Specops Password Reset

Transcription

1 Specops Software. All right reserved. For more information about Specops Password Reset and other Specops products, visit

2 Copyright and Trademarks Specops Password Reset is a trademark owned by Specops Software. All other trademarks used and mentioned in this document belong to their respective owners. 2

3 Contents Key components 7 Administrator configurations 7 Helpdesk operations 7 End-user experience 7 Specops Password Reset Configuration Tool 8 Domains 8 settings 10 Helpdesk settings 11 License 12 Specops Password Reset Web Customization Tool 13 Themes 14 Languages 16 Group Policy Snap-In 18 Create a Specops Password Reset GPO 18 Applying policy settings 19 Policy settings 20 Configuring the Client from the Administrative Template 29 Specops Password Reset Helpdesk Tool 30 User Information 30 Password Reset 30 3

4 User Statistics 31 Specops Password Reset Reporting Tool 32 Enrollment Statistics 32 Reset Statistics 32 All Users 32 License Statistics 32 Refresh statistics 32 Database file 32 Specops Password Client 33 Enrollment process 33 Resetting your password 34 Changing your password 34 Modifying the user attributes used by the system 35 Appendix A: Delegated Helpdesk Security Configuration 40 Delegated Helpdesk security configuration 41 4

5 About this guide This guide is intended for administrators who are responsible for managing user accounts in their Microsoft Active Directory environment. Before you perform the tasks in this guide, please ensure you have correctly installed Specops Password Reset. You can find the Specops Password Reset Installation Guide at 5

6 About Specops Password Reset Specops Password Reset is a self-service solution that enables end users to address the most common tasks related to password management including forgotten passwords, locked out Active Directory accounts and password resets and changes. Specops Password Reset is a component of the Specops Password Management suite. Specops Password Management takes a holistic approach to password management that increases security, cuts costs, and extends the reach of password-based security. You can learn more about the Specops Password Management solution and other Specops Password related products 6

7 Key components Specops Password Reset can be configured from any computer in the domain where the Specops Password Reset Administration Tool are installed. The administration tools can be used to configure different aspects of the product. Administrator configurations Specops Password Reset Configuration tool: Manages system wide configuration settings for each Specops Password Reset Server. Specops Password Reset Web Customization tool: Manages branding and text customization of the Specops Password Reset on web servers. Group Policy snap-in: Manages Specops Password Reset Settings including how users are allowed to use the system. Helpdesk operations Specops Password Reset Helpdesk tool: Manages password related helpdesk operations. Can be used to verify the identity of the user, set a new password for the user, and view user statistics. Specops Password Reset Reporting tool: Tracks your enrollment process and provides reports on enrolled users, system utilization, and license utilization. End-user experience Specops Password Client: The Specops Password Client presents a link to the Specops Password Reset Web application on the Windows logon screen, and presents end user notifications about enrollment requirements. 7

8 Specops Password Reset Configuration tool The Specops Password Reset Configuration tool is used to control system wide settings for each Specops Password Reset Server. Domains Specops Password Reset Servers can only serve requests from domain which have been configured for use through the Specops Password Reset Configuration tool. You can use the Domains tab to perform the following tasks: Configure New Domain Edit Selected Domain Configuration Configure a new domain This option allows you to enable a new domain. Using the system with multiple domains requires a bi-directional trust between the additional domains and the domain where the Specops Password Reset Server is located. 1. From the Specops Password Reset Configuration tool, select Domains, and click Configure New Domain. 2. From the list of available domains, select the domain you want to add. 3. Click OK. 8

9 Edit domain configuration settings 1. From the Specops Password Reset Configuration tool, select Domains, and click Edit Selected Domain Configuration. 2. In the Domain Friendly Name field enter the name of the domain you want presented to users. Note: The name of the domain will be visible to the users during enrollment, password changes, and password reset operations. If the value is left blank, the FQDN name of the domain will be shown to the user instead. 3. Select the Scope of Management. The Scope of Management is the root in Active Directory where the Password Reset Service will be used. 4. Select Enable Challenge Question in Helpdesk to allow helpdesk users to see the secret questions for enrolled users to verify the identity of a calling user. The default behavior is not enabled. 5. Select Hide Users Mobile Number to hide the mobile number of users from all web pages. Note: In some environments, depending on security standards, you may want to hide the mobile number from the users. 6. Select Restrict access to caller s domain to restrict access to user data in other domains for administrators using the helpdesk or reporting pages in Specops Password Reset Web. 7. If you changed the scope of management to a higher level in your Active Directory hierarchy, click Delegate Security to assign the necessary permissions for your service account to the new Scope of Management. You can use the below table to verify whether the necessary permissions have been applied to the Specops Password Reset Server service: Permission Create and Delete Read Change and Reset password Unlock account Change password at next logon List child objects Read and Write Scope classstore objects beneath user objects useraccountcontrol attribute on user objects msds-user-account-control-computed attribute on user objects User objects User objects User objects User objects Mobile attribute on user objects 9

