KRMC Cloud Pro User Manual Version 4

Transcription

1 KRMC Cloud Pro User Manual Version 4 Copyright 2018, All Rights Reserved.

2 Notices and Information NOTICES AND INFORMATION Please be aware of the following points before using the Kanguru Remote Management Console Copyright 2018 Kanguru Solutions. All rights reserved. Windows Vista, Windows 7, Windows 8.1, Windows 10 and.net Framework are registered trademarks of Microsoft Inc. All other brands or product names are trademarks of their respective companies or organizations. Kanguru Solutions will not be held responsible for any illegal use of this product nor any losses incurred while using this product. The user himself is responsible for the copyright laws, and is fully responsible for any illegal actions taken. Customer Service To obtain service or technical support for your system, please contact Kanguru Solutions Technical Support Department at , or visit for web support. Legal notice In no event shall Kanguru Solutions liability exceed the price paid for the product from direct, indirect, special, incidental, or consequential software, or its documentation. Kanguru Solutions offers no refunds for its products. Kanguru Solutions makes no warranty or representation, expressed, implied, or statutory, with respect to its products or the contents or use of this documentation and all accompanying software, and specifically disclaims its quality, performance, merchantability, or fitness for any particular purpose. Kanguru Solutions reserves the right to revise or update its products, software, or documentation without obligation to notify any individual or entity. Export Law Compliance Regardless of any disclosure made to Kanguru Solutions pertaining to the ultimate destination of the specific Kanguru product, you warrant that you will not export, directly or indirectly, any Kanguru product without first obtaining the approval of Kanguru Solutions and the appropriate export license from the Department of Commerce or other agency of the United States Government. Kanguru Solutions has a wide range of products and each product family has different license requirements relative to exports. 2

3 End User License Agreement End User License Agreement This legal document is an agreement between you, the end user ( Licensee ), and Kanguru Solutions, a division of Interactive Media Corporation ( Licensor ). By and using this software, you are consenting to be bound by the terms of this agreement, which includes the disclaimer of warranty. This agreement constitutes the complete agreement between you and licensor. If you do not agree to the terms of this agreement, cease to use the product immediately. DISCLAIMER OF WARRANTIES The software as a service is provided on an AS IS basis, without warranty of any kind, including without limitation the warranties of merchantability, fitness for a particular purpose, and noninfringement. The entire risk as to the results and performance of the software is assumed by you, the Licensee. If the software is defective, you, and not Licensor or any distributor, agent or employee of Licensor assumes the entire cost of all necessary servicing, repair, or correction. LIMITATION OF DAMAGES In no event shall Licensor, or anyone else who has been involved in the creation, distribution, or delivery of this product be liable for any direct, indirect, special, punitive, exemplary, consequential or incidental damages (including but not limited to damages for loss of business profits, business interruption, loss of business information, and the like) arising out of the use or inability to use such product even if Licensor has been advised of the possibility of such damages. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. COPYRIGHT RESTRICTIONS This software and any accompanying materials are copyrighted. Unauthorized copying of this software or of any of the textual materials accompanying it is expressly forbidden. You may not modify, adapt, translate, reverse engineer, decompile, disassemble (except to the extent applicable laws specifically prohibit such restriction), or create derivative works based on the software. EXPORT RESTRICTIONS You agree that you will not export the software to any country, person or entity subject to U.S. export restrictions. 3

4 End User License Agreement ENTIRE AGREEMENT This written End User License Agreement is the exclusive agreement between you and Licensor concerning the software as a service and supersedes any and all prior oral or written agreements, negotiations or other dealings between us concerning the software. This License Agreement may be modified only by a writing signed by you and Licensor. This agreement is subject to the laws and jurisdiction of the courts of the Commonwealth of Massachusetts, USA. If a court of competent jurisdiction invalidates one or more of the terms of this contract, the surviving terms continue in force. This License Agreement is effective upon the use of the software as a service. 4

5 Table of Contents TABLE OF CONTENTS Notices and Information... 2 End User License Agreement Introduction Main Features of KRMC Cloud Pro KRMC Cloud Version 4 Improvements System Requirements Getting to Know KRMC Cloud Pro Logging into KRMC Cloud Pro Logging in with a registered address SAML Login Logging in with 2 Factor Authentication Logging In for the First Time (Super Admin only) Components of KRMC Cloud Pro Filtering and Sorting Lists Navigation Menu Main Pages Navigation Sub-Menus Log Out Change Password Events Bar Home Page Notifications Area Customizable Charts Account Information Devices Page Users List Creating New Users and Groups Create a New User Create a New Group Device List Device Activity List Edit Device Info Add Action Reprovision Codes Delete Device Deactivate Device Reactivating a Device

6 Table of Contents 8. Actions Page Pending Actions Tab Successful Actions Tab Failed Actions Tab Create Global Action Tab Users Page Admins Tab Edit or Delete Admins Edit Permissions View Groups / Users / Devices Users Tab Set Provision Profile for User Edit or Delete User Groups Tab Edit Groups Add Group Action Delete Group Licenses Page Summary Tab Licenses Tab Parking Licenses Tab Orders Tab Settings Page Global Provision Profile Tab Administrator Settings Tab (Super Admin only) Event Bar Options Tab Notification Options Tab Administrative Password Tab (Super Admin only) Server Settings Tab Charts/Reports Page Technical Support Appendix A : Description of Remote Actions Appendix B: Description of Reports Appendix C: KRMC License Management Appendix D: Integrating KRMC with Microsoft AD FS

