Separate installation rights from everyday access
Use an authorized administrator for setup tasks that install services or change system configuration. That does not mean every console user, database login or application identity should receive administrator access. Review permissions separately for the installer, Agent, server, web console and database.
Apply access to the correct component
| Component | Access to review |
|---|
| Agent installer | Authorized elevation for the approved package. Confirm the deployment and organization before rollout. |
| On-Premise server | Its installed service identity, configuration-file access and database connection rights. |
| GateCore web console | Verify the GoMyidCore service, selected web port and local-only or network access setting in the customer setup. |
| SQL database | The documented customer setup requires sa for its fixed GOMYID instance. Protect credentials and connection files; do not replace the login without product compatibility validation. |
| Report reviewers | Only the device, group, report and export access required for the approved role. |
Scope firewall rules to the real connection
| Traffic | Rule design |
|---|
| Agent to server | Allow the configured server destination and actual listener ports from the intended endpoint networks. |
| Browser to web console | Local mode uses localhost. Network mode binds all IPv4 interfaces and setup adds a TCP inbound rule for the chosen web port (default 5000). This does not configure HTTPS. |
| Application host to SQL | Allow the actual SQL listener from the application hosts that require it; do not expose SQL to every Agent. |
| Administration | Limit management access to designated administrators and their trusted network paths. |
Verify the protocol, direction, destination, source scope and active Windows firewall profile. A port number alone is insufficient. A successful TCP check proves reachability to a listener, not successful application authentication.
Handle antivirus findings without broad exclusions
Keep antivirus and endpoint protection active. If an installation or connection fails, first inspect the protection event and identify the specific file or behavior involved. Confirm that the file came from the approved DeskGate package.
If a reviewed exception is required, scope it to the verified executable, publisher or path using your security product’s supported policy. Document the reason and review it after updates. Do not exclude all files with *.*, disable real-time protection globally or grant Everyone full control to solve an unexplained error.
Current Cloud Agent files are under native Program Files\GoMyid; On-Premise Agent files are under native Program Files\GoMyit. Confirm the actual installed location before defining a rule. These folder names are not a recommendation to exclude the whole directory.
Validate a change
- Record the original symptom, affected component and relevant event.
- Make the smallest reviewed permission or network change.
- Repeat the same connection or installation test.
- Confirm that unrelated sources still cannot access the service.
- Record the owner, scope and review date of any exception.