A brand new installation of SolarWinds Orion NPM sets the local Admin account password completely blank. One of the first steps you should take as an Orion administrator is to create a password for this user account. Perform the following steps to change the default administrator password:

Perform the following steps to disable the Guest user account in Orion NPM:

The default admin password is now changed and the Guest account is disabled, which will prevent people from accessing Orion NPM.

Orion NPM supports individual user accounts that are local to Orion NPM itself, as well as Active Directory domain accounts. Local Windows accounts, such as a Windows account that is local to the server that Orion NPM is installed on, are not supported.

Individual user accounts are local to the SolarWinds Orion installation and are only specific to Orion NPM. If you try to use a local Windows Server user account to log into the dashboard, it will not work! SolarWinds Orion only allows individual user accounts to be added one at a time, and cannot be added in bulk. If you do not have the need to manage a large number of user accounts in Orion NPM, setting up individual user accounts may be more than sufficient.

An alternative method of setting up user authentication is through Active Directory. Active Directory (AD) is a centralized authentication service for Microsoft-based networks and simplifies user account management for the Orion dashboard. Active Directory is a staple in the enterprise and is wildly popular. Enabling Active Directory Authentication in Orion allows you to add both, single domain accounts as well as Active Directory security groups.

The best practice when using Active Directory Authentication is to create a new security group in Active Directory and add domain accounts to the group whom you wish to give access to Orion NPM. Finally, add the security group to the authentication settings in the Orion dashboard. As long as a domain user account is a member of the security group, that user account will, or will not, have rights to the Orion dashboard.

One final thing to know about security groups is that if a user has an individual Orion account and the user is a member of an Active Directory security group added to Orion, the individual Orion user account "wins" and the security group permissions will be completely ignored.

As an Orion administrator, it is up to you to decide how you want to handle user authentication to your Orion NPM system. You can always start with assigning individual accounts, then implement Active Directory Authentication at a later date. Or, you can use both methods at the same time. There is no "user licensing" for SolarWinds Orion NPM. You can create/add/edit as many user accounts as you want!

You can manage user account access in two ways, by using individual accounts or Active Directory security groups.

The Individual Accounts tab shows how easy it is for an Orion administrator to see who has been logging into the dashboard, what type of user accounts have access to the dashboard, what user accounts may need to be deleted due to inactivity, and a general idea of what permissions a user account may have.

Active Directory security groups are added to Orion from the Groups tab in the Manage Accounts page. The process for adding a group, as well as assigning permissions to a group, is precisely the same as individual accounts. Groups can be added only if Active Directory authentication was enabled from the Orion Configuration Wizard.

Use the following example to create an individual user account:

The new user account will be listed in the Individual Accounts tab. If you make a mistake, you can always go back and edit the account permissions. Otherwise, delete the account then create a new one.

Use the following example to grant an Active Directory domain account access to the Orion dashboard:

The new user account(s) will be listed in the Individual Accounts tab. Notice that the Account Type states it is a Windows domain user account. Accounts that are local to the Orion server will say Orion.

If you made a mistake when adding the accounts in the dashboard, you can always go back and edit or delete them.

Adding Active Directory groups to Orion can be done in one of the two ways; directly from the Groups tab or from the Individual Accounts tab. But, for the sake of simplicity, we will see how to do this from the Groups tab.

Your Active Directory groups will be listed in the Groups tab. Again, remember that if a user account has an individual account in Orion and is also a part of the Active Directory security group, Orion will ignore the group permissions.

SolarWinds Orion is fully compliant with the concept of "the principle of least privilege". It allows an administrator to be extremely granular regarding permissions to tabs, pages, and modules. Almost every aspect of the Orion dashboard has a user permission which can be allowed or denied per user account or per Active Directory group. It is even possible to limit one user account to a single node! You would want to limit access because some modules actually allow you to change a setting on the actual node. You wouldn't want a virtualization administrator to start making changes to your core production routers, would you? If you need to know what options allow or deny, a full description for each permission is displayed in the account edit screen.