Endpoint Security webrh

Transcription

1 Endpoint Security webrh Framework 3.0 HFA1 Administration Guide 2 January 2011

2 2011 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS and FAR TRADEMARKS: Refer to the Copyright page ( for a list of our trademarks. Refer to the Third Party copyright notices ( for a list of relevant copyrights and third-party licenses.

3 Important Information Latest Software We recommend that you install the most recent software release to stay up-to-date with the latest functional improvements, stability fixes, security enhancements and protection against new and evolving attacks. Latest Documentation The latest version of this document is at: For additional technical information, visit the Check Point Support Center ( Revision History Date Description 2 January 2011 First release of this document Feedback Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments (mailto:cp_techpub_feedback@checkpoint.com?subject=feedback on Endpoint Security webrh Framework 3.0 HFA1 Administration Guide).

4 Contents Important Information... 3 Introduction... 6 About this Guide... 6 Who should read this guide?... 6 Related Documentation... 6 Introduction to Endpoint Security webrh... 8 About Endpoint Security webrh... 8 The Concept of Remote Help... 8 Users Must Be Authenticated... 8 Problem... 8 Solution... 9 Helpdesk Structure... 9 Benefits of Endpoint Security webrh... 9 End-User Products with webrh Function...10 Managing Endpoint Security webrh...11 Introduction to Managing Endpoint Security webrh...11 Endpoint Security webrh and Organizational Units...11 User Types...12 Primary Administration Tasks...12 Getting Started with Endpoint Security webrh...13 Working with Organizational Units (OUs)...14 Managing Authentication Tokens...17 Importing Token Information...19 Managing User Accounts...22 Configuring Endpoint Security webrh Settings...26 Managing Licenses...29 Changing Your Password...32 Working with Profiles Introduction to Profiles...33 Creating and Deploying webrh Profiles...33 General Instructions for Creating webrh Profiles...33 Downloading webrh Profiles...34 Pointsec PC Module Profiles...35 Pointsec PC 6 Module Profiles...39 Pointsec PC Linux Edition Module Profiles...41 Pointsec Protector Module Profiles...42 Pointsec Media Encryption Module Profiles...44 Pointsec Mobile Module Profiles...45 Remote Help Introduction...47 Verifying User Identities...47 Providing Remote Help...47 Pointsec PC Module Remote Help...48 Pointsec PC 6 Module Remote Help...49 Pointsec PC Linux Edition Module Remote Help...51 Pointsec Protector Module Remote Help...53 Pointsec Mobile Module Remote Help...54 Pointsec Media Encryption Module Remote Help...55 Removing Pointsec Mobile from Devices...55 Log Files in webrh Introduction...57 Viewing the Logs...57

5 Exporting Logs to Files...59 Deleting Logs...60 Configuring Logs...61 Token Information About Dynamic Tokens...62 Supported Token File Formats...62 Format Requirements for.csv Token Files...63 Format Specification...63 Examples...63 Index... 65

6 Chapter 1 Introduction Welcome to Endpoint Security webrh, a top-of-the range help management system for Endpoint Security products. Endpoint Security webrh enables you to help the endpoint users, from a central location, when they have forgotten their passwords or lost their dynamic tokens, so that they cannot access their encrypted devices. In This Chapter About this Guide 6 Who should read this guide? 6 Related Documentation 6 About this Guide This guide explains how to manage administrators and users in the Endpoint Security webrh framework, and how to use the Endpoint Security webrh modules to supply Remote Help. This guide contains: This introductory preface An introduction ("Introduction to Endpoint Security webrh" on page 8) to the concept of Remote Help, and an overview of Endpoint Security webrh Information on how to work with OUs ("Managing Endpoint Security webrh" on page 11) to manage groups of administrators and helpdesk staff, for example how to manage user accounts and tokens in Endpoint Security webrh, and how to configure general Endpoint Security webrh settings. Instructions on how to create profiles ("Working with Profiles" on page 33) for each module, and references to documents describing how to deploy profiles for each module. Descriptions on how to supply Remote Help ("Remote Help" on page 47) for different end-user products. For the Pointsec Mobile module, it is also described how to help users remove the software from their devices. Information on how to view, configure and delete logs ("Log Files in webrh" on page 57) in Endpoint Security webrh, and how to export logs to files. Descriptions of the tokens ("Token Information" on page 62) which administrators and helpdesk staff can use to authenticate themselves to Endpoint Security webrh. For example, information on the required format for the token files which can be imported, and what encryption methods are used for the encryption of the response mechanism used. Who should read this guide? Administrators at organizations that are installing, deploying and/or managing Endpoint Security webrh should read this guide. Related Documentation For the hardware and system requirements and the latest information on the Endpoint Security webrh framework, see the Endpoint Security webrh Release Notes. Page 6

7 Related Documentation For information on how to install Endpoint Security webrh, see the Endpoint Security webrh Installation Guide. Introduction Page 7

8 Chapter 2 Introduction to Endpoint Security webrh In This Chapter About Endpoint Security webrh 8 The Concept of Remote Help 8 Helpdesk Structure 9 Benefits of Endpoint Security webrh 9 End-User Products with webrh Function 10 Managing Endpoint Security webrh 11 About Endpoint Security webrh Remote Help is used to help users of Check Point s encryption solutions when they are unable to access their encrypted computers, PDAs or removable media devices. Endpoint Security webrh is a web-based Remote Help, which enables an organization s helpdesk department to use Internet technologies to provide Remote Help to all users within the organization. Note - Throughout this guide, when referring to all types of computers, PDAs or removable media devices using Endpoint Security webrh, the term "device" is used. The Concept of Remote Help Users Must Be Authenticated In the encryption solutions managed by Endpoint Security webrh, users must be authenticated before being granted access to their computers, PDAs or removable media devices. This authentication can be done using, for example, passwords or dynamic tokens. Problem The disadvantage of password and token authentication is that passwords can be forgotten and tokens can be lost or stolen. When this happens, a user cannot access the protected resource until the password is reset or a new dynamic token is issued. While this disadvantage of the authentication requirement may be an inconvenience for many systems, for users of Check Point encryption solutions, it is worse than that. For our users, a forgotten password or lost token means that he or she is unable to access his or her computer, PDA or removable media device. Of course, Check Point supplies a solution to this problem. Page 8

