Configuring Integrated RunAs

The following functionality is not supported:

• Published applications and desktops.

• Microsoft Universal Windows Platform applications on shared kiosk workstations.

  By design, these applications can run under the generic Windows user only.

Before you begin, consider the following:

• The Imprivata Chrome Extension is required and must be enabled.

• All path parameters in the custom shortcut must be enclosed in quotes, including those that do not include spaces.

  For more information, see the provided examples.

• Applications open in a normal window.

  The custom shortcut cannot be configured to minimize or maximize the application window.

• All applications should be opened using the custom shortcut only.

  This prevents unexpected application behavior that can result from the user first opening the application from the Start menu, for example, and then from the desktop.

• APG custom logoff sequences for web based applications may be overridden.

  All open IWA applications are closed on user switch or logout. If an APG-profiled web application is sharing the same web browser session with one of those applications, it is also closed.

• Either the Microsoft Outlook Web App or Microsoft Office 365 are the recommend Outlook deployment options on shared kiosk workstations.

  If Microsoft Outlook is deployed as a thick client application:

  • The profile for each authenticated user is loaded. This can result in degraded performance.

  • Users must complete the Outlook setup wizard on each workstation.

• By default, Windows does not remove user profiles on user switch or logout. This can become memory intensive, and over time, can result in degraded performance on the workstation. It is best practice to periodically remove these profiles.

To configure a shortcut on a single endpoint:

1. Go to the following location:

   • 64–bit — C:\Program Files (x86)\Imprivata\OneSign Agent

2. Right–click ISXRunAs.exe, and select Send to > Desktop (create shortcut).

3. Go to the desktop, and right–click ISXRunAs - Shortcut.

4. Update the Target field to include the additional ISXRunAs usage parameters.

5. Click OK.

Examples

As detailed in the following examples, all path parameters must be enclosed in quotes, including those that do not include spaces.

Start Notepad with the Default Profile Flag

"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" "C:\notepad.exe"

Start Notepad with the No Profile Flag

"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" /noprofile "C:\notepad.exe"

Start Notepad with the Net Only Flag and Pass Additional Program Parameters

"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" /netonly "C:\notepad.exe" "C:\open file.txt" -showwindow

Start Google Chrome in Incognito Mode

"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" /netonly "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://ad.demo.local/owa"

Start Internet Explorer in Private Mode

"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" /netonly "C:\Program Files (x86)\Internet Explorer\iexplore.exe" "https://ad.demo.local/owa" -private

Configuring a GPO lets you distribute a custom shortcut to all of the required workstations.

For example – you can apply a GPO to a group of computers in Active Directory. Each time a user logs into the workstation, the shortcut is created automatically.

To configure a GPO:

1. From the domain controller, open the Group Policy Management console.

2. In the console tree, locate the organizational unit (OU) that includes the computers on which the shortcut is required.

3. Right–click the OU, click Create a GPO in this domain, and Link it here, and name the GPO.

4. Right–click the new GPO, and click Edit to open the Group Policy Management Editor.

5. Go to Computer Configuration > Preferences > Windows Settings > Shortcuts.

6. Right–click Shortcut, and select New Shortcut.
7. Complete the following:

   • From the Action list, select Update, and then specify the name of the shortcut.

   • From the Location list, select All Users Desktops.

   • In the Target path field, enter the path to the ISXRunAs utility.

   • In the Arguments field, enter the ISXRunAs usage parameters.

   • In the Icon file path field, browse to the icon that should be used for the shortcut .

     If this location is not specified, the shortcut appears with the Imprivata icon.

8. Click OK.

Drive mapping requires an Imprivata OneSign procedure code. To map a network drive:

• Configure a procedure code to use ISXRunAs to map the drive at user login/desktop unlock.

• Enable the procedure code in the computer policy that is governing your endpoints.

Using ISXRunAs to map the drive ensures that it remains available, under the context of the authenticated user, for the duration of their session.

Configure the Procedure Code

To configure the procedure code:

1. In the Imprivata Admin Console, open the gear icon menu, and click Extensions.

2. Go to the Procedure code section, and click View/Edit.

3. Click Add, and enter a name for the procedure code.

4. Click Click here to choose an event, and select the User Login session event.

5. Click Or > Click here to choose an event, and then select the Desktop Unlocked session event.

6. Type the following command in the text field:

   Syntax

   "C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" cmd.exe /C "net use <network_drive_to_map>"

   Example

   "C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" cmd.exe /C "net use z: \\exampledrive"

7. Go to The code will be section, and select Written to a file extension of, and type BAT in the field.

8. Save the procedure code.

Enable the Procedure Code

To assign the procedure code:

1. In the Imprivata Admin Console, click Computers > Computer policies.

2. Locate the required computer policy, and click its name to edit it.

3. Go to the Extensions tab, and select Enable Procedure Code Extension Object?

4. Click Enable, and save the computer policy.