7 Introduction 1. Introduction Thank you for using the Kanguru Remote Management Console: Cloud Pro Edition (referred to throughout this manual as KRMC Cloud Pro). KRMC Cloud Pro is a revolutionary product that places a complete USB security policy into your hands, giving you the ability to remotely manage USB flash drives from anywhere in the world. KRMC Cloud Pro was designed to work specifically with the following Kanguru security drives: Current Legacy Defender Elite200 Kanguru Defender V2 Defender Elite300 Kanguru Defender Basic+ Defender Elite30 Kanguru Defender Elite Defender 2000 Virtual Defender Defender 3000 Kanguru Defender DualTrust Kanguru Defender HDD Kanguru Defender SSD The devices mentioned above communicate through a secure, encrypted tunnel to ensure that your information is protected. For more information regarding the communication protocols used by KRMC Cloud Pro, please contact: Security@Kanguru.com Important! Any Kanguru device that is configured to communicate with a KRMC Cloud Pro account will be permanently bound to that KRMC Cloud Pro account. Resetting the device will not unbind it. You can only stop communication by disabling KRMC Cloud Pro on the device or deleting the device from the KRMC Cloud Pro console (see section Codes on p.36). 7

8 Main Features of KRMC Cloud 2. Main Features of KRMC Cloud Pro KRMC Cloud Pro has an array of features that give administrators the ability to manage their Kanguru secure USB flash drives and hard drives. Below is a list of just some of the features available in KRMC Cloud Pro: Remote data deletion Self-service password management Remote device disable/enable Remote password reset Remote password change Administrator level auditing of actions and events Ability to create groups consisting of multiple devices and/or users Ability to create multiple admin users Configurable offline settings Token-based deployment capability Configurable offline settings Remote re-provisioning of devices for security policy enforcement and compliance Reports and charts IP address and hostname device usage tracking Logging of all system actions and events Organized asset management system Remote messaging to devices License management for KRMC and Anti-virus Ability to create schedule-based actions Many more 8

9 KRMC Version 4 Improvements 3. KRMC Cloud Version 4 Improvements Several major improvements have been made with the release of version 4. These include changes to the user interface, the menu navigation, additional management options, grouping features, performance enhancements, and several other improvements that provide a better user experience. Below is an extended list of changes to expect in version 4: Last Location - You will now be able to view the last geographic location a device was seen on the Devices page. Customizable Home Page - You can now customize the information you see on the home page. Compact Navigation - The navigation has been restructured to be more intuitive and less obtrusive. Dynamic Interface - The web console displays information in real-time without having to refresh or navigate to another page. Improved Monitoring - There is now an events section that tracks important account and device activity. Device Activity - Detailed histories of device activity are now available for viewing. Users - Provides additional user creation options and manageability. Device Groups - The Groups feature allows devices to be assembled in groups. Additional Deployment Options - Deploying Kanguru Defenders can now be simplified by using unique Cloud IDs generated for each individual user. Cloud IDs can be used to easily assign a registered device to a specific user. Improved Licensing - License management has been simplified, providing greater flexibility and manageability. Centralized Settings - System settings are all centrally located on a single page, making it easier to find and configure account-level settings. Notifications - You can now set up important notifications to be sent to you via through the settings page. The above features will be detailed further in this manual. Kanguru Solutions welcomes all customer feedback and suggestions. Please forward your comments to feedback@kanguru.com and we will respond as soon as possible. We thank you in advance for your feedback regarding KRMC. 9

10 System Requirements 4. System Requirements Client requirements for Admins using KRMC Cloud Pro These requirements are for systems that will be used to log in to the KRMC Cloud Pro web console. Supported by current versions of Microsoft Edge, Mozilla Firefox and Google Chrome Minimum resolution: 1024x768 Internet / network connection 32MB of available local storage Minimum 512MB RAM 10

11 Getting to Know KRMC Cloud Pro 5. Getting to Know KRMC Cloud Pro KRMC Cloud Pro is a web based application that provides administrative tools in a single, centrally managed console. It allows you to manage, monitor, and provision your USB devices. Its intuitive design simplifies the work flow for administrators making it easy to take advantage of the array of tools and available options. KRMC Cloud Pro is a SaaS based application, so it is accessible through any operating system or device as long as you have a web browser and access to the internet. Once logged in, you will be able to manage your USB devices remotely from anywhere. 5.1 Logging into KRMC Cloud Pro... p Components of KRMC Cloud Pro... p Filtering and Sorting Lists... p Navigation Menu... p Change Password... p Events Bar... p.21 11

12 Getting to Know KRMC Cloud Pro 5.1 Logging into KRMC Cloud Pro To log into KRMC Cloud Pro: 1. Open your web browser. The site is best viewed by using the latest version of Microsoft Internet Explorer, Google Chrome, Mozilla Firefox, or Safari. 2. Once you have the web browser open, you can use either of these methods to navigate to the login page: Visit and you will be directed to the login page directly. Visit and then click on the KRMC Cloud Login link located in the navigation bar: This brings you to the KRMC login screen Logging in with a registered address 1. Enter your registered and password and then click the Login button. If you do not have an account setup yet, please contact Kanguru support at support@zendesk.kanguru.com. 2. Once you have logged in with your account information, you will be directed to your KRMC Cloud Pro dashboard. You have successfully logged into KRMC Cloud Pro and will be directed to the Home page. 12

13 Getting to Know KRMC Cloud Pro SAML Login Active Directory (AD) based Single Sign On (SSO) using Security Assertion Markup Language (SAML) provides KRMC administrators an alternative sign-on option for login. If setup for the account, an administrator wishing to login to KRMC will be redirected to the SSO URL for authentication using their own SAML supported AD service. Once the administrator authenticates into their AD service, they will be redirected back to KRMC in a logged-in state, where they can continue to use KRMC features as usual. Benefits of using AD based login: Productivity savings for administrators no additional passwords to remember for KRMC. The KRMC login now ties seamlessly with SSO. Administrators are authenticated using the company s trusted internal AD services, enabling higher customer trust in the KRMC ecosystem overall. Near instant privilege revocation in case a KRMC Admin is terminated as an employee. KRMC will refresh account state with the customer s AD server every 30 minutes. To login using AD based SSO, click the SAML Login link on the Login page. If you are authenticated by Active Directory, then you will be automatically logged into KRMC. For instructions on integrating KRMC with Microsoft Active Directory Federation Services please refer to Appendix D: Integrating KRMC with Microsoft Active Directory Federation Services on p.72 13