9 Solution Helpdesk Structure Remote Help is the answer to the problem of forgotten passwords and lost tokens. Remote Help enables an administrator or helpdesk staff, to grant the user access to a protected device without requiring the administrator's presence at that device. This Is How It Works There are many ways to implement Remote Help, but they always require two components: the client software, and the server software. For the user to gain access to a locked device, he or she must call the helpdesk to get support. Note - To supply Remote Help via Endpoint Security webrh, an Endpoint Security webrh profile must have been deployed onto the user's device; if the device becomes locked before such a profile has been deployed, another type of Remote Help has to be used. For example, if the end user is having problems accessing a device protected by Full Disk Encryption, you need to use the Full Disk Encryption management console to supply Remote Help. Once the identity of the user has been verified, he/she provides the helpdesk with information about the system, user name, and a challenge generated by the security product. The helpdesk staff enters this information into Endpoint Security webrh which generates a response for the user to enter into the device. Once this response has been entered, the system is unlocked and the user has access. This process of challenge and response is a proven method for providing secure authentication, and it is the principle behind one type of dynamic token authentication. By using Remote Help, helpdesk staff can provide the approval necessary to enable the user to either change a password or temporarily access the system (depending on the situation that prompted the Remote Help call, and on the security product used on the end-user device). Helpdesk Structure Endpoint Security webrh is the solution to the problem of updating helpdesk accounts stored within profiles. Endpoint Security webrh provides a hierarchical management structure for Remote Help providers (helpdesk staff). The hierarchical structure of Endpoint Security webrh enables global organizations to define support groups at physically disparate locations all within a single management framework. Using Organizational Units (OUs), an administrator can group helpdesk staff members together. The OUs can then be added to the profiles, allowing all members of that OU to provide Remote Help to users of protected devices. Since changing helpdesk staff only requires changing the OU membership, no changes are required on the computer, and no profile updates are needed for changes to helpdesk staff. If required, Endpoint Security webrh enables the creation of localized helpdesk groups, limiting their ability to provide support outside that location, while higher level groups can supplement the local groups to provide regional support covering multiple locations. Benefits of Endpoint Security webrh Implementing Endpoint Security webrh within an organization will provide many benefits, especially cost savings related to profile management. The following is a list of advantages offered by Endpoint Security webrh: Internet-based method for providing Remote Help Helpdesk staff can use a web browser from any network computer to provide Remote Help Secure two-factor authentication of authorized helpdesk staff and administrators combined with logging of Remote Help activity provides accountability and secure web-based password resets OU-based management for helpdesk staff Introduction to Endpoint Security webrh Page 9

10 End-User Products with webrh Function Only OU changes, not helpdesk staff changes, need to be deployed via profiles Helpdesk staff can only provide Remote Help, never access the local computer Helpdesk staff can be placed into groups to provide Remote Help globally, regionally or locally (3 OU levels) Your helpdesk can be staffed externally without requiring access to secured computers. End-User Products with webrh Function Endpoint Security webrh can be used to supply Remote Help to a number of Check Point products. To be able to supply Remote Help, you need to install the Endpoint Security webrh framework and the relevant Endpoint Security webrh modules, depending on what end-user products are used in your organization. The following table shows which webrh module should be used to supply Remote Help for each end-user product supported in Endpoint Security webrh: Table 2-1 Module related to end-user product To supply Remote Help for this product... Pointsec for PC 5.x Use this Endpoint Security webrh module: Pointsec PC Module Pointsec PC 6.x Full Disk Encryption for Windows Pointsec PC 6 Module Note - Pointsec PC 7 Module is also supported. Full Disk Encryption for Mac (version 3.1 or later) Pointsec PC Linux Edition Endpoint Security Media Encryption Pointsec Protector Disknet Pro Pointsec Mobile (all types, e.g. Pocket PC, Smartphone, Symbian OS S60) Pointsec Media Encryption File Encryption Pointsec PC Linux Edition Module Pointsec Protector Module Note - All the products using the Pointsec Protector module are different versions of the same product. The current name is Endpoint Security Media Encryption. Pointsec Mobile Module Pointsec Media Encryption Module Introduction to Endpoint Security webrh Page 10

11 Chapter 3 Managing Endpoint Security webrh In This Chapter Introduction to Managing Endpoint Security webrh 11 Endpoint Security webrh and Organizational Units 11 User Types 12 Primary Administration Tasks 12 Getting Started with Endpoint Security webrh 13 Working with Organizational Units (OUs) 14 Managing Authentication Tokens 17 Importing Token Information 19 Managing User Accounts 22 Configuring Endpoint Security webrh Settings 26 Managing Licenses 29 Changing Your Password 32 Introduction to Managing Endpoint Security webrh The primary purpose of Endpoint Security webrh is to provide hierarchical management for Remote Help. The following sections discuss Endpoint Security webrh and Organizational Units (OUs), administration tasks, getting started and working with OUs, tokens and user accounts. Note - For information on module settings, see the documentation delivered with the modules for which you plan to provide Remote Help via Endpoint Security webrh. Endpoint Security webrh and Organizational Units For creating a hierarchal framework, Endpoint Security webrh uses the concept of Organizational Units (OUs). In Endpoint Security webrh, an OU is a group of helpdesk staff that is related in some way. Some examples of usual relationships are geographical, language, and divisional. Available OU levels are: Global (top-level) Regional Local Page 11

12 Managing Endpoint Security webrh This picture illustrates the relationship between different OUs: User Types There are three types of user accounts for managing other accounts and supplying Remote Help: Type of user Description Administrators Helpdesk Self-help Administrators can create, edit and delete other accounts. They can also provide Remote Help to users of protected devices in their OU and all subordinate OUs. Initial administrators, who must be added during installation, by default have permission to provide Remote Help to all users in the organization, and to manage all administrator and helpdesk accounts. The initial administrator accounts can be edited by all global (top-level) administrators added later. Helpdesk users are associated with an OU and can provide Remote Help to all users of protected devices in that OU and all subordinate OUs. Helpdesk users cannot manage user accounts. Self-help users are used only if the self-help API is used. Ask your Check Point representative for more information. Primary Administration Tasks The primary Endpoint Security webrh administration tasks are as follows: Managing organizational unit (OU) groups Adding/deleting tokens for helpdesk staff and administrators Managing helpdesk staff and administrators Creating and deploying Endpoint Security webrh profiles to protected devices Reviewing and exporting log files. Introduction to Endpoint Security webrh Page 12

13 Getting Started with Endpoint Security webrh To log on and be authenticated: Managing Endpoint Security webrh 1. Start your browser and go to Endpoint Security webrh, for example: ( 2. Enter your user name and password, select the relevant domain, and click Log in. The Welcome page opens: You can access the administrative functions from the menu bar on the left of the screen. You can only access this web page if you have administrator rights. Note - By default, Endpoint Security webrh times out after 20 minutes. You can set a longer or shorter time or disable this function. Introduction to Endpoint Security webrh Page 13

14 Managing Endpoint Security webrh Working with Organizational Units (OUs) There are three different levels of OUs: global, regional and local. You can manage regional and local OUs directly. Regional OUs correspond to the second level while local OUs are the lowest level. Whenever an OU is created, it must be assigned to a parent OU; for example, a regional OU would be assigned to the global OU (chosen during installation), and a local OU would be assigned to a regional OU. Once created, an OU s properties cannot be edited - it can only be removed. This establishes the hierarchy in Endpoint Security webrh. Creating OUs To create an OU: 1. In the left-hand menu, click Organizational Units. The ADMINISTRATION - Organizational Units web page opens: 2. To create an OU, click Create. The following page opens: 3. Enter the OU name and select its hierarchy level: regional or local. The first OU that you enter must be a regional OU. Click Next. Introduction to Endpoint Security webrh Page 14