10 settings You can change the server settings using the Configuration tool. The settings are used when the Specops Password Reset Server sends s to users. Edit settings 1. From the Specops Password Reset Configuration Tool, select Settings, and click Edit. 2. Specify the FQDN or IP-address of your SMTP server in the SMTP Server Name text field. 3. Specify a non-standard port to connect to the server in the SMTP Port Number field. 4. Optionally, you can configure more advanced settings: Enable TSL Security Use Custom SMTP Credentials Note: You can use custom credentials if you not want to use the service account of the Specops Password Reset server for sending Enter the address that will be used to send in the Sender Address field. 6. Enter the sender display name in the Sender Display name field. This is the name that will appear in the Enter the address that will be receive license expiration s in the License reminder address. Note: License reminders are sent to administrators to report license compliance issues such as nearing or exceeding the allowed license count. 10

11 Helpdesk settings To configure the settings for mobile verification messages, you must use a third-party SMS service provider. This will generate an SMS verification code that will be used to authenticate users who request password resets through the helpdesk. Edit Mobile Verification Settings 1. From the Specops Password Reset Configuration Tool, select Helpdesk Settings, and click Edit. 2. In the From text field, enter the address that will be used to send the validation message. 3. Configure the To , Subject, and Body settings according to the specifications of your SMS provider. 4. From the Insert placeholder code drop box you can select the information that will be different for each user. 5. Click OK. 11

12 License You can use the Specops Password Reset Configuration Tool to view license information and update your license key. You will be required to add more licenses if you have added additional users or if you have upgraded the product to a new major version in accordance with your Support and Maintenance agreement. 12

13 Specops Password Reset Web Customization tool The Specops Password Reset Web application contains a customization tool which gives you control over the Specops Password Reset end user interface. The customization tool can be used to customize the following: Graphical appearance of the user interface by modifying the theme. Text used in the product by editing the selected language. 13

14 Themes The graphical elements on the Specops Password Reset web pages, such as images, colors, and fonts can be modified using the theme editor. Set current theme The Set Current Theme button will make the selected theme the active theme in the web application. 1. From the Specops Password Reset Web Customization tool, select an available theme. 2. Click Set Current Theme. Add new theme You can create new themes using the Add New Theme button. 1. From the Specops Password Reset Web Customization tool, click Add New Theme. 2. Select a theme template using the drop-box. 3. Enter a theme name and click OK. Edit theme The Edit Theme button will launch the theme editor and allow you to modify an existing theme. 1. From the Specops Password Reset Web Customization tool, click Edit Theme. 2. To modify the text display elements, click the Theme Path link. The text display elements are contained in the cascading style sheets. You can edit the style sheets in any text editor. 3. The theme folder contains the following style sheets: Style Sheet Default.css HelpDesk.css MasterPage.css Reporting.css Wizard.css Where it is used Reset, Change, and Enrollment pages Helpdesk pages Master pages Reporting pages Wizard elements on the Reset, Change, and Enrollment pages. 4. Import the following graphic elements: Element Size Where it is used Wizard background 800x600 pixels Background image on the Reset, Change, and Enrollment pages. Wizard top left logo 128x109 pixels The logo image used on the Reset, Change, and Enrollment pages. 14

15 Helpdesk top left logo 128x109 pixels ID card logo seen on the main page of the Helpdesk tool. Helpdesk logo 381x109 pixels The header image used in the Helpdesk tool. Note: 5. Click OK. Specops Password Reset uses the PNG and GIF format for product graphics. All the graphics used in the theme can be found in the Images folder in each theme folder. 15

16 Languages You can use the Specops Password Reset Web Customization tool to manage the languages that the product is translated into. Edit selected language You can use the language editor to change any string used on the Specops Password Reset web pages. The strings are divided into tabs depending on where they are used in the system. The text fields support HTML, including HTML links for further customization. 1. From the Specops Password Reset Web Customization tool, select an available language. 2. Click Edit Selected Language. 3. Select a string. 4. Double-click the text you want to change. Warning: Some of the strings contain placeholders, such as {0}, to variables retrieved by the Specops Password Reset server, such as the mobile telephone number from the user object. 5. Once you have made the necessary changes, click OK. 6. Restart the web site application pool to apply the changes. Note: This can be done through the IIS manager on the web server. 16