14 Getting to Know KRMC Cloud Pro Logging in with 2 Factor Authentication 2 factor authentication is a feature that extends an additional layer of security which prevents unauthorized users from logging into KRMC Cloud Pro. When 2 factor authentication has been enabled, after the administrator signs in with their password they are directed to an authentication page. An authentication code is automatically generated and sent by to the administrator. The administrator must copy the authentication code from the into the Authentication Code field and then click on the Verify button. Note: Authentication codes are only valid for 30 minutes after they have been generated. If your code has expired, then click the Resend Code button and a fresh authentication code will be sent by . Once the authentication code has been validated, the administrator will be logged into the web console. For more information about how to enable 2 factor authentication, please refer to section 9.1 Admins Tab on p.44 to enable for individual administrators and section 11.2 Administrator Settings Tab (Super Admin only) on p.60 to enable for all administrators. 14

15 Getting to Know KRMC Cloud Pro Logging In for the First Time (Super Admin only) If you are the Super Admin and you are logging into KRMC for the first time, you will be required to complete some initial setup and configuration of your KRMC. This will only have to be done once by the Super Admin, the first time that they login. 1. The first time that the Super Admin logs into KRMC, they will be greeted with a Welcome screen. Click on the BEGIN button to proceed with initial setup and configuration. 2. On the next screen you will be prompted to create an Administrative Password. The Administrative Password must conform to the default security parameters. Enter and then reenter an Administrative Password and then click on the Save & Continue button. 3. Define a Global Provisioning Profile and then click on the Save & Continue button. All managed drives registered with KRMC will be automitically configured with these security policy settings. Note: The Admin can modify the Global Provisioning Profile at anytime by navigating to Settings > Global Provision Profile. For more information about the Global Provisioning Profile, see section 11.1 Global Provision Profile Tab on p.59 15

16 Getting to Know KRMC Cloud Pro 4. Enter your contact information (name, , and employee ID if applicable) and then click on the Save & Continue button. This address will be what you enter during subsequent logins. Once you have completed the initial setup and configuration, you will be directed to the KRMC home page. 16

17 Getting to Know KRMC Cloud Pro 5.2 Components of KRMC Cloud Pro There are several components of KRMC Cloud that administrators can navigate and perform various actions from. It is important to familiarize yourself with these components and understand how they interact with each other. 1. The Navigation Menu - Located in the left hand side of the page. Rolling your mouse over the Navigation Menu will expand the area, allowing you to see what each link points to. 2. Account Profile - Located at the top right of the console, the Account Profile area displays your account name and can be used to log out or change your login password. 3. The Events Bar - Located at the right side of the page, the Events Bar can be toggled to show either the Events Bar or the Support Bar. The Events Bar contains a list of any events, actions, or alerts that you have subscribed to in the Settings Page (see section 11.3 Event Bar Options Tab on p.61) 4. The Support Bar - Located on the right side of the page below the Events Bar. The Support Bar is not fully implemented in this version and will be released in a future version. 5.3 Filtering and Sorting Lists Information can be filtered within the console using the search bar. Doing a search will filter content among several columns, not just the name column. In addition to searching for information, you can also sort the columns by clicking on the header name. 17

18 Getting to Know KRMC Cloud Pro 5.4 Navigation Menu The Navigation Menu is located on the left-side of every page. Initially, the Navigation Menu only displays icons. When you hover your mouse over the area, the menu will expand revealing the full context Main Pages There are a total of seven, main pages in KRMC that are accessible through the Navigation Menu on the left. These main pages are listed and detailed below: Devices Page A list of devices that are registered to this account. You can manage devices, create remote actions, update security settings and add users. This is your primary page. Actions Page A list of pending, successful, and failed actions that occurred on devices. You can also create global actions from this page. Users Page A list of current admins, users, and groups. You can add additional users and groups on this page, as well as modify existing permissions or settings. Licenses Page A quick snapshot your licenses status. Licenses can be manually assigned or deleted from this page. Your order history is also listed here. Settings Page Set an administrative password and configure a global provisioning template, notification options, and event bar settings. Charts/Reports Page A series of data charts which visually represent status and usage information. 18

19 Getting to Know KRMC Cloud Pro Navigation Sub-Menus The Navigation Menu on certain pages will contain sub-menu icons. The sub-menu options are specific to that page and allow for easier management of devices or users. These will be explained in later sections. Devices Page...p.25 Create User Creates either a new User or Admin. You can assign a unique Cloud ID to the new user and assign it to a group. Create Group Creates a new group that contains devices and users. A group in KRMC Cloud Pro can contain multiple devices and administrators. Actions Page...p.40 Delete All Actions Deletes all actions for every device the logged in Admin has access to. This cannot delete system critical actions such as the Change Administrative Password action Log Out You can log out of the console by clicking on Log Out in the Navigation Menu. Alternatively, you can click on the green arrow located at the top right by your account information. 19

20 Getting to Know KRMC Cloud Pro 5.5 Change Password You can change the password you use to login by clicking on the green arrow located at the top-right, by your account information. This will redirect you to the Change Password page. Enter the required password information and then click the Change password button. You will need to enter your new password the next time you login to KRMC Cloud. 20

