As the number of privileged connections grows, managing and controlling them becomes increasingly challenging for companies. One of the main goals in developing Axidian Privilege is to automate control where continuous specialist involvement was previously required.
Key updates of this release include activity control in sessions, Kerberos support for Linux installations, new usage scenarios in the Web Terminal, and control of port forwarding in SSH sessions.
Activity control in RDP sessions:
risky actions stopped as they happen
One of the major updates in Axidian Privilege 3.5 is the ability to create rules that control user activity during RDP sessions. Administrators define the events to monitor, such as launching a specific application or switching browser windows, and set the system’s response: logging the event, terminating the session, or blocking the user.
Why it matters
The IT security team can respond to unwanted actions automatically during the connection, instead of waiting for the session to end and reviewing events afterwards. This shortens the time between detecting an action and responding to it, and reduces the need to monitor every connection manually.
Rules can be introduced gradually. At first, the system can simply log selected events, so specialists can gather statistics and understand how users really work. Later, stricter responses can be set for specific actions. This step-by-step approach makes it easier to roll out the same control rules across infrastructures with many privileged connections.
Kerberos on Linux servers:
easier and safer login for companies using Active Directory
Another key enhancement is support for Kerberos authentication on Linux-based Axidian Privilege servers. It is available for users whose accounts are stored in Active Directory.
When a user logs in to Axidian Privilege from a domain computer, the browser signs them in automatically, with no need to enter their username and password again. The management server does not need to be added to the domain. Previously, this was possible only when Axidian Privilege ran on Windows.
This also covers administrator accounts in the Active Directory Protected Users group. Members of this group cannot use the older NTLM login method and must use Kerberos with AES encryption. Now they can log in to Axidian Privilege on Linux servers too.
Why it matters
Keeping administrator accounts in the Protected Users group is a common security recommendation and is often checked during audits. Until now, companies had to choose: meet this requirement, or run Axidian Privilege on Linux, which needs fewer resources, is easier to maintain, and costs less.
With version 3.5, companies can run Axidian Privilege on Linux and still meet strict requirements for protecting administrator accounts. Users also get a simpler daily experience, because they no longer need to enter their password again.
Web Terminal for remote access to RDS: secure access to work applications straight from a web browser
In Axidian Privilege 3.5, Web Terminal supports not only RDP and SSH sessions but also connections to Remote Desktop Services (RDS) servers.
Users can open a remote desktop or a published RemoteApp application directly in their browser, without downloading RDP files, installing a local client, or logging in again.
Why it matters
Employees and contractors can now work from almost any device with a browser. It can be a company laptop, a personal computer, or a guest device. The type of device no longer matters, which makes access as convenient as possible for users.
Security stays at the same level as a connection through a client on a company computer. All connections pass through Axidian Privilege, so the security team keeps full control and records every session.
File transfer in Web Terminal:
convenient file exchange for users, full control for security
Web Terminal now supports file transfer between the user’s device and the target server. To upload or download a file, the user simply drags it into the active session window. Axidian Privilege policies control this feature, so organizations can allow file transfer only for approved tasks and users.
Why it matters
Administrators often need to move files during their work. For example, they upload installation files to a server or download logs to investigate an incident. Now they can do this directly in the browser, from any device, without installing extra software. This makes daily work easier for both employees and contractors.
At the same time, the security team stays in control: it decides who can transfer files and for which tasks.
Control of port forwarding in SSH sessions: no hidden paths to other systems
Axidian Privilege policies now include a dedicated setting for local port forwarding in sessions opened through SSH Proxy. It allows administrators to enable or disable SSH tunneling. If tunneling is blocked, Axidian Privilege stops only the tunnel. The user’s main session keeps running as normal.
Why it matters
Port forwarding is a built-in SSH feature. It lets a user turn an approved connection into a hidden path to other internal systems that they were never given access to. From the outside, it still looks like normal work on one approved server. This weakens the access rules set by the security team, and attackers can use it to move from one stolen login to many systems.
With this setting, people can reach only the systems they were actually given access to. Tunnels can still be allowed for approved tasks and for specialists who need them in their work.
Safer login through third-party systems: critical accounts are linked to the right person
The new release expands authentication settings for external Identity Providers via OpenID Connect. An account in Axidian Privilege can be linked to an external ID either manually or automatically via email address upon first login. This authentication method can be individually enabled or disabled per user.
Why it matters
Linking accounts by email is fast and convenient, especially during the first setup. But for privileged and emergency (break-glass) accounts, convenience cannot come first. If two email addresses match, the accounts are linked automatically, and this can create extra risks.
Axidian Privilege lets organizations choose the right balance for each account. For most users, automatic linking by email keeps setup simple. For critical accounts, automatic linking is turned off, and the account is linked to the external provider by a unique identifier.
Organizations can transition to this authentication model gradually without disrupting existing operations. For critical accounts, logging in via an external Identity Provider can be completely disabled, leaving only native Axidian Privilege authentication mechanisms.
New permission wizard: granting access made easier and faster
The permission wizard has a new single-page interface that shows all parameters in one view. Administrators can review the complete configuration and adjust settings before saving.
Why it matters
In large enterprises, access permissions are granted dozens of times a day. The new wizard makes this routine task faster, reduces manual work, and lowers the risk of granting access with incorrect parameters.
Users receive approved access sooner, and the IT security team can check every setting before access is granted.
Configuration of proxy components in policies:
more granularity and scalability
In Axidian Privilege, every privileged session passes through a proxy server. This is the checkpoint where the session is controlled and recorded. Previously, these checkpoints were set up once for the whole system.
Now administrators can set proxy server addresses and settings for individual connections. A specific session can be sent through a chosen proxy server without changing the configuration of the whole system. For example, sessions to servers in one data center can go through a nearby proxy, while sessions to another site use a different one.
Why it matters
This is useful for large companies with offices, data centers, or networks in different locations, or with proxy servers that perform different tasks. Each connection takes the most suitable route. New sites can be added and the system can grow without rebuilding the setup for everyone.
Rotation of text session logs: predictable database size without manual cleanup
Version 3.5 introduces automatic rotation of text session logs. Text session logs are the written record of each privileged session, such as the commands a user typed. Administrators set how long these logs are kept in the Axidian Privilege management console. When that period ends, the system deletes the old entries automatically. This also applies to logs from sessions that closed before the update.
Why it matters
In large companies, thousands of sessions happen every day, and these records grow quickly. The database keeps getting bigger, backups take longer, and someone eventually has to clean it up by hand or ask support for help.
With automatic rotation, old records are removed on schedule, much like an automatic archive policy for email. The database stays at a predictable size, and logs are kept exactly as long as the company’s internal data storage policy requires.
Interface improvements:
personalized views and live system status
On the “All Sessions” page, users can now choose which columns to show or hide. Each person’s view is saved and also applied to the list of active sessions.
The administrator dashboard, the main screen that shows the current state of the system, now updates automatically every ten seconds.
Why it matters
Each person sees only the data they need. For example, an auditor may only need the user, the target server, and the session time, while an administrator may want more technical details. The view is set up once and does not need to be repeated.
Administrators no longer need to refresh the page to see what is happening. The dashboard always shows near real-time information, which helps them notice problems faster.