15 Managing Endpoint Security webrh The following web page opens: 4. Here you select the parent OU. If the group is regional, only the organization s top OU will be available. For a local group, all regional level OUs will be available. Click Save to create this OU. The following dialog box opens: 5. Click OK. Repeat these steps to create all OUs that are needed in your organization. Viewing OU Properties Viewing an OU allows you to see its properties, including members in the OU and all child OUs. To view an OU: 1. On the ADMINISTRATION - Organizational Units web page, click View. The following web page opens: 2. Click an OU to view its properties. Introduction to Endpoint Security webrh Page 15

16 Managing Endpoint Security webrh The OU s properties are displayed, for example: The following table explains the OU properties: Property Explanation Name OU Level Parent OU Accounts in the OU Name given to OU when it was created. Type of OU: Global, Regional or Local. OU immediately above the current one. Lists all accounts that are members of this OU. Accounts listed here will be able to provide Remote Help for any device in this OU or child OU. Clicking on the Edit link will open the Edit User page ("Managing User Accounts" on page 22). Deleting OUs Be careful when deleting an OU. All child OUs and accounts in and under the OU will also be deleted. Move any helpdesk accounts you want to keep to another OU before you delete the current OU. It is not possible to delete the Global OU. Introduction to Endpoint Security webrh Page 16

17 Managing Endpoint Security webrh To delete an OU: 1. On the ADMINISTRATION - Organizational Units web page, click Delete. The following web page opens, displaying all OUs: 2. Click on the name of the OU you want to delete. The following dialog box opens: 3. Click OK to remove the OU. Managing Authentication Tokens You can configure the helpdesk or administrator accounts to use dynamic tokens instead of passwords for authentication to Endpoint Security webrh. To do so, you need to create or import dynamic tokens into the Endpoint Security webrh database. The tokens can then be assigned to helpdesk staff or administrators, if they are to use a token to authenticate themselves to Endpoint Security webrh. Accessing Token Administration To access token administration: 1. On the left menu, click Tokens. The ADMINISTRATION - Tokens web page opens: Introduction to Endpoint Security webrh Page 17

18 Managing Endpoint Security webrh This is where you access pages on which you can create, import, view and delete token information. Creating Token Entries Before you start creating a token entry in Endpoint Security webrh, you must have the token programming information. This information must be entered correctly for the tokens to be used. To create token entries in Endpoint Security webrh: 1. On the ADMINISTRATION - Tokens web page, click Create. The following web page opens: 2. Enter the following token information: Table 3-2 Token information Field Explanation Serial Number Token Key Token Encryption Method Serial number or identifier of the physical token. We recommend that this name be unique, though this is not required. Key that has been programmed into the token. Select the encryption method used by the token. The method used to encrypt the response is determined by the token key length: Key length: 14 -> Encryption method: DES Key length: 42 -> Encryption method: 3DES Challenge Type Challenge Length Response Type Response Length Select the type of challenge to be generated by Endpoint Security webrh for entry into the token. Select the length of the challenge that Endpoint Security webrh will generate for entry into the token. Type of response that will be generated by the token for entry into Endpoint Security webrh. Length of the response the token will generate for entry into Endpoint Security webrh. 1. Click Save to create the token entry in Endpoint Security webrh. To ensure that you have entered the correct information and that the token is working, click Test Token ("Testing Tokens" on page 19). Introduction to Endpoint Security webrh Page 18

19 Managing Endpoint Security webrh Testing Tokens When creating a token entry in Endpoint Security webrh, you can test the token to ensure that the entry is correct and that the token is working. To test a token: 1. Click Test Token. The Token Test web page opens: 2. Endpoint Security webrh generates a challenge based on the token information you entered. Enter the challenge into the token and then enter the token s response in the Response field and click Test Token. A successful test will display Result OK. A failed test will display Result failed. 3. If the test was successful, close the web page, save the token entry and continue creating other token entries. If the test failed, check the information you entered for errors. Importing Token Information You can add tokens for authentication by importing token information. For more information on token information, see ("Token Information" on page 62). To import token information: 1. On the ADMINISTRATION - Tokens web page, click Import. The following web page opens: 2. Click Browse and browse to the file containing the token information. Enter the password for the file and click Next. Introduction to Endpoint Security webrh Page 19

20 Managing Endpoint Security webrh Note - The length of the password determines which method is used to encrypt the response: Password length: 14 -> Encryption method: DES The following dialog box opens: Password length: 42 -> Encryption method: 3DES 1. Click OK to continue. The following page opens: 2. Click Tokens to return to the main Tokens page. Viewing Token Entries Once a token has been entered, its properties cannot be edited. You can only view the token entry or remove it. The Tokens - View web page enables you to see all the tokens that have been entered into Endpoint Security webrh along with a summary of the token configurations (the key is not included). Introduction to Endpoint Security webrh Page 20

21 Managing Endpoint Security webrh To view all the token entries in Endpoint Security webrh: 1. On the ADMINISTRATION - Tokens web page, click View. All the tokens available in Endpoint Security webrh are displayed, for example: Deleting Token Entries Only global (top-level) administrators are permitted to delete tokens. If you delete a token entry, Endpoint Security webrh will no longer be able to authenticate the account associated with the token. The account must be associated with a new token to access Endpoint Security webrh. To delete a token entry: 1. On the ADMINISTRATION - Tokens web page, click Delete. The following web page opens: 2. All token entries are listed. Click Delete to remove a token entry. Introduction to Endpoint Security webrh Page 21

22 Managing Endpoint Security webrh The following dialog box opens: 3. Click OK to remove the token information from Endpoint Security webrh. Managing User Accounts To access Endpoint Security webrh, a user must have an Endpoint Security webrh account. The settings in the user s account control user rights and OU membership, which in turn determine which protected devices the user can provide Remote Help for. You manage user accounts by creating, editing and deleting them. Accessing Account Administration To access account administration: 1. On the left menu, click Accounts. The ADMINISTRATION - Accounts web page opens: Introduction to Endpoint Security webrh Page 22

23 Managing Endpoint Security webrh Creating User Accounts To create a user account: 1. On the ADMINISTRATION - Accounts web page, click Create. The following web page opens: 2. Enter the following information: Property Explanation User type Select the type of user account from the following options: Helpdesk user A user with this type of account can only provide Remote Help. No other administration is possible. Administrator A user with this type of account can access all Endpoint Security webrh functionality, including providing Remote Help, viewing the logs and accessing the Administration menu. Self help user This option is only available for accounts using the webrh local account login method. Self-help users are used only if the self-help API is used. Ask your Check Point representative for more information. Note - Both helpdesk users and administrators can exist either on global (top-level), regional or local OU level. For more information on how the OU affects the user, see "Organizational unit" on page 30. Introduction to Endpoint Security webrh Page 23

