Administration, Reporting, and Auditing
Administration building blocks
This domain tests the controls that keep Secret Server trustworthy: identity, roles, engines, configuration, reporting, and audit. Administrators manage users and groups, authentication (Active Directory/LDAP, SAML/SSO, MFA such as Duo or RADIUS), application accounts for API access, and role assignments. Use least privilege: a help-desk person may need user administration, an auditor may need only audit/report viewing, and a platform admin may need system configuration. Prefer synced AD groups for both access and administration so joiner/mover/leaver changes flow from the identity source. Distributed Engines and sites must be registered, healthy, and assigned to the right secrets.
Reporting and auditing
Secret Server records audit events for logins, failed logins, secret views/edits, permission changes, heartbeat/RPC results, access requests, and session events. Built-in reports include secret audit, user audit, heartbeat status, password-change status, permission, and secret-expiration reports; many can be scheduled and emailed. For compliance, forward audit events to a SIEM via syslog/event subscriptions and set retention longer than the required period. Test restores: back up the SQL database and the encryption key material together, or the restore cannot decrypt secrets.
Worked example
An auditor asks who viewed a specific secret last month and whether MFA was used. Run the Secret Audit report filtered to that secret and date range; export it. Cross-check User Audit/login events for the same users to confirm MFA and source IP. If events are forwarded to the SIEM, search there for a single timeline. Reasoning: the secret audit proves access; login/MFA events prove authentication context; retention must cover last month. The auditor's account should have report/audit-viewing rights, not System Administrator.
Traps
- Granting System Administrator just to run reports; use a reporting/audit role.
- Assuming audit forwarding is on by default; it must be configured.
- Backing up the database but not the encryption key.
- Relying on default retention when policy requires a year or more.
- Confusing heartbeat reports with password-change/RPC reports.
- Forgetting that group membership changes from AD may take a sync cycle to affect permissions.