17 Add new language You can add new languages to Specops Password Reset. All strings for the new language must be entered manually in the language editor. 1. From the Specops Password Reset Web customization tool, click Add New Language. 2. Select the language you want to add, and click OK. 3. Use the language editor to add the text for the new language. 17

18 Group Policy snap-in The Group Policy snap-in, installed with the Administration Tools, allows you to create and manage Specops Password Reset settings in group policy objects. These settings are stored as a part of the GPO. Managing SPR settings in Group Policy allows you to control how and where the policies are applied. Create a Specops Password Reset GPO 1. In the GPMC, expand your domain node and locate the Group Policy Objects node. 2. Right click on the GPO node, and select New. 3. Enter a name for the Group Policy Object, and click OK. 18

19 Applying policy settings Specops Password Reset settings will apply to all user accounts in locations where your GPO is linked. If more than one GPO is linked on the same level, the link order of the GPOs determine the order the GPOs will be processed. If conflicting settings from multiple GPO s apply to a user, Group Policy will resolve the conflict. Group Policy Objects are applied in the following order; the GPO closest to the user object in AD will have the highest precedence. Local Group Policy Objects Note: Specops Password Reset settings cannot be created on this level. Site linked Group Policy Objects Domain linked Group Policy Objects OU linked Group Policy Objects If the above order does not enable you to apply your preferred settings, you can use security filtering, to control on a permission level, which users and computers will be affected by the GPO. Security filtering allows you to apply different policy settings to objects located on the same level in Active Directory. 19

20 Policy settings Group policy settings determine how the system should behave when accessed by a user. The Specops Password Reset Server queries Active Directory to determine which settings to use for each visiting user. General You can configure the following items from the General tab. Enrollment options These settings control the authentication method users affected by the policy should use: Secret Questions Mobile Verification Code Both You can also prompt the user for their current password before starting the enrollment wizard. Prompting the user for their current password is a good security practice. 20

21 Locked account options You can use the locked account options to: Allow locked user account to use the password reset service: If you enable this box alone, the user can reset their password and their account will be automatically unlocked. Allow users to unlock their account without resetting their password: If you enable this box, the user can unlock their account and choose not to change their password. Enrollment Enforcing You can use the Enrollment Enforcing settings to control how you want your users to enroll. The Reminder Mode setting allows you to configure the type of reminders you want your users to receive. Balloon tip: Reminder balloon tip that pops up from the taskbar tray. Clicking the reminder will take the user directly to the enrollment web page. This is the default setting in Specops Password Reset. Start browser: This setting causes the reminder to open a browser window with the enrollment web page. Start unclosable fullscreen browser: This setting causes the reminder to open a full screen browser window with the enrollment web page which cannot be closed until the enrollment has been completed. You can configure the reminder to appear only user logon, or during user logon and at regular intervals during the day. You can manage the intervals using the Specops Password Reset Administrative Template. See Configure Specops Password Client from the Administrative Template for more information. 21

22 Secret Questions The Secret Question tab allows you to edit the secret questions used in the GPO. You can configure the following items from the Secret Questions tab. 22

23 Secret Question Settings The following settings control the requirements on how users are allowed to select and answer the questions in the GPO. Number of questions: The number of questions users are required to answer when they authenticate using the secret questions mechanism. You must have more than the configured number of questions available in the policy in order for users to be able to meet this requirement. Number of allowed custom questions: Controls the number of custom questions the user is allowed to user. Custom question answer min length: If custom questions are allowed, this value controls the minimum length of the answers to the custom questions. Lockout threshold: Number of failed password attempts allowed before locking the user out from Password Reset. When the user exceeds the configured number of attempts the system will invalidate the enrollment information, preventing the user from using the system until a new enrollment has been created. Allow identical answers: Allows users to use the same answer to more than one question in the question series. Case sensitive answers: Requires users to provide answers to questions using the same case as when they enrolled. Edit Questions Specops Password Reset contains a selection of questions and language translations that can be made available to users affected by the GPO. The questions can be imported using the Import Questions button. You can also manually create new questions using the Add new Question button. If you have manually created new questions, you will have to provide your own translations. If you want to provide translations for your questions you can add more language translations using the Edit Languages button. Mobile Verification Code If Use Mobile Verification code is enabled, you can use the Mobile Verification code tab to configure how the system should connect to your SMS service provider. 23