24 Managing Endpoint Security webrh Property Login method User name Organizational unit Start Date Expire Date Available Remote Help Modules Explanation From the drop-down list, select the type of logon for the account from the following options: Active Directory Account Select this option if the users should use their AD accounts to log on to Endpoint Security webrh. When you select this option, the following additional fields are shown: Object type Select if the account you are creating is a group or a single user account. Search button Click this button (below the User name field) to browse a list of available users or groups in the AD and select the relevant user or group. webrh local account When you select webrh local account, the following additional fields are shown: X9.9 Token Password In this field, enter the password which the user will use for authentication. Confirm Password In this field, re-enter the password to confirm it. User must change password at next logon Select this check-box if you want to make the user change his or her password the next time he or she authenticates to Endpoint Security webrh. In the Token field, select the serial number of the token. Only previously imported tokens are available here. If you want to add more tokens, see the Organizational unit property. The name which the user will enter to log on to Endpoint Security webrh. Click Example to view a list of examples of user account formats. OU in which the account exists. The user will be able to supply Remote Help to all protected devices in his or her OU and in all subordinate OUs. Administrators will also be able to manage all accounts in his or her OU and all subordinate OUs. address of the user. Date the account becomes active. Click Calendar to change the start date. Date the account expires. Click Calendar to change the expiry date. Select the modules for which the user should be allowed to perform Remote Help. 3. Click Save to create this account. Introduction to Endpoint Security webrh Page 24

25 Managing Endpoint Security webrh The following dialog box opens: 4. Click OK. Editing User Accounts You can edit all account properties, including the OU, expiration date and authentication information. To edit an existing user account: 1. On the ADMINISTRATION - Accounts web page, click Edit. The following web page opens: 2. Click Edit to access the properties in order to edit them. For explanations of the available fields, see ("Creating User Accounts" on page 23). 3. Click Save to save any changes you make to the user account. The following dialog box opens: 4. Click OK to confirm the changes. Deactivating and Deleting User Accounts Deleting an account permanently deletes the account but does not deactivate it. If deleted, a user account must be created again completely to allow the user access to Endpoint Security webrh. Note - Deleting a user account does not delete the token entry associated with the account. You cannot delete a user account which is currently logged on to Endpoint Security webrh. To deactivate a user account: 1. Set the expiry date to an earlier date (for example, yesterday). Introduction to Endpoint Security webrh Page 25

26 Managing Endpoint Security webrh To delete a user account: 1. On the ADMINISTRATION - Accounts web page, click Delete. The following web page opens: 2. Click Delete to remove the user account. The following dialog box opens: 3. Click OK to remove the account. Configuring Endpoint Security webrh Settings Note - Only top-level administrators are permitted to configure webrh settings. Introduction to Endpoint Security webrh Page 26

27 To configure Endpoint Security webrh settings: 1. On the left menu, click webrh Settings. The following web page opens: Managing Endpoint Security webrh The following properties are displayed: Table 3-3 Set or modify settings Property Explanation Minimum Password Length Minimum Password Age Maximum Password Age Password History Length Password Complexity Session Timeout Minimum length of a password. Minimum number of days between each change of password. Maximum number of days a password can be used until it must be changed. History length of previously used password, preventing old passwords from being reused. With this option selected, special complexity requirements are imposed on fixed passwords. See "Password Complexity" on page 35 for more information. Select to enable or disable the session timeout functionality. Introduction to Endpoint Security webrh Page 27

28 Managing Endpoint Security webrh Property Show logout timer Minutes Size of images in webrh Account Lockout Threshold Explanation Select to show or hide how much time remains before session timout. Specify how long a session should last without activity. Select to use normal or lightweight images in webrh. Lightweight displays fewer images. Use this setting to lock accounts after a specified number of failed attempts to log in to Endpoint Security webrh. You can set the number to 1, 2, 3, 6 or 12 attempts, or select "Do not lock accounts". Syslog Logging Protocol Server Address Server Port Message Prefix Time Zone Offset Use this setting to enable sending logs to the Syslog server. Important: On the Syslog server, the administator needs to open a UDP/TCP port for external logging. Select the communication protocol. Set the Syslog server IP address. Set the same UDP/TCP port defined on the Syslog server. The webrh server uses this port to send external communication to the Syslog server. Set a prefix that will be added to the webrh records in Syslog. Enter the time zone offset for the webrh server. The corresponding time of the webrh server will be time that appears in the time stamp in the Syslog records. If you have two webrh servers, for example, one in Washington DC (GMT -5:00) and another one in Minneapolis (GMT -6:00), set the following: 1. On the webrh server in Washington DC, set the time zone offset to -5:00 to see Washington DC time in the Syslog records received from the webrh server in Washington DC. 2. On the webrh server in Minneapolis, set the time zone offset to -6:00 to see Minneapolis time in the Syslog records received from the webrh server in Minneapolis. Error Facility Notice Facility Select the relevant Syslog error facility. Select the relevant Syslog notice facility. 2. Configure the settings as required and click Save. Click OK to confirm that you want to save the settings. Password Complexity You can apply strong complexity to fixed passwords to increase security. To apply password complexity: 1. Select the Password Complexity option to review the password requirements. Introduction to Endpoint Security webrh Page 28

29 Managing Endpoint Security webrh When the Password Complexity option is enabled, and Fixed Password is selected as the authentication method, you can access the Password Complexity dialog box from the Account - Create and Account - Edit pages. Click the Complexity Requirements link. The following information window opens: Managing Licenses To use your new Check Point product, you will need a license. Once you have obtained licenses from Check Point, you can import them into Endpoint Security webrh. Obtaining Check Point Licenses For information on how to obtain licenses from Check Point, please see the User Center ( Here you can sign in using your user credentials, or sign up for a user account which you need in order to access information on Check Point products and services. Once you have signed in, click Getting Started to learn about how to generate licenses and start taking advantage of the other User Center resources. Viewing Imported Licenses To view the imported licenses: 1. On the left menu, click Licenses. The following web page opens: Introduction to Endpoint Security webrh Page 29

30 Managing Endpoint Security webrh 2. Click View. A web page displaying the imported license(s) opens: Importing License Files You can import license files to be used with Endpoint Security webrh. To import a license file: 1. On the left menu, click Licenses. The following web page opens: Introduction to Endpoint Security webrh Page 30

31 Managing Endpoint Security webrh 2. Click Import. The following web page opens: 3. Select license type: Table 3-4 Select license type If you want to use a... Check Point license file Pointsec legacy license Do this: Select Check Point license file and browse to the file you want to import. Select Legacy license and enter the legacy Pointsec serial number. Click Next. A new page opens, informing you that the license was successfully imported: 4. To import another file, click Back in the message and repeat step 3. To view imported licenses, click View. Replacing an Old License If you want to replace an old license with a new one, simply import the new license ("Importing License Files" on page 30). Your software installation will then continue to function without interruption even when the old license becomes invalid. You cannot delete licenses, just add new ones. Introduction to Endpoint Security webrh Page 31

32 Managing Endpoint Security webrh Changing Your Password If you use a local webrh account (not your AD account) when authenticating to Endpoint Security webrh, you can easily change your password. Note - If you are an administrator, you can change other users passwords by editing their accounts. ("Editing User Accounts" on page 25) To change your password: 1. In the left-hand menu panel, click Change Password. Note - The Change Password menu item is only available if webrh local account" is the login method selected for your account. The change password page opens: 2. Enter the current password. 3. Enter the new password and confirm it. If the password does not comply with the complexity rules ("Password Complexity" on page 28), you will be informed of this. Click Save. Your password has now been changed. Introduction to Endpoint Security webrh Page 32