21 Getting to Know KRMC Cloud Pro 5.6 Events Bar The Events Bar, located on the right side of the page, displays all events that you subscribe to. You can configure what type of events appear in the Events Bar from the Settings page (see section 11.3 Event Bar Options Tab on p.61). Anytime one of these events occur, the event instance will be logged and displayed in the Events Bar. The Events Bar can be collapsed or expanded to the length of the current page. Tracking and Auditing The Events Bar allows you to track who has been logging into the console. You can also view who has been creating actions on devices and at what times. In addition, any potential security risks will also be recorded in the Events Bar, such as failed login attempts. Export of Logs Allows you to export an event logs of KRMC actions. After exporting the log, you will have the option to clear the log. Configurable Settings Navigate to the Settings page, and click on the Event Bar Options tab (see section 11.3 Event Bar Options Tab on p.61). From here, you will be able to choose what events are displayed. Changing an event s priority level will affect what color that event will appear in. High Priority Red text Medium Priority Yellow text Low Priority White Text None Does not display on the events bar 21

22 The Home Page 6. Home Page When you login to KRMC Cloud Pro, you are automatically directed to the KRMC home page. The KRMC home page provides you with a system overview displaying information about the time of your last login, your devices, your licenses, and of any successful, pending or failed actions. Note: If this is your first time logging into KRMC Cloud Pro, then you must define an Administrative Password. All devices that you register with this KRMC Cloud Pro account will be set with this Administrative Password. For more information about the Administrative Password please refer to section 11.5 Administrative Password Tab (Super Admin only) on p Notifications Area... p Customizable Charts... p Account Information... p.24 22

23 The Home Page 6.1 Notifications Area The notifications section is located near the top of the home page. It contains important news and updates from the Kanguru Development Team. 6.2 Customizable Charts There are four slots for charts on the home page. To change what charts are displayed, click on the add charts button located in the bottom-left corner of each chart window. A menu appears, allowing you to select charts you want displayed on the home page. A maximum of four charts can be selected at any one time. Once the charts have been selected, click the Update button. The selected charts will be displayed on the home page, providing a quick snapshot of usage data each time you login. 23

24 The Home Page 6.3 Account Information A summary of your account is shown in the Account Information area. It contains the following information: Cloud ID The account-level Cloud ID used to register devices to this account. Total Unused Licenses The number of licenses available that can be assigned to a device. Devices with Expired Licenses The number of devices that currently have expired licenses. Devices with expired licenses will not be able to receive remote actions from the KRMC server. It is strongly recommended to assign a new license to any device with an expired license. Number of Devices The total number of devices registered with this account. Number of Connected Devices The number of devices that are currently being used and communicating back to the server. Note: Devices running in offline mode will not report this information (see section Set Provision Profile for User on p.48). Last Device Connection Date The most recent date that a device communicated with the KRMC server. Your Last Login The date that the current Admin last logged into the console. Cloud Pro Expiration Date The date when your KRMC Cloud Pro subscription will expire. After the Cloud Pro subscription expires, all Regular Admin accounts become disabled and all devices are assigned to the Super Admin. 24

25 Devices 7. Devices Page The Devices Page provides you with options for viewing and managing your Defender devices. The tabs located at the top of the page will provide a brief overview of a selected device or user. Users Tab - Information about the User or Group selected in the Users List Device Tab - Information about the device selected in the Device List Export Tab - Export the device list information to a spreadsheet. View Deactivated/Active Devices button - Clicking this button toggles whether the Device List displays active devices or deactivated devices. 7.1 Users List...p Creating New Users and Groups...p Device List...p Device Activity List...p Edit Device Info...p Add Action...p Reprovision...p Delete Device...p Deactivate Device...p Reactiavating a Device...p.39 25

26 Devices 7.1 Users List The Users List contains a list of groups and users. It appears to the left of the Device List on the Devices page. Note: Super Administrators and Global Device Administrators can view all Groups, Admins and Users in the system. Regular Administrators can only view Groups that they are assigned to, Global Device Administrators, and Users that they created. Selecting View All from the Users List will display all devices registered with this KRMC Cloud account in the Device List. Selecting a group from the Users List will display all devices assigned to that group in the Device List. Additionally, a list of individual Admins and Users that belong to the group are displayed beneath the group name. Selecting an individual User or Admin in the Users List will display only devices assigned to that User or Admin in the Device List. Users and Admins who do not belong to any groups can be viewed by selecting Ungrouped Users. Selecting Unassigned Devices from the Users List will display all devices that are not assigned to a group in the Devices List. Unassigned Devices will only appear in the Users List if your account was created with the Can see unassigned devices option enabled (see section Creating New Users and Groups on p.27). 26

27 Devices Creating New Users and Groups On the left side of the Navigation Bar on the Devices page, you will notice two sub-menu items which are unique to this page: - Create new user - Create new group Create a New User Hover your mouse over the Create New User icon to reveal the Create New User menu: The Create New User menu allows you to easily create a new user without navigating away from the current page. First Name The user s first name Last Name The user s last name The user s Employee ID The user s employee ID User / Admin Set the user role to either a User or a Regular Admin. Only Super Admins and Global Device Admins can create Admins. Regular Admins can only create Users. Groups Administered (Admin only) Assign the Admin to a group without having to navigate to the Users page. Unique Cloud ID s the user a unique Cloud ID. Any device registered using this Cloud ID will automatically be assigned to this user. The device will still be viewable and manageable by the Super Admin and any applicable Admins. Can see unassigned devices (Admin only) - When enabled allows the Admin to view any unassigned devices. If disabled the Admin will only see devices assigned to them. Allow to Use SA licenses (Admin olny) - When enabled allows the Admin to attach AV or KRMC licenses registered with the Super Administrator s account to their own devices. 27

28 Devices Create a New Group Hover your mouse over the Create New Group icon to reveal the Create New Group menu: The Create New Group menu allows you to easily create a group without navigating away from the current page. Group Name The Group s name, e.g. Sales Department Description A short description of the group. e.g. Northeast Territory Administrated By Allows you to add administrators to the group. Admins assigned to this group will be able to manage all devices associated with the group. 28