24 Verification Code Message The Specops Password Reset Server uses these settings to create an message, which will be sent to the SMS provider, and converted to an SMS message which the user will receive. Most of these settings are controlled by the SMS service provider. The below placeholders are evaluated by the Specops Password Reset Server service. %MobileNumber%: Contains the mobile number retrieved by Specops Password Reset from the user object of the target user in Active Directory. %Code%: Contains the mobile verification code generated by the Specops Password Reset. The code is only valid for use from the same session against the web server that it was requested from. % %: Contains the address retrieved by Specops Password Reset from the user object of the target user in Active Directory. Mobile Verification Settings You can control how the mobile verification code is used by users affected by the GPO. 24

25 Bypass if mobile number missing: This option is only available if you Use Both mobile verification and secret questions is enabled. If this option is selected, mobile verification codes will only be used for those users that have a mobile number configured in Active Directory. For others, the step will be bypassed. Allow users to enter mobile number when enrolling: This option is only available if Use Mobile Verification code is enabled. If this option is selected, users without a registered mobile number in Active Directory will be asked to enroll in the system by registering their mobile number. Require verification of mobile phone number: This option is only available if allow users to enter mobile number when enrolling is enabled. If this option is selected, users will have to verify that they have enrolled with the correct mobile number by receiving and responding with a verification code during the enrollment process. 25

26 Notifications When certain system events occur, such as a user enrolling with the system, Specops Password Reset has the ability to generate and send s to end users to confirm that the operation was successful. Event notification settings can be managed using the Notifications tab. The text fields support HTML, including HTML links for further customization. Server Settings These settings can be used to override the server configuration specified during the installation of the Specops Password Reset Server component. This is useful in scenarios where you want a specific part of the organization to use a specific SMTP server. Events Specops Password Reset can send notification for the following events: 26

27 Password Reset by user: This event triggers every time a user resets their password through Specops Password Reset. By default, a confirmation is sent to the user with details about the reset operation. Password Reset from helpdesk: This event triggers when the Specops Password Reset Helpdesk tool is used to reset the password of a user. No s are configured by default for this event. User has enrolled: This event triggers when a user successfully completes the enrollment process in Specops Password Reset. By default, a confirmation is sent to the user with details about the enrollment operation. User account locked out from Specops Password Reset: This event triggers when a user has exceeded the allowed number of attempts to answer the secret questions correctly. No s are configured by default for this event. Account unlocked: This event triggers when a user unlocks their account through Specops Password Reset. No s are configured by default for this event. Enrollment reminder: This event triggers during the daily enrollment status check if the system discovers a user who has not yet enrolled. No s are configured by default for this event, but it is strongly recommended to add a customized reminder that will be sent to the user. 27

28 Custom Wizard Messages The settings in the Custom Wizard Messages tab allows you to create your own custom message to be displayed to the end users when they have successfully completed an enrollment, password change/reset operation. The custom message you create can either be appended to the default message or used to replace the default message entirely. 28

29 Configuring the Client from the Administrative Template The Specops ureset Client can be configured using the administrative template in the Group Policy Management Console. 1. Open the GPMC and navigate to the GPO you want to edit. 2. Right click on the GPO and select Edit 3. In the Group Policy Management Editor dialog box, expand Computer Configuration, Policies, Administrative Templates, and click Specops ureset Client. 4. Double-click the setting you want to configure. Note: If you are an existing Specops Password Reset customer and testing Specops ureset, Prefer SPR over ureset must be enabled in the General ureset client settings. 5. Make the desired changed, and click OK. If you configure the settings, it is recommended to create a Central Store for Group Policy Administrative Templates and add the Specops Password Reset Administrative template. Create a Central Store for Group Policy Administrative Templates The Central Store for Administrative Templates allows you to store all template files in a single location on SYSVOL where they can be accessed and presented on any server from your domain. To create a Central Store for Group Policy Administrative Templates, copy the Specops ureset Client ADMX/ADML files from %windir%policydefinitions. The ADMX should be copied to: \<domainfqdn>sysvol<domainfqdn>policiespolicydefinitions The ADML should be copied to: \<domainfqdn>sysvol<domainfqdn>policiespolicydefinitionsen-us For more information about the Central Store and best practices, visit: 29