33 Chapter 4 Working with Profiles In This Chapter Introduction to Profiles 33 Creating and Deploying webrh Profiles 33 Introduction to Profiles This chapter explains how to create, configure and download Endpoint Security webrh profiles. To be able to provide users of encrypted devices with Remote Help using Endpoint Security webrh, you must create and deploy an Endpoint Security webrh profile onto the users devices. Depending on the webrh module used, the profile is either deployed directly onto the device or via the ordinary profile management tool for the encryption software. Once the Endpoint Security webrh profile has been deployed, helpdesk staff can provide Remote Help to users of those devices. Creating and Deploying webrh Profiles For most modules, you configure the settings when creating the profile. The exception is the Pointsec PC Module, where you configure the settings first, and then create the profile. After creating the profile, you must download it and then deploy it, either directly to the end-user device, or via a profile management tool used for the relevant end-user encryption product. General Instructions for Creating webrh Profiles This section describes the general procedure for initiating the creating of an Endpoint Security webrh profile. In the following sections, there is detailed information on each module. Note - For the Pointsec PC module, you must configure settings for the profile ("Pointsec PC Module Profiles" on page 35) first. Page 33

34 Creating and Deploying webrh Profiles To create a webrh profile: 1. From the left menu, click Profiles. The ADMINISTRATION - Profiles web page opens: 2. Click Create. The Module Selection web page opens, for example: Note - What modules are shown here depends on which ones have been installed. Downloading webrh Profiles Once you have created one or more webrh profiles, you must download them from the server in order to deploy them onto end-user devices. Working with Profiles Page 34

35 Creating and Deploying webrh Profiles To download a profile: 1. On the ADMINISTRATION - Profiles page, click Download. The Profiles - Download web page opens, for example: 2. All the webrh profiles you have created are displayed. Click Download for the relevant profile to download the profile to a local computer, and save it in a secure location. For details on how to create and deploy profiles for a specific module, see one of the following sections: Table 4-5 Where to find profile information per module To create and deploy the module for... Pointsec PC See this section: Pointsec PC ("Pointsec PC Module Profiles" on page 35) Pointsec PC 6 Pointsec PC Linux Edition Pointsec Protector Pointsec Mobile Pointsec Media Encryption Pointsec PC 6 ("Pointsec PC 6 Module Profiles" on page 39) Pointsec PC Linux Edition ("Pointsec PC Linux Edition Module Profiles" on page 41) Pointsec Protector ("Pointsec Protector Module Profiles" on page 42) Pointsec Mobile ("Pointsec Mobile Module Profiles" on page 45) Pointsec Media Encryption ("Pointsec Media Encryption Module Profiles" on page 44) Pointsec PC Module Profiles Configuring Pointsec PC Module Profiles This section explains how to configure the Pointsec PC Module response length and algorithm settings for Pointsec PC Module users. When you have configured settings, you can create a profile ("Creating Pointsec PC Module Profiles" on page 36). Working with Profiles Page 35

36 Creating and Deploying webrh Profiles To configure settings: 1. On the Endpoint Security webrh main page, from the left menu, select Module Settings and then click on Pointsec PC. The MODULE SETTINGS - Pointsec PC Module page opens: You can configure the following settings: Table 4-6 Configurable settings Setting Explanation Response length default value Select the level of security you want to use when Endpoint Security webrh generates a response. Response length changeable Select if it should be possible to change the response length when: Providing Remote Help Creating a profile Available algorithms Select which algorithm(s) should be available when creating a profile. 1. When you have configured the settings you require, click Save. When prompted, click OK to confirm that you want to save the settings. The settings are used when creating profiles ("Creating Pointsec PC Module Profiles" on page 36) and when providing Remote Help ("Remote Help" on page 47). Creating Pointsec PC Module Profiles The following section explains how to create a webrh profile for the Pointsec PC Module. To create a webrh profile: 1. From the left menu, click Profiles. The ADMINISTRATION - Profiles web page opens. 2. Click Create. The Module Selection web page opens. Working with Profiles Page 36

37 3. Select Pointsec PC. The available Pointsec PC Module settings are displayed: Creating and Deploying webrh Profiles 4. Enter the following information to create the profile: Table 4-7 Enter information to create profile Field Explanation Organizational Unit Algorithm Response length Profile name Authentication information Specify which organizational unit to include in the profile. When this profile is used, it will be possible to supply Remote Help to client computers within the specified OU and its sub-ous only. Specify which algorithm is to be used in the channel/response procedure when this profile is used. Specify the response length to be used in the channel/response procedure when this profile is used. Enter the name of the profile being created. This will be used for the file name. Name: Enter a user name to be used when opening this profile in the Pointsec Admin program. This is useful if you want to merge this Endpoint Security webrh profile with the ordinary Pointsec PC profile before deploying on the client computers. Password: Enter the password to be used when opening this profile in the Pointsec Admin program. Working with Profiles Page 37

38 Creating and Deploying webrh Profiles Field Explanation Confirm Password: Confirm the password. Profile password Password: Enter the password which is used when the profile is downloaded automatically directly to the client computers. The same password must be set in the Pointsec PC profile deployed on the client computers. If the same password is not set in both this webrh profile and in Pointsec PC, the webrh profile will not be deployed. For more information, see the Endpoint Security webrh Administrator s Guide. Confirm Password: Confirm the password Pointsec PC Serial No Enter the Pointsec PC serial number for the computers on which you will deploy this profile. 5. Once you have entered the information, click Create. The following dialog box opens: 6. Click OK to create the profile. Another page opens, informing you that the profile was successfully created and stored in the database. 7. Click Download to download and save the profile ("Downloading webrh Profiles" on page 34). The next step is to deploy the profile to Pointsec PC-protected workstations. Deploying Pointsec PC Module Profiles Once you have created a webrh profile for the Pointsec PC Module, you can deploy it to Pointsec PCprotected workstations. Deploying the webrh profile entails downloading it from the Endpoint Security webrh database and placing it in the Pointsec PC work directory. To deploy the Endpoint Security webrh profile: 1. On the workstation where you want to deploy the webrh profile, copy it to the Pointsec PC work directory. The default location for the Work directory is: Program Files\Pointsec\Pointsec for PC\Work. Note - Ensure that the Pointsec PC Management Console is not running on the workstation when you place the profile in the Work directory. If the Management Console is running, the profile may not be deployed correctly. Pointsec PC automatically deploys the profile and removes it from the Work directory. Note - To ensure that the profile has been deployed correctly, you can start the Pointsec PC Management Console and check that the WEBRH group has been added. Note - If a profile has not been successfully deployed, you must create a new profile in Endpoint Security webrh and deploy it again. You cannot reuse profiles. 2. Repeat step 1 on every Pointsec PC-protected workstation on which you want to deploy the profile. Working with Profiles Page 38