29 Devices 7.2 Device List The Device List displays a list of devices belonging to the Group, Admin or User selected in the Users List. Note: Regular Admins can only view devices assigned to them, or devices that are assigned to a Group that they are an Administrator of. Super Admins can view all devices. A Global Device Admin (see section Edit or Delete Admins on p.45) can also view all devices. By default, only active devices are displayed in the Device List. To view any deactivated devices, click on View Deactivated Devices located in the top-right of the tabs area. For more information about deactivated devices, please refer to section Deactivate Device on p.38. The device list displays information about each device, separated into columns. You can change what information is displayed by clicking Edit, located in the top-right area of the Device List. Device Name The name of the device assigned by UKLA, device setup, or KRMC. Description A description of the device. The default description is the device s name. Last Activity The last time the device communicated with KRMC. Serial Number The serial number of the physical device. Device Owner The User or Admin that the device is assigned to. Validity The amount of days remaining on the device s KRMC license. Application The client version that the device last reported it was running. Hostname The name of the machine the device was last connected to. IP Address The IP address of the machine the device was last connected to. Last Location The geographical location of the computer that the device was last connected to. The geographical location is an approximate location of the drive. The actual location may differ. (cont.) 29

30 Devices Last AV Update The date the drive was last updated with antivirus definitions. Department The department that the drive or drive s user belongs to. Employee ID/Name The name and employee ID of the User or Admin that the drive is assigned to. The address of the User or Admin that the drive belongs to. Phone The phone number of the User or Admin that the drive belongs to. Disabled Displays whether the device is currently disabled. Status - If a device appears with a flag under the Status column, then it has a pending action. Hover your mouse over the flag to view the pending actions. 30

31 Devices 7.3 Device Activity List Clicking on a device in the Device List will expand the Device Activity List. The Device Activity List displays actions that were created for the device selected in the Devices List. You can close the Device Activity List by clicking on the device in the Device List again. Note: Select multiple devices from the Device List by holding the CTRL key while clicking on devices. Each action in the Device Activity list is displayed with a description of the action, the date and time that the action was completed and the admin that created the action. Actions displayed with Pending have not been executed yet. Actions created by Automatic were created by the system in response to an admin setting change (e.g. enabling Self Service Password Management). There are buttons at the top of the Device Activity List, which will be explained in the following sections. The buttons available will vary depending on your account type. Edit Info...p.32 Add Action...p.33 Reprovision...p.34 Delete Device...p.36 Deactivate Device...p.38 Reactivating a Device...p.39 31

32 Devices Edit Device Info Clicking the Edit Device button will open the Edit Device menu in the Device Activity List. From here you can change the device s name, assign the device to an owner or group, and add internal notes about the device. Note: Super Admins and Global Device Admins can assign devices to any Admin or User. Regular Admins can assign devices to themselves, an Admin that belongs to one of their Groups, or a User that they created. When you have finished editing the device s information: Click the Update button to apply any changes made and return to the Device Activity List. Click the Cancel button to discard any changes and return to the Device Activity List. 32

33 Devices Add Action Clicking the Add Action button will open the Add Action menu in the Device Activity List. From here you can create a new action for the device(s) selected in the Device List. Note: Select multiple devices from the Device List by holding the CTRL key while clicking on devices. The created action will be run on all of the selected devices. Select an action to be executed and then enter a message in the Message field to be displayed to the device user when the action is executed. You can also add an internal note in the Notes field which will be recorded in KRMC but will not be displayed to the device user. A complete list and description of remote actions is provided in Appendix A : Description of Remote Actions on p.67 By default, a new action is scheduled to execute the next time the device communicates with the KRMC server. If you want to delay the action until later, you can select Run this action on specific date and time and schedule a date and time. Note: A scheduled action may not occur at the exact date and time set here. The action will be executed the next time the device communicates with KRMC after the scheduled date and time. When you have finished creating the new action: Click the Create button to create the new action and return to the Device Activity List. Click the Cancel button to discard the new action and return to the Device Activity List. 33

34 Devices Reprovision Clicking the Reprovision button List. will open the Reprovision Device menu in the Device Activity Note: Select multiple devices from the Device List by holding the CTRL key while clicking on devices. This allows you to reprovision all of the selected devices. From here you can change the device s security settings: Individual Device Settings Provision Template Used - Select whether the device will follow the Global Provision Profile configured for this KRMC account or its own custom security profile (for more information about the Global Provision Profiles see section 11.1 Global Provision Profile Tab on p.59). Password Constraints Password Length (8-15 characters) The mandatory minimum number of characters a password must contain to be valid. Expiration frequency (none, 30, 60, 90, 180, 360 days) How often the system will force the user to change their user password. Minimum Uppercase/Lowercase/Symbols/Numbers (0-5) The minimum number of upper and lower case letters, symbols and digits a valid password must contain. Enforced Password History - The number of previously used passwords that may not be accepted as your current password. A higher number discourage users from alternating between several common passwords. 34

35 Devices Security Settings Login Attempts Allowed (3 15 attempts) - The number of times a user can incorrectly enter their password when attempting to login to the drive. A warning message will appear to inform the user when they have one attempt remaining. After Login Attempt Used -- Format Device - The device will automatically format itself if the user exceeds the number of allowed password retries. This will erase all admin settings and user data stored on the device and reset the device to the factory default settings. -- Timeout - The device will automatically activate a timeout period if the user exceeds the number of allowed password retries. The user will have to wait for the timeout period to pass before they are allowed to attempt entering a password again. -- Disable Device - The device will become disabled if the user exceeds the number of allowed password retries. The device user will be unable to login to their device or access the device s secure partition again until it is enabled by an Enable Device remote action. Timeout Value (1 Min, 2 Min, 5 Min, 10 Min, 30 Min) - How long the timeout period is. If the user exceeds the set number of password retries, the user will have to wait this long before they are allowed to enter a password again. Change Password at Next Login - If selected, the user will have to change their password the next time they successfully login to their device. Offline Access Allow Offline Access (Unlimited, Logins) - If unselected, the device user will not be able to login to access the device s secure partition if the computer the device is connected to does not have internet access. When selected, the device user will be able to access the device s secure partition when there is no internet access. The number of logins on computers without internet access can be set as 1 login up to 100 logins. If Unlimited is selected, the device user will always be able to login to the device, regardless of interenet access. When you have finished configuring the device s security profile: Click the Update button to apply any changes made and return to the Device Activity List. Click the Cancel button to discard any changes and return to the Device Activity List. 35