30 Specops Password Reset Helpdesk tool The Helpdesk tool can be used to, verify the accounts of users who call the helpdesk with password related problems, set a new password for the user, and view user statistics. The Helpdesk tool is available to users who are members of the Specops Password Helpdesk Admins local security group or have been delegated specific permissions. For more information about delegation, see Appendix 1: Delegated Helpdesk security configuration. User Information Selecting a user account from the Helpdesk tool will open the User Information tab. From the User Information tab, you can view general information about the user, view enrollment status, and force the user to reenroll. Verify the user 1. From the Specops Password Reset Helpdesk tool search for and select a user. 2. If a mobile phone number is configured for your user, you will have the option to click Send code to send a one-time verification code to the mobile phone. The user should repeat the code they received. The code should match the code that was sent. 3. If the challenge question in helpdesk is configured for your user, the last secret question the user enrolled with is presented to the helpdesk. Repeat the question to the user. Enter their answer and click Verify answer. Force reenrollment The Force Reenrollment button can be used to invalidate an existing enrollment, and force the user to reenroll the user to reenroll with the system. Password Reset Once the helpdesk has verified the identity of the caller, a new password can be set for the user from the Password Reset tab. Set a new password for the user 1. From the Specops Password Reset Helpdesk tool search for and select a user. 2. Select the Password Reset tab. 3. You will have the following options: Click Generate Password to automatically create a complex password that matches the password policy of the user. This will put the new password in the New Password Text field. OR 30

31 Create and enter a new password in the New Password text field. 4. Click Reset Password to commit the change in Active Directory. 5. Click Send Password to send the new password in an SMS text message to the user. The user must have a mobile device on file. Note: It is best practice to enable the User much change password at next logon checkbox. User Statistics You can view individual statistics for each user from the User Statistics tab. The User Statistics tab displays the full history of system usage for each user, allowing you to identify if the user is using the system appropriately. If a user has performed an excessive amounts of reset, it may be worthwhile to further educate the user about password reset best practices. 31

32 Specops Password Reset Reporting tool The Specops Password Reset Reporting tool allows you to track your enrollment process and provides several reports. The reporting page is only accessible to members of the Specops Password Reporting Admin, and Specops Password Reporting Readers local security groups on the Specops Password Reset Server. A link to the reporting page will be available in the start menu of any machine where the Administration Tools are installed. Enrollment Statistics The Enrollment Statistics tab shows an overview of the enrollment status for the configured GPOs in your environment. This page can be used to determine if a specific policy is being adapted or whether it is triggering users getting locked out of the system. Reset Statistics The Reset Statistics tab shows an overview of the system usage. This can show you how well the system is working. The Reset Statistics tab also displays the number of text messages sent from the system. If your SMS service provider only allows a certain number of credits per month, this will help ensure that you do not run out of credits. All Users The All Users tab shows the enrollment information for each individual user. You can export the report data to a CSV format for further processing. Note: The Export All button will export enrollment information for all users. License Statistics The license statistics tab shows an overview of your current license information. You can use this tab to ensure that you do not exceed the allowed license count. - Refresh statistics You can refresh the statistics by clicking the Initiate new user count button. Database file The reporting statistics gathered by Specops Password Reset are stored in an SQL Server Compact database. The database file can be found at the following location on the Specops Password Reset Server: %ProgramData%\Specopssoft\Specops Password Reset\SPRReporting.sdf 32

33 Specops Password Client The Specops Password Client integrates Specops Password Reset and the Windows client computers. When Specops Password Reset Policy is enabled, the Specops Password Client presents a link to the Specops Password Reset web application on the logon screen. In addition, when a user is logged into the system, the Specops Password Client provides notifications about enrollment requirements to the logon user. Enrollment process The enrollment process is required when using secret question authentication. Secret question authentication requires users to enroll with the system by selecting and answering one or more questions from a pool of available questions configured for them in Group Policy. If you only want to use mobile verification, you do not need to enroll using secret question authentication. Specops Password Reset contains several notification options to remind users to enroll and encourage self-service. The notification method is controlled through GPO settings, with the default setting being the system tray notification balloon tip in the system tray. For more information, read Enrollment Options and Best Practices. Mobile verification enrollment When the user follows the notification link to the enrollment page, the enrollment process is started. 1. Enter your user name. 2. Click Next. 3. Enter your mobile number. 4. If your administrator requires you to verify your mobile phone number, click Send Code. a. Enter the code you received on your device into the enrollment page. 5. Click Next. 6. Click Finish. Secret question enrollment When the user follows the notification link to the enrollment page, the enrollment process is started. 1. From the Password Reset Enrollment page, select your preferred language for the enrollment from the drop-box. Note: Only the languages configured for the user through the GPO will be available. 33