39 Creating and Deploying webrh Profiles Once deployed, users can receive one-time logon and remote password change help from helpdesk staff and Pointsec PC administrators using Endpoint Security webrh. Pointsec PC 6 Module Profiles About Pointsec PC 6 Module profiles Pointsec PC 6 module profiles are used to supply Remote Help to the following end-user products: Pointsec PC 6 Full Disk Encryption for Windows Full Disk Encryption for Mac Creating Pointsec PC 6 Module Profiles The following section explains how to create a webrh profile for the Pointsec PC 6 module. Note - You can only use the webrh profile to update an existing Pointsec PC 6 or Full Disk Encryption profile on the end-users computers. To create a webrh profile: 1. From the left menu, click Profiles. The ADMINISTRATION - Profiles web page opens. 2. Click Create. The Module Selection web page opens. 3. Click Pointsec PC 6. The following web page opens: 4. Enter the following information to create the profile: Table 4-8 Enter Profile Information Field Organizational Unit Challenge length Explanation Specify which organizational unit to include in the profile. Set the length of the challenge to be generated when providing Remote Help. Default value: Do not set Minimum value: 10 character challenge Maximum value: 20 character challenge Working with Profiles Page 39

40 Creating and Deploying webrh Profiles Field Group authority level Explanation Set the group authority level required when deploying this profile. Nine is the highest group authority level, and zero is the lowest. For more information on group authority levels, please see the Endpoint Security webrh 6 Administrator s Guide. Profile version Select the version of Endpoint Security webrh 6 for which you want to create a profile. For Full Disk Encryption for Windows and for Full Disk Encryption for Mac, use profile version Profile name Profile password Enter the name of the profile being created. This will be used for the file name. Enter the profile password. This password must be the same as the update validation password in the Endpoint Security webrh 6 or Full Disk Encryption profile already deployed on the device. Otherwise, the webrh profile will not be deployed. Note - After changing the update validation password on a client machine, a new webrh profile containing the new password must be deployed to that machine, too. Confirm password Confirm the password. 5. Once you have entered the information, click Create. The following dialog box opens: 6. Click OK to create the profile. Another page opens, informing you that the profile was successfully created and stored in the database. 7. Download ("Downloading webrh Profiles" on page 34) and save the profile. The next step is to deploy the profile to Endpoint Security webrh-protected workstations. Deploying Pointsec PC 6 Module Profiles Once you have created and downloaded a webrh profile, you can deploy it to Pointsec PC 6 or Full Disk Encryption-protected workstations as an update profile. How to deploy update profiles is described in the Administrator s Guide for the relevant product (Pointsec PC 6, Full Disk Encryption for Windows or Full Disk Encryption for Mac). Note - To ensure that the profile has been deployed correctly, you can start the Pointsec PC 6 or Full Disk Encryption Management Console and check that the WEBRH group has been added. Working with Profiles Page 40

41 Creating and Deploying webrh Profiles Note - If a profile has not been successfully deployed, you must create a new profile in Endpoint Security webrh and deploy it again. You cannot reuse profiles. Once the profile has been deployed on end-user computers, users can receive one-time logon and remote password change help from helpdesk staff and administrators using Endpoint Security webrh. Pointsec PC Linux Edition Module Profiles Creating Pointsec PC Linux Edition Module Profiles This section describes how to create a webrh profile for the Pointsec PC Linux Edition module. 1. From the left menu, click Profiles. The ADMINISTRATION - Profiles web page opens. 2. Click Create. The Module Selection web page opens. 3. Click Pointsec PC Linux Edition. The following web page opens: 4. Enter the following information to create the profile: Table 4-9 Create a profile Field Organizational Unit Profile Name Password Confirm Password Explanation Specify which OU (and parent OUs) to add to the profile. The name of the profile being created. This will be used for the file name. Enter the password that is used to open the profile. Confirm the password 5. Once you have entered the information, click Create. The following dialog box opens: Working with Profiles Page 41

42 Creating and Deploying webrh Profiles 6. Click OK to create the profile. The following page opens: 7. Click Download to download and save ("Downloading webrh Profiles" on page 34) the profile. Deploying Pointsec PC Linux Edition Module Profiles Once you have created and downloaded the webrh profile for the Pointsec PC Linux Edition Module, you must deploy it onto end users computers as an update profile. For information on how to do this, please see the Pointsec PC Linux Edition Administrator s Guide. Pointsec Protector Module Profiles About Pointsec Protector Module profiles Pointsec Protector module profiles are used to supply Remote Help to the following end-user products: Endpoint Security Media Encryption Pointsec Protector Disknet Pro Note - All the products using the Pointsec Protector module are different versions of the same product. The current name is Endpoint Security Media Encryption. Creating Pointsec Protector Module Profiles The following section explains how to create a webrh profile for the Pointsec Protector Module. To create a webrh profile: 1. From the left menu, click Profiles. The ADMINISTRATION - Profiles web page opens. 2. Click Create. The Module Selection web page opens. Working with Profiles Page 42

43 Creating and Deploying webrh Profiles 3. Click Pointsec Protector. The following web page opens: 4. Enter the following information to create the profile: Table 4-10 Enter Profile Information Field Organizational Unit Profile name Profile password Confirm password Explanation Specify which organizational unit to include in the profile. Enter the name of the profile being created. This will be used for the file name. Enter the profile password. Confirm the password 5. Once you have entered the information, click Create. The following dialog box opens: 6. Click OK to create the webrh profile. Another page opens, informing you that the profile was successfully created and stored in the database. 7. Click Download to download and save the profile ("Downloading webrh Profiles" on page 34). The next step is to deploy the webrh profile to Pointsec Protector-protected workstations. Deploying Pointsec Protector Module Profiles This section describes how to deploy a webrh profile for the Pointsec Protector module to end-user computers. To deploy a Pointsec Protector profile: 1. Import the webrh profile for the Pointsec Protector Module into the Pointsec Protector Administration Console when creating an ordinary Pointsec Protector profile. 2. Deploy the ordinary Pointsec Protector profile, containing the webrh profile, onto end-user workstations. Once this has been done, users can receive Remote Help from helpdesk staff and Endpoint Security webrh administrators using Endpoint Security webrh. Working with Profiles Page 43

44 Pointsec Media Encryption Module Profiles Creating Pointsec Media Encryption Module Profiles To create a profile: 1. From the left menu, click Profiles. The ADMINISTRATION - Profiles web page opens. 2. Click Create. The Module Selection web page opens. 3. Click Pointsec Media Encryption. The following web page opens: Creating and Deploying webrh Profiles 4. Enter the following information to create the profile: Table 4-11 Create profile Field Organizational Unit Profile Name Password Confirm password Explanation Specify which OU (and parent OUs) to add to the profile. The name of the profile being created. This will be used for the file name. Enter the password that will be used when importing the profile into the Pointsec PC Linux Edition profile in Pointsec Administration Console. Confirm the password 5. Once you have entered the information, click Create. The following dialog box opens: 6. Click OK to create the profile. The profile is saved in the database. 7. Click Download to download the profile ("Downloading webrh Profiles" on page 34) and save it to a secure location. Deploying Pointsec Media Encryption Module Profiles Once the Pointsec Media Encryption Module profile has been downloaded and saved to a safe location, it must be imported into a Pointsec Media Encryption profile in Pointsec Administration Console. Working with Profiles Page 44

