
1
Open the user
Click the Edit User icon next to the user on the Users page.
2
Delete
On the User Details tab, click Delete User in the bottom left.
3
Confirm
Click Delete in the confirmation message.
The default
admin user can’t be deleted — use Disable the default admin instead.Disable the default admin
The defaultadmin user has unrestricted access to everything in Syteca — useful for initial setup, a meaningful risk during operation. After initial deployment, security-conscious organizations disable the default admin entirely and rely on other Administrators users (each with auditable, configurable permissions) to operate the platform.
On the default admin user's Edit page, the Disable User button replaces the Delete User button - and only appears when another Administrators-group user exists.
Why disable the default admin?
- Eliminates a known, high-value credential target (the literal
adminaccount). - Forces all administrative actions through accounts that show up in the Audit log by name.
- Meets compliance frameworks (NIST 800-53 IA-4, ISO 27001 A.9.2) that restrict generic admin accounts.
- Required by some Pseudonymizer / regulatory deployment patterns.
Prerequisites
Before disabling the default admin, at least one other user must be added to the Administrators user group — either as an internal user, an AD user, or via membership in an AD user group added to Administrators. Additionally, the default admin can’t be disabled while they’re the sole owner of certain options or rules. Address these first:If the default admin is the owner (i.e. created) of a Scheduled Report rule, disabling the default admin stops the rule from running and removes it from the Scheduled Reports tab. To preserve the rule, transfer ownership before disabling — or recreate the rule under another user.
Disable the default admin
1
Sign in as another administrator
Sign in to the Management Tool as any user in the Administrators group except the default admin.
Only users in the default Administrators user group (internal or AD, or AD user-group members) can disable the default admin.
2
Open the default admin
Click Users in the left navigation. Click the Edit User icon next to the default
admin user.3
Click Disable User
On the User Details tab, click Disable User in the bottom left.
The Disable User button replaces Delete User for the default admin. It only appears if at least one other user has been added to the Administrators group.
4
Confirm
Click Confirm in the warning pop-up. If the default admin is the sole owner of any options/rules listed in the prerequisites table, the Confirm button won’t be available — resolve those first.
Restrictions after disabling
Disabling the default admin changes the behavior of several features:Add a user group
User groups work the same way as users — same Endpoint Access, same Administrative Permissions, same User-to-User access mechanism. Users in a group inherit the group’s permissions.1
Open Add User Group
On the Users page, click Add User Group in the top right.
2
Set group properties
On the Group Properties tab, enter a Name (optionally a description), then click Next.
3
Add members
On the Management Tool Users tab, click Add Users in the top left, select the users to add, then click Next.
4
Set administrative permissions
On the Administrative Permissions tab, select the administrative permissions all group members will inherit. Click Next.
5
Set Endpoint access
On the Endpoint Access tab, for each Endpoint or Endpoint group, click the Edit Permissions icon and select the Endpoint permissions to grant. Click Save after each, then Next.
6
(Optional) Set User-to-User access
On the User Access tab, restrict which endpoint users’ monitoring results group members can see — same mechanism as for individual users in Add a user.
7
Finish
Click Finish. The new user group appears on the Users page.
Edit a user group
1
Open the group
On the Users page, click the Edit Group icon in the top right of the user group.
2
Make your changes
Edit properties, members, permissions, and Endpoint access on the corresponding tabs — same as when adding a user group.
3
Save
Click Finish to save and exit, or Next to save progressively.
Delete a user group
1
Open the group
Click the Edit Group icon in the top right of the user group on the Users page.
2
Delete
On the Group Properties tab, click Delete Group at the bottom of the page.
3
Confirm
Click Approve in the confirmation message.
The All Users group can’t be deleted.
Related
Administrative permissions reference
The administrative permissions and what each one grants.
Endpoint permissions reference
The per-Endpoint permissions, plus a worked permission-inheritance example.
Which sessions a user can see
How administrative and Endpoint permissions combine to scope session access.
Two-factor authentication
Configure 2FA across users and the deployment.
ACB application accounts
Service-to-service authentication for the API.