34 The selected language will override any language selection made when the user wants to reset their password. 2. If required by the administrator, enter your current password in the text field. 3. Click Next. 4. Select a question from the list and answer the question. 5. Click Next. 6. Repeat steps 4 and 5 until you have fulfilled the number of answered questions all the required questions. 7. Click Finish. Resetting your password 1. Enter your user name in the Password Reset page, and click Next. 2. If you enrolled using Secret Questions, you will need to: a. Enter the answer to your secret question, and click next. b. Repeat (a) until you have answered all the questions. c. Enter your new password, and click Finish. Resetting with your mobile device If you enrolled using Mobile Verification, you will need to: a. Click Send Code. b. Enter the code you received on your device into the Specops Password Reset web page or mobile app. c. Enter your new password, and click Finish. Changing your password 1. From the change password page, select your preferred language. 2. Enter your user name. 3. Enter your current password. 4. Click Next. 5. Enter and confirm your new password, and click Finish. 34

35 Modifying the user attributes used by the system The Specops Password Reset Server uses data from user objects in Active Directory to read and write information used in the system. You can control which attributes are used by the system by modifying the registry on the Specops Password Reset Server. Session data and mobile verification code attributes During the password reset process, the session data, such as the session ID and the mobile verification code, is stored in the specops-spp-pwdreset object beneath the user object in Active Directory. If your organization only uses the mobile verification code mechanism, the creation of the sub object can be prevented by configuring the Specops Password Reset Server to use custom user attributes instead of the sub object when storing the session data. These settings are controlled in the registry on the Specops Password Reset server: Registry key HKLM\Software\Specopssoft\Specops Password Reset\Server\Domains\ [domain_name] UseCustomAttributesForVerificationCode HKLM\Software\Specopssoft\Specops Password Reset\Server\Domains\ [domain_name] CustomAttributeSessionId HKLM\Software\Specopssoft\Specops Password Reset\Server\Domains\ [domain_name] CustomAttributeVerificationCode Description Enables the use of custom attributes for session data. If the value is set to 1 the custom attribute setting will be enabled. If the value is set to 0 the sub object will be used to hold session data. Default value: 0 LDAP display name for the arbitrary user string attribute you wish to hold the session ID. Default value: LDAP display name for the arbitrary user string attribute you wish to hold the mobile verification code. Default value: Run the following command to grant the SPR service account permission to read and write the attributes chosen above: 35

36 dsacls [DN_of_your_scope_of_management] /I:T /G [spr_service_account]:rpwp;[your_selected_sessionid_attribute];user dsacls [DN_of_your_scope_of_management] /I:T /G [spr_service_account]:rpwp;[your_selected_verification_code_attribute];user Example: dsacls OU=Example,DC=example,DC=com /I:T /G example\sprsvc :RPWP;carLicense;user dsacls OU=Example,DC=example,DC=com /I:T /G example\sprsvc :RPWP;assistant;user The Specops Password Reset Server service should be restarted after this configuration has applied. address and mobile phone attributes By default the Specops Password Reset Server retrieves the address of the user from the mail attribute. The mobile phone number of the user is retrieved from the mobile attribute. You can change the settings to other attributes on the user object: Registry key HKLM\Software\Specopssoft\Specops Password Reset\Server\Domains\ [domain_name] CustomAttribut HKLM\Software\Specopssoft\Specops Password Reset\Server\Domains\ [domain_name] CustomAttributeMobile HKLM\Software\Specopssoft\Specops Password Reset\Server\Domains\ [domain_name] CustomAttributeVerificationCode Description Enables the use of a custom attribute for address data if configured with a value. The specific value should match an attribute on the user object. Default: Enables the use of a custom attribute for mobile phone number if configured with a value. The specific value should match an attribute on the user object. Default: LDAP display name for the arbitrary user string attribute you wish to hold the mobile verification code. Default value: Run the following command to grant the SPR service account permission to read and write the attributes chosen above: 36