45 Creating and Deploying webrh Profiles In order for webrh to function on the clients, the webrh profile must be imported into all Pointsec Media Encryption update profiles. Note - Always start the creation of an update profile from the current installation profile, to be certain that no settings are overwritten. For more information on update profiles and Pointsec Administration Console, see the Pointsec Media Encryption Administrator s Guide. Pointsec Mobile Module Profiles Creating Pointsec Mobile Module Profiles The following section explains how to create a webrh profile for the Pointsec Mobile module. To create a webrh profile: 1. From the left menu, click Profiles. The ADMINISRATON - Profiles web page opens. 2. Click Create. The Module Selection web page opens. 3. Click Pointsec Mobile. The following web page opens: 4. Enter the following information to create the profile: Table 4-12 Create a profile Field Organizational Unit Profile Name Password Confirm Password Explanation Specify which OU (and parent OUs) to add to the profile. The name of the profile being created. This will be used for the file name. Enter the password that is used to authenticate and open the profile. Confirm the password Working with Profiles Page 45

46 5. Once you have entered the information, click Create. The following dialog box opens: Creating and Deploying webrh Profiles 6. Click OK to create the profile. The following page opens: 7. Click Download to download and save the profile ("Downloading webrh Profiles" on page 34). Deploying Pointsec Mobile Module Profiles Once the webrh profile has been downloaded and saved to a secure location, it must be imported into a Pointsec Mobile profile for PDAs or smartphones in Pointsec Administration Console, the administration tool used for deploying ordinary Pointsec Mobile profiles. To enable the administrator to provide users of PDAs and smartphones with Remote Help via Endpoint Security webrh, the webrh profile must be imported into all PDA and smartphone update profiles. Note - Always start the creation of an update profile from the current installation profile, to be certain that no settings are overwritten. For more information on update profiles administrated via Pointsec Administration Console, see the documentation accompanying the relevant Pointsec Mobile product for PDAs or smartphones. Working with Profiles Page 46

47 Chapter 5 Remote Help In This Chapter Introduction 47 Verifying User Identities 47 Providing Remote Help 47 Removing Pointsec Mobile from Devices 55 Introduction This chapter suggests ways of verifying users and explains how to provide Remote Help to end-users. Verifying User Identities Before you provide Remote Help to a user, you must be sure that the user is actually authorized to access the computer. You can do this in a number of ways, for example: Use predetermined questions and answers that only legitimate users have access to Keep a list of sample questions to ask, such as the user s name and favorite color, partner s middle name, brand of car, etc. Some of the questions could have randomized, fixed answers, for example, when asked about his/her favorite pet, the user could answer "clouds", not "cat". Store the questions and answers in a separate database that is accessible to all Remote Help administrators. Use voice verification software Use security software to extract unique vocal characteristics of the caller and compare them with the user s recorded voiceprint. Providing Remote Help Depending which encryption product the end-user is using, you can provide different kinds of help. For this reason, the section is divided into sub-sections describing the help procedure for each Endpoint Security webrh module. See the relevant section, depending on which end-user product the user needs help to access: Table 5-13 Where to find information on how to supply Remote Help Module for which you want to supply Remote Help Pointsec PC ("Pointsec PC Module Remote Help" on page 48) Pointsec PC 6 ("Pointsec PC 6 Module Remote Help" on page 49) Pointsec PC Linux Edition ("Pointsec PC Linux Edition Module Remote Help" on page 51) Page 47

48 Providing Remote Help Module for which you want to supply Remote Help Pointsec Protector ("Pointsec Protector Module Remote Help" on page 53) Pointsec Mobile ("Pointsec Mobile Module Remote Help" on page 54) Pointsec Media Encryption ("Pointsec Media Encryption Module Remote Help" on page 55) Pointsec PC Module Remote Help For the Pointsec PC module, two types of Remote Help are available: Remote Password Change for users who have forgotten their fixed passwords One Time Logon for users who usually use dynamic tokens or smart cards but do not have access to them at the moment. To provide Remote Help to users of Pointsec PC: 1. Once you have verified that the user is legitimate, log on to Endpoint Security webrh and select Remote Help. 2. If you have more than one Pointsec module installed in Endpoint Security webrh, a list of products for which you can provide Remote Help is displayed. Select Pointsec PC. The REMOTE HELP- Pointsec PC page opens: 3. Enter the following information: Table 5-14 Enter Remote Help information Field User name: Challenge Algorithm Explanation Enter the name of the account the user is using. Ask the user for the challenge displayed on his or her computer, and enter it here. Select type of encryption algorithm to be used for encryption of the response. Remote Help Page 48

49 Providing Remote Help Field Response Remote Password Change One-time Login Explanation If allowed in your Pointsec PC Module webrh profile, enter the length of the response Endpoint Security \webrh will generate. Select this option for users who have forgotten their fixed passwords. Select this option for users who usually use dynamic passwords or smart cards but do not have access to them at the moment. 4. Click Get Response. A response is generated: 5. Read the response to the user, and ask the user to enter it into the Response field. Ensure that the user successfully changes his or her password or gains one-time access to the computer before ending the Remote Help session. Pointsec PC 6 Module Remote Help You can provide the following types of Remote Help to users of workstations protected by Pointsec PC 6 and Full Disk Encryption: Remote Password Change for users who have forgotten their fixed passwords One Time Logon for users who usually use dynamic passwords or smart cards but do not have access to them at the moment. To provide Remote Help to users of Pointsec PC 6 or Full Disk Encryption: 1. Once you have verified that the user is legitimate, log on to Endpoint Security webrh and select Remote Help. Remote Help Page 49

50 Providing Remote Help 2. If you have more than one Pointsec module installed in Endpoint Security webrh, a list of products for which you can provide Remote Help is displayed. Select Pointsec PC 6. The REMOTE HELP- Pointsec PC 6 Module page opens: 3. Enter the following information: Table 5-15 Remote Help Information Field Explanation Type of end-user assistance: End-user account name: Select the type of Remote Help required: Remote password change - for users who have forgotten their fixed passwords One-time logon - for users who usually use dynamic passwords or smart cards but do not have access to them at the moment. Enter the name of the account the user is using. 4. Click Get Response. Response One is generated: 5. Read Response One to the user and then ask the user to enter it into the Response One field and press the Tab button. Remote Help Page 50