36 Devices Codes Clicking the Codes button will open the Codes menu. The Codes menu will display the last issued Self Service Password Management (SSPM) Password Reset Code generated for the device, when the code was issued, and whether that code is still valid. SSPM is an automated feature that can be enabled by Admins which allows the device end user the ability to change the login password to their device themselves, without either the Admin having to send a Change User Password remote command or resetting the device to the factory settings. The Codes menu can be used by admins when an end user is have trouble receiving SSPM s. In the even that a device end user is not able to receive s containing their SSPM Password Reset Code, the user can call or otherwise contact their KRMC Admin to receive their code. 36

37 Devices Delete Device When a device is deleted from KRMC, it will no longer be remotely manageable and all actions and logs associated with the device will also be deleted. Any KRMC license assigned to the drive will also be lost. Deleting a device is only recommended if you are certain that the device will not need to be managed in the future. Some situations where you would want delete a device from KRMC include: A device is no longer functional and cannot or will not be repaired A device is being decommissioned due to age A device is permanently lost If there is any possibility that the device will be managed in the future then you should deactivate the device instead of deleting it. Deactivating a device only temporarily parks the device in a inactive state, allowing it to be reactivated and managed by KRMC at a later time. For more information about deactivating a device, please see section Deactivate Device on p.38 Clicking the Delete Device button list. will display the Delete Device dialogue in the Device Activity Click the Yes, delete button to confirm removing the device and close the Device Activity List. Click the Cancel button to keep the device registered with KRMC and return to the Device Activity List. Note: Only the Super Administrator has the ability to delete devices from KRMC. 37

38 Devices Deactivate Device Devices that have not been seen by the KRMC Cloud server for at least 18 months can be deactivated. Deactivating a device will temporarily exclude it from normal KRMC activity without removing the device from the account. When a device is deactivated from KRMC it will not be assigned new licenses, nor will it be remotely manageable but all actions and logs associated with the device will be retained. Any KRMC or AV licenses assigned to the drive when it is deactivated will be lost. Deactivating a device requires the consumption of one parking license. For more information about parking licenses please refer to section 10.3 Parking Licenses Tab on p.57. Deactivating a device is recommended if there is a possibility that the device will be managed again in the future. To reactivate a deactivated device, see section Reactivating a Device on p.39 If there is no possibility that the device will be managed in the future then you should consider deleting the device instead of deactivating it. For more information about deleting a device, please see section Codes on p.36 Caution! If you want to deactivate a device but you need to verify the device s serial number, DO NOT run KDM to find the serial number. Running KDM could make the device seen by the KRMC server, in which case the device will no longer be valid for deactivation. Please use the Kanguru Serial Number Display Tool to obtain the serial number. The Serial Number Display Tool can be downloaded here: Clicking the Deactivate Device button Activity list. will display the Deactivate Device dialogue in the Device You can specify how you want the deactivated device to behave: Deactivate and Allow Use - Deactivates the device from KRMC but allows the user to continue using the device as normal. Deactivate and Disable - Deactivates the device from KRMC and prevents the device from being used. The device user is not able to login to a disabled device. Deactivate, Disable and Delete all data - Deactivates the devices from KRMC, deletes all data from the device and prevents the device from being used. Click the Deactivate button to confirm deactivating the device and close the Device Activity list. 38

39 Devices Reactivating a Device When selecting a deactivated device from the Device List, there is an Activate button that appears in the Device Activity area (for information about viewing deactivated devices, see section 7.2 Device List on p.29). Click on the Activate button to reactivate a deactivated device. Activating a device requires the consumption of one KRMC license. 39

40 Actions 8. Actions Page The Actions Page allows the currently logged in Admin to review the history of actions sent to devices they own. From here you can view a list of all pending actions, successful actions, and failed actions, and also create a global action that will be sent to every device that you manage. To switch between each view, click on one of the tabs located at the top of the page: Within each view you will see the following columns: Action Type - The type of action to be executed. Target Device - The device that the action will occur on. Message - The message that will be displayed to the device user when the action is executed. Schedule - The earliest date that the action is set to occur. Created by - The Admin that originally created the action 8.1 Pending Actions Tab... p Successful Actions Tab... p Failed Actions Tab... p Create Global Action Tab... p.42 40

41 Actions 8.1 Pending Actions Tab The Pending Actions Tab contains a list of actions that are currently waiting to be executed. Once a drive communicates with KRMC, it will receive any actions that are scheduled on the pending list. Once received, the device will execute the action. There is an Action column in the Pending Actions Tab. You can delete a pending action by clicking on the Delete Action icon located in the Action column, removing it from the pending actions queue and preventing it from being executed. You can delete all pending actions for every device assigned to you by clicking on the Delete All Actions icon located in the Navigation Bar on the Actions Page. A dialogue menu appears asking you to confirm that you want to delete all pending actions for all of your assigned devices. Click the Delete button to confirm. Note: Some actions are critical to a device s operation and manageability and cannot be deleted. 41