37 dsacls [DN_of_your_scope_of_management] /I:S /G [spr_service_account]:rpwp;[your_selected_ _attribute];user dsacls [DN_of_your_scope_of_management] /I:S /G [spr_service_account]:rpwp;[your_selected_mobile_phone_attribute];user Example: dsacls OU=Example,DC=example,DC=com /I:S /G example\sprsvc :RPWP;carLicense;user dsacls OU=Example,DC=example,DC=com /I:S /G example\sprsvc :RPWP;assistant;user The Specops Password Reset Server service should be restarted after this configuration has applied. If the mobile attribute has been changes, the password client should be configured to use the custom attribute. This is controlled through the Specops Password Reset ADMX template and the User object custom mobile attribute setting. Specops Password Reset Server call throttling To prevent attackers from systematically probing the system for user names, the Specops Password Reset Server service automatically restricts the number of attempts a client may make to use the service within a specified sliding time window. The sliding windows begins counting as soon as the first invalid request is detected and adds new requests when a new invalid attempt is detected. When the sliding time windows for a request has elapsed, the request will be available for use with the service. To change these settings, you will need to modify the following registry keys: Registry key HKLM\Software\Specopssoft\Specops Password Reset\Server\ CallThrottlingMaxCalls HKLM\Software\Specopssoft\Specops Password Reset\Server\ Description Specifies the maximum number of calls permitted from a single client during the specified sliding time window. When the number is exceeded, the server will deny the request and generate an error message. Default value: 200 Specifies the size of the sliding windows measured in seconds. CallThrottlingTimeWindowSeconds 37

38 Default value: 300 (5 minutes) Other Specops Password Reset Server registry settings Registry key Description HKLM\Software\Specopssoft\Specops Password Reset\Server\ Databasefilepath HKLM\Software\Specopssoft\Specops Password Reset\Server\ HelpdeskMaximumNumberOfUsersDisplayed HKLM\Software\Specopssoft\Specops Password Reset\Server\ IgnoreParenthesisContentInPhoneNumbers HKLM\Software\Specopssoft\Specops Password Reset\Server\ LogFilePath HKLM\Software\Specopssoft\Specops Password Reset\Server\ PollingTime HKLM\Software\Specopssoft\Specops Password Reset\Server\ SearchPageSize HKLM\Software\Specopssoft\Specops Password Reset\Server\ SendVerificationCode Using7bitencoding Changes the location of the Specops Password Reset Reporting database. Default value: blank Controls the maximum number of user records to display in the Helpdesk tool. This setting is useful in large environments. Default value: 500 This setting forces the Specops Password Reset server to ignore any digits entered between parenthesis characters in the mobile number. Default value: 0 Changes the location of the Specops Password Reset Server debug log file. Default value: C:\PasswordResetServer.log Controls the time of day the daily user count and enrollment reminder process starts. Default value: 00:00 Controls the page size of searchers for users in the Helpdesk tool. Default value: 1000 Specifies that 7-bit encoding should be used in the s sent to the SMS provider. Useful when a provider does not support modern encoding formats. Default value = 0 38

39 HKLM\Software\Specopssoft\Specops Password Reset\Server\ UseComplexMobileVerificationCode HKLM\Software\Specopssoft\Specops Password Reset\Server\ DefaultLanguage HKLM\Software\Specopssoft\Specops Password Reset\Server\ UseOnlyDefaultLanguage HKLM\Software\Specopssoft\Specops Password Reset\Server\ UseDelegatedHelpdeskSecurity Specifies that the mobile verification code should be generated in a complex format. This setting can be disabled by changing the value to 0. Turning off the complexity causes a four digit pin code to be used as the mobile verification code. Default value = 1 Changes the default language of the server. Changing this setting also overrides any user language preference. The value should match the name of the language file on the web server. Default value = blank. Enables the default language as the only language used in Specops Password Reset. Enabling this setting removes the language selection dropdown list from the Specops Password Reset web pages. You must configure a default language for this setting to work. Default value = 0 Enables the delegated security model in the helpdesk. If the value is set to 1 the delegated security model will be enabled. If set to 0 the trusted subsystem security model will be used. Default value: 0 39

40 Appendix A: Delegated Helpdesk security configuration Specops Software. All right reserved. For more information about Specops Password Reset and other Specops products, visit