51 Providing Remote Help 6. Endpoint Security webrh generates a challenge. Ask the user to read you the challenge. Enter the challenge and click Get Response. Endpoint Security webrh generates and displays Response Two: 7. Read Response Two to the user. Ensure that the user successfully changes his or her password or gains one-time access to the computer before ending the Remote Help session. Pointsec PC Linux Edition Module Remote Help There are two types of Remote Help available for the Pointsec PC Linux Edition module: Remote Password Change for users who have forgotten their fixed passwords One Time Logon for users who usually use dynamic tokens or smart cards but do not have access to them at the moment. To provide Remote Help to users of Pointsec PC Linux Edition: 1. Verify that the user is legitimate. Log on to Endpoint Security webrh and select Remote Help. The Remote Help web page opens. 2. Click Pointsec PC Linux Edition. The challenge page opens: 3. Enter the following information: Remote Help Page 51

52 Providing Remote Help Table 5-16 Remote Help Information Field Type of end-user assistance: Explanation Select the type of Remote Help required: Remote password change - for users who have forgotten their fixed passwords One-time logon - for users who usually use dynamic passwords but do not have access to them at the moment. End-user account name: Enter the name of the account the user is using. 4. Click Get Response. Response One is generated: 5. Read Response One to the user and then ask the user to enter it into the Response One field and press the Tab button. 6. Endpoint Security \webrh generates a challenge. Ask the user to read you the challenge. Enter the challenge and click Get Response. Endpoint Security webrh generates and displays Response Two: 7. Read Response Two to the user. Ensure that the user successfully changes his or her password or gains one-time access to the computer before ending the Remote Help session. Remote Help Page 52

53 Providing Remote Help Pointsec Protector Module Remote Help To provide Remote Help to users of Pointsec Protector: 1. Verify that the user is legitimate. Log on to Endpoint Security webrh and select Remote Help. 2. Click Pointsec Protector. The challenge page opens: 3. Enter the user name of the media owner and the challenge generated by Endpoint Security \webrh. Click Get Response. Endpoint Security \webrh generates and displays the response: 4. Read the response to the user. Tip - Use the phonetic alphabet when reading out the response to the user. When reading the response to the user, it is often a great help to use the phonetic alphabet to avoid mistakes or confusion. The Pointsec Protector module makes this easier for you; simply select the relevant language in the drop-down list, and the letters in the response will be displayed as words according to the selected phonetic alphabet. Remote Help Page 53

54 Providing Remote Help For example, if you select English, the response will be displayed like this: Ensure that the user successfully accesses his or her device before ending the Remote Help session. Pointsec Mobile Module Remote Help With the Pointsec Mobile module, you can not only supply Remote Help to unlock users devices when they have become locked. You can also help users remove Pointsec Mobile from their devices, if allowed by the profile deployed on the device. This section describes how to unlock devices. See also the section on how to help users remove Pointsec Mobile ("Removing Pointsec Mobile from Devices" on page 55). To provide Remote Help to a user of a Pointsec Mobile device: 1. Verify that the user is legitimate. Log on to Endpoint Security webrh and select Remote Help. Click Pointsec Mobile. Remote Help Page 54

55 Removing Pointsec Mobile from Devices The challenge page opens: 2. Select Unlock Device/card, enter the challenge generated by Pointsec Mobile and click Get Response. Endpoint Security webrh generates and displays the response. 3. Read the response to the user. Ensure that the user successfully accesses his or her device and changes the password before ending the Remote Help session. Pointsec Media Encryption Module Remote Help To provide Remote Help for users of Pointsec Media Encryption: 1. Verify that the user is legitimate. Log on to Endpoint Security webrh and select Remote Help. Click Pointsec Media Encryption. The challenge page opens: 2. Enter the challenge generated by Pointsec Media Encryption and click Get Response. Endpoint Security webrh generates and displays the response. 3. Read the response to the user. Ensure that the users successfully access their devices and change their passwords before ending the Remote Help session. Removing Pointsec Mobile from Devices With Pointsec Mobile module, you can also help users remove Pointsec Mobile from their devices, if allowed by the profile deployed on the device. Remote Help Page 55

56 Removing Pointsec Mobile from Devices To help a user to remove Pointsec Mobile from a device: 1. Verify that the user is legitimate ("Verifying User Identities" on page 47). 2. Ask the user to initiate removal of the Pointsec Mobile product installed on his or her device. See the documentation accompanying the relevant product for more information. 3. Log on to Endpoint Security webrh and select Remote Help. The following web page opens: 4. Click Pointsec Mobile. The challenge page opens: 5. Select Remove Pointsec, enter the challenge generated by the device and click Get Response. Endpoint Security webrh generates and displays the response. 6. Ask the user to enter the response into the device and tap OK. Pointsec Mobile decrypts the information on the device and removes itself from the device. Remote Help Page 56

57 Chapter 6 Log Files in webrh In This Chapter Introduction 57 Viewing the Logs 57 Exporting Logs to Files 59 Deleting Logs 60 Configuring Logs 61 Introduction A general requirement in any security product is the ability to log the actions of users in the system. Endpoint Security Endpoint Security webrh logs Remote Help events and allows administrators to export the log files to comma-delimited text files for further analysis. This means that your organization can track the actions of helpdesk staff, establishing an audit trail that can be added to other centralized auditing systems. You can also configure Endpoint Security webrh internal errors that are stored in the Windows Event Viewer and user actions stored in the webrh database to be sent to the Syslog Server. See Configuring Endpoint Security webrh Settings (on page 26). Syslog Limitations Log messages will not be buffered on the webrh server. This means that if the Syslog server is down or not available for any reason, all log messages will be lost. Pointsec for PC 5 Module Settings: log messages for these settings will not be generated due to end of life of this release. Viewing the Logs All administrators - global, regional and local - can view logs. Page 57

58 Viewing the Logs To view the log: 1. From the left menu, click Logs. The ADMINISTRATION - Logs web page opens: 2. Click View. The Logs - View web page opens, for example: Log Files in webrh Page 58

59 Exporting Logs to Files 3. Select the type and range of view you want and click View. This web page shows detailed information about actions recorded by Endpoint Security webrh. Categories include the date and time of an action, the action itself, the user account associated with the action and the OU the account belongs to. By default, 100 log entries are displayed per page. Exporting Logs to Files Only global and regional administrators can export logs. Log Files in webrh Page 59

60 Deleting Logs To export the log: 1. On the ADMINISTRATION - Logs page, click Export. The Logs - Export web page: 2. Select the type of export you want and click Export. 3. In the File Download dialog box, select Save this file to disk. Choose where to store the Endpoint Security webrh log file and click Save. When the information has been exported, a new entry is created in the log stating that the log was successfully exported and who exported it. Deleting Logs Only global (top-level) administrators can delete logs. To delete logs: 1. On the ADMINISTRATION - Logs page, click Delete. The following page opens: 2. Select the type of deletion to perform and click Delete. 3. In the dialog box which opens, click OK to confirm that you want to delete the specified logs. When the deletion is complete, an entry in the log will be created stating who performed the deletion and what type of deletion it was. Log Files in webrh Page 60

61 Configuring Logs Configuring Logs Only global (top-level) administrators can configure logs. To configure logs: 1. On the ADMINISTRATION - Logs page, click Configure. The following page opens: All selected actions on this web page will create a log entry in the database when the event occurs. 2. Select and deselect the options to modify the actions logged. Click Save to save your changes. Log Files in webrh Page 61