42 Actions 8.2 Successful Actions Tab The Successful Actions Tab contains a list of actions that were successfully executed on the target device. Actions on this page cannot be deleted. There is an additional Date of Completion column in the Successful Actions Tab that records the date and time that the action was executed. 8.3 Failed Actions Tab The Failed Actions Tab contains a list of actions that have failed. A common reason for why an action fails is if a device has an expired license, or if an incorrect administrative password was used when attempting to run a Change User Password action. There is an additional Date of Failure column in the Failed Actions Tab that displays the date and time when the action failed. 8.4 Create Global Action Tab The Create Global Action Tab allows you to create an action that is executed on all devices managed by your account. Creating a global action creates individual pending actions for every device that you manage. You can exclude specific devices from the global action by deleting the action for the device(s) from the Pending Actions view (see section 8.1 Pending Actions Tab on p.41) Select an action to be executed and then enter a message in the Message field which will be displayed when the action is executed. You can also add an internal note in the Notes field which will be recorded in KRMC but will not be displayed to the device user. A complete list and description of remote actions is provided in Appendix A : Description of Remote Actions on p.67 By default, a new action is scheduled to execute the next time the device is seen by the KRMC server. If you want to delay the action until later, you can select Run this action on specific date and time and schedule a future date and time when the action can be executed. Note: Time is based on the KRMC Timezone setting (see section 11.6 Server Settings Tab on p.64), not the time at the device location. A scheduled action may not occur at the exact date and time set here. The action will be executed the next time the device communicates with KRMC after the scheduled date and time. When you have finished creating the new global action: Click the Create button to create the new action. This will create a new pending action for every device that you manage. 42

43 Users 9. Users Page The Users Page allows you to view and edit users created by your account. There are four levels of users in KRMC Cloud Pro: Super Administrator - The Super Administrator (Super Admin) has the highest level access. The Super Admin has authorization in KRMC Cloud Pro to manage all devices, admins, users, groups and settings. Each KRMC Cloud Pro account can have one and only one Super Administrator. Administrator - Admins have the second-highest access level, just below the Super Admin. Admins have the authority in KRMC Cloud Pro to manage devices, users and groups assigned to them by the Super Admin. Global Device Administrator - Global Device Admins are just like regular Admins, except they have the ability to view all devices, not only the ones assigned to them. User - Non-admin users have the lowest level access and are most commonly the device end users. Users are not able to login to the KRMC web console and are only permitted to use Defender devices assigned to them by an Admin or Super Admin. To view users in each user level, click on one of the tabs located at the top of the page: The Admins tab displays a list of Super Admin and Admin users. The Users tab displays a list of non-admin users. The Groups tab displays a list of all groups. Note: The Users Page also contains two sub-menu items in the Navigation Bar: Create User and Create Group. These are the same sub-menu items which are also on the Devices page. For more information about the Create User and Create Group sub-menu items, please see section Creating New Users and Groups on p Admins Tab...p Users Tab...p Groups Tab...p.51 43

44 Users 9.1 Admins Tab The Admins tab provides a list of Administrator users. Note: The Super Admin and Global Device Admins are able to view all Administrators. Regular Admins are able to view themselves and, if they are administering a Group, any other Admins that are also administering that group. Each Admin account has the following actions available: Edit User (Super Admin only) Edit Permissions (Super Admin only) View Groups View Users Generate Cloud ID (not available after a Cloud ID has been generated) View Devices Clicking on any of these action buttons will display the selected information in the area to the right. 44

45 Users Edit or Delete Admins Super Admins can change account-level information for all Admins by clicking the Edit User button. The Edit Admin menu appears in the area to the right of the Admins list: Note: Global Device Admins and Regular Admins can only change information for their own account. User / Admin Displays whether the account type is User or Admin. This option cannot be changed. Groups Administered Assign the Admin to a group(s). An Admin who belongs to a group has administrative rights over the group. Unique Cloud ID s a unique Cloud ID to the User/Admin. A device registered with this unique Cloud ID will automatically be assigned to this User/Admin. Can see unassigned devices - When enabled, allows the Admin to view any unassigned devices. If disabled the Admin will only see devices assigned to them in KRMC. Allow to Use SA licenses - When enabled, allows the Admin to attach AV or KRMC licenses registered with the Super Admin s account to their own devices. Account Enabled - If selected, this account will be active and the user will be able to login to the KRMC web console. If left un-selected, this account will be considered inactive. Account is Locked - If selected, this account will be locked. Locked accounts are caused by entering invalid passwords too many times when attempting to login to the console. Global Device administrator - If selected, this Admin will be able to manage all drives registered with the KRMC account. Use 2 Factor Authentication for Login - If selected, this Admin will be forced to use 2 factor authentication to log into the KRMC web console. For more information about logging in with 2 factor authentication see section Logging in with 2 Factor Authentication on p.14. Required to Change Password on Next Login - When selected, the Admin will be forced to change their password for the KRMC web console the next time they login. Click the Update button to apply the changes. Click the Delete button to remove the Administrator from this KRMC account. 45

46 Users Edit Permissions Super Admins can choose what remote actions an Administrator is able to create by clicking the Edit Permissions button. Note: Only the Super Admin can edit permissions for other Admins. An Edit Permissions menu appears in the area to the right of the Admins list: The Administrator will only be able to create actions that are selected here. For a full description of available remote actions, please refer to Appendix A : Description of Remote Actions on p.67 Click the Update button to apply any changes View Groups / Users / Devices Clicking the View Groups, View Users or View Devices button will display a list of Groups, Users or Devices that the Admin is managing. 46

47 Users 9.2 Users Tab The Users tab displays a list of Users. Users are typically device end users who do not have access to the KRMC web console. Note: Super Admins and Global Device Admins can see all Users in KRMC. Regular Admins can only see Users that they themselves created. Each user account is displayed with the following information: User Name - The name of the device user. Cloud ID - Click on the Generate button to create a Cloud ID for the user. A Cloud ID can be used to directly assign a device to this user when provisioning. Devices - The number of devices that are assigned to this user. Last Device Seen - The most recent device assigned to this user that communicated with the KRMC server. - The user s address 47