41 Delegated Helpdesk security configuration The Specops Password Reset Helpdesk tool can be configured to use either of the following security models: Trusted subsystem model: When using the trusted subsystem model, access to the Helpdesk is controlled through the membership of the local security group Specops Password Helpdesk Admins on the Specops Password Reset Server. Users allowed to access the Helpdesk can reset the password of any user within the configured scope of management in the configured domains. Delegated security model: When using the delegated security model, all server operations are performed in the security context of the user accessing the web page. This is useful in environment where the ability to reset passwords has been delegated to Helpdesk personnel. The delegated security model allows detailed logging and tracking of user activities in the system, and can be used to provide granular control over who is allowed to reset which password. The Helpdesk tool uses the trusted subsystem security model by default. Specops Password Reset should be configured to use the model which best suits the security needs of your organization. Configure the Helpdesk tool to use the delegated security model To use the delegated security model, you need to complete the below configuration steps: 1. Configure the SPR server computer account to be trusted for delegation: a. From Active Directory Users and Computers, browse to the computer account. b. Right-click on the computer account, and select Properties. c. Select the Delegation tab. d. Enable Trust this computer for delegation to any service (Kerberos only), and click OK. 2. Configure the SPR service user account to be trusted for delegation: a. From Active Directory Users and Computers, browse to the service account. b. Right-click on the service account, and select Properties. c. Select the Account tab. d. Verify that Account is sensitive and cannot be delegated is not enabled from the Account options list. e. Select the Delegation tab. f. Enable Trust this user for delegation to any service (Kerberos only). g. Click OK. 3. Create a folder for logfiles and enable Full Control permissions for Specops Password Helpdesk Admins group. h. On the Specops Password Reset Server, create a new folder (e.g. C:\logfiles\PasswordReset). 41

42 i. Right-click on the folder, and select Properties. j. From the security tab, click Edit. k. Click Add to add the Specops Password Helpdesk Admins group. l. Click Locations. m. Select the top node, and click OK. n. Click Advanced. o. Click Find Now. p. Select Specops Password Helpdesk Admins from the search results, and click OK. q. Click OK. r. Verify that the Specops Password Helpdesk Admins group is selected, and enable Full Control permissions for Specops Password Helpdesk Admins. s. Click OK. 4. Update the logfile path in the registry. t. Open the Registry Editor. u. Edit the following value to allow the SPR Server to write the trace file to the directory where the SPR Helpdesk Admins have permissions: i. Navigate to HKLM\Software\Specopssoft\Specops Password Reset\Server\LogFilePath. ii. In the Value data field, enter the path you created in 3a. C:\logfiles\PasswordReset\PasswordResetServer.log iii. Click OK. v. Edit the following value to enable tracing. i. Navigate to HKLM\Software\Specopssoft\Specops Password Reset\Server\Debug. ii. In the Value data field, enter 3. iii. Click OK. 5. Restart the SPR Server Service. 6. Grant the Act as part of the operating system privilege to the SPR service account. The privilege can be assigned either using a Domain Group Policy Object or using the Local Security Policy tool. If you are using a GPO to assign the privilege, the setting can be found in Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. If you are using the Local Security Policy you need to complete the following steps: a. Open Local Security Policy on the SPR server. b. Expand the following items: Security settings, Local Policies, and click User Rights Assignment. c. Double-click the Act as part of the operating system policy. d. Click Add User or Group. e. Add the SPR service account to the policy, and click OK. 42

43 f. Click OK. 7. Enable the delegated security model in the Helpdesk tool. The delegated security model is enabled by modifying the following registry entry for the Specops Password Reset Server. Registry key HKLM\Software\Specopssoft\Specops Password Reset\Server\ UseDelegatedHelpdeskSecurity Description Enables the delegated security model in the helpdesk. If the value is set to 1 the delegated security model will be enabled. If set to 0 the trusted subsystem security model will be used. Default value: 0 8. Allow users to write events to the Application log on the SPR server. You will need to create the following registry entry on the Specops Password Reset Server: Registry key HKLM\SYSTEM\CurrentControlSet\ Services\EventLog\Application\ CustomSD (REG_SZ) Value O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007 ;;;SY)(A ;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S )(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;BU) 9. Optional: If your organization is using fine-grained password policies, grant Helpdesk personnel read permissions to fine-grained password policies. If fine-grained password policies are used in the domain, you will need to grant the Helpdesk personnel read permission to see the correct password rules in the Helpdesk tool. a. Log on to a domain controller with an account that has Domain Admin permissions in the domain. b. Run the following command from a command prompt: dsacls CN=Password Settings Container,CN=System,[domain_DN] /I:S /G [group_name]:rp;;msds-passwordsettings Example: dsacls CN=Password Settings Container,CN=System,DC=example,DC=com /I:S /G example\helpdesk Staff :RP;;msDS-PasswordSettings 43

44 Support For helpful tips and solutions for troubleshooting the product, find the Specops Password Reset Troubleshooting Guide from Online We recommend submitting your case directly on our website at: Telephone International Monday - Friday: 09:00-17:00 CET North America SPECOPS ( ) Monday - Friday: 09:00-17:00 EST Specops Software. All right reserved. For more information about Specops Password Reset and other Specops products, visit