48 Users Set Provision Profile for User Under the Settings column, click on the Set Provision Profile for User icon security requirements for any device assigned to this user. to modify the Password Constraints Password Length (8-15 characters) The mandatory minimum number of characters a password must contain to be valid. Expiration frequency (none, 30, 60, 90, 180, 360 days) How often the system will force the user to change their user password. Minimum Uppercase/Lowercase/Symbols/Numbers (0-5) The minimum number of upper and lower case letters, symbols and digits a password must contain. Enforced Password History - How frequently old passwords can be reused. A higher number discourage users from alternating between several common passwords. Security Settings Login Attempts Allowed (3 15 attempts) - The number of times a user can incorrectly enter their password while attempting to login to the drive. A warning message will appear to inform the user when they have one attempt remaining. After Login Attempt Used -- Format Device - If selected, the device will automatically format itself if the user exceeds the number of allowed password retries. This will erase all admin settings and user data stored on the device and reset the device to the factory default settings. -- Timeout - If selected, the device will automatically timeout if the user exceeds the number of allowed password retries. The user will have to wait for the timeout period to pass before they will be allowed to enter a password again. 48

49 Users -- Disable Device - If selected, the device will become disabled if the user exceeds the number of allowed password retries. The device user will be unable to log into their device or access the device s secure partition again until it is enabled by an Enable Device remote action. Timeout Value (1 Min, 2 Min, 5 Min, 10 Min, 30 Min) - If Activate Timeout Period has been selected, you can define how long the timeout period is. If the user exceeds the set number of password retries, the user will have to wait this long before they are allowed to attempt entering a password again. Change Password at Next Login - If selected, the user will have to change their password the next time they successfully login to their device. Offline Access Allow Offline Login (1-100 or Unlimited Logins) -- If this option is unchecked, the user will not be able to login to their device if the device cannot communicate with the KRMC server through the internet. -- If you check this option, the user will be able to access their device even if the device cannot communicate with the KRMC server. If you enable Allow Offline Login, you can select the number of times the user can login to the device when there is no communication with the KRMC server. If you select Unlimited then the user will always be able to login to their device when there is no internet connection. SSPM - The Self Service Password Management feature allows the user to reset their own login password for a managed Defender device. Users must register an address so that a password reset can be sent to the user. Enable and Force - Enable SSPM and force the user to register an the next time they use their device. Enable but Defer - Enable SSPM but allow the user to register an at a later time. Disable - Disable SSPM, preventing users from resetting the password on their device. If the user forgets their password, the only method of recovery is for the device administrator to create a Change User Password action for the device. 49

50 Users Edit or Delete User Super Admins and Admins can change a User s information by clicking the Edit User button. An Edit User menu appears in the area to the right of the Users List: First Name The User s first name Last Name The User s last name The User s Employee ID The User s employee ID User / Admin Set the account type to either User or Admin. If you upgrade a User to an Admin, then they will be able to login to KRMC. You cannot downgrad an Admin to a User. Groups administered This option is only available if you are editing an Admin user. Allows you to assign an Admin to a group. Unique Cloud ID s the User a unique Cloud ID. A device registered using the User s Cloud ID will automatically set the device s owner as this User. Can see unassigned devices - This option is only available if you are editing an Admin user. When enabled allows the Admin to view any unassigned devices. If disabled the Admin will only see devices assigned to them in KRMC. Allow to Use SA licenses - This option is only available if you are editing an Admin user. When enabled allows the Admin to attach AV or KRMC licenses registered with the Super Administrator s account to their own devices. Click the Update button to apply the changes. Click the Delete button to remove the User from this KRMC account. 50

51 Users 9.3 Groups Tab The Groups Tab displays a list of Groups created in KRMC. Groups are created by organizing associated Admins and Devices under a single group. Admins assigned to a group have the ability to manage all devices within that group. Each Group is listed with the following information: Group Name - It is recommended to create a descriptive name for your Groups to make them easily recognizable. Users - The number of Admins assigned to this Group. Devices - The number of devices assigned to this Group. Administrator - The Administrator(s) that manages this Group. 51

52 Users Edit Groups Super Admins and Group Admins can change a Group s information by clicking the Edit Group button. An Edit Group menu appears in the area to the right of the Groups list. You can modify the Group s name, the description, which Admins manage the Group and which devices belong to the group. Click the Update button to apply any changes. 52

53 Users Add Group Action Clicking the Add Group Action icon will open the Add Group Action menu in the area to the right of the Groups list. From here you can create a new action that will be created for all devices in this Group. Select an action and then enter a message in the Message field. This message will be displayed to all device users when the action is executed. You can also add an internal note in the Notes field which will be recorded in KRMC but will not be displayed to the device users. A complete list and description of remote actions is provided in Appendix A : Description of Remote Actions on p.67 By default, a new action is scheduled to execute the next time the device is seen by the KRMC server. If you want to delay the action until later, you can select Run this action on specific date and time and set a future date and time when the action can be executed. Note: A scheduled action may not occur at the exact date and time set here. The action will be executed the next time the device communicates with KRMC after the scheduled date and time. When you have finished creating the new action: Click the Create button to create the new action and return to the Groups list Delete Group Click on the Delete icon to delete this Group from KRMC. A dialogue appears asking you to confirm deleting this Group. Click on the OK button to remove the Group. This will remove the Group only. Any Users, Devices or Administrators assigned to a deleted Group will still remain in KRMC. 53

54 Licenses 10. Licenses Page The Licenses Page allows you to view and manage your KRMC device licenses. To view licenses, click on one of the tabs located at the top of the page: The Summary Tab shows a high-level overview of your KRMC and AV licenses. The Licenses Tab shows a low-level description of your active licenses. The Parking Licenses Tab shows a list of parking licenses which are used to deactivate devices. The Orders Tab will allow you to manage your license purchases directly from the web console The Summary Tab...p The Licenses Tab...p The Parking Licenses Tab...p The Orders Tab...p.57 54

55 Licenses 10.1 Summary Tab The Summary Tab displays a low-level overview of the current status of any KRMC licenses and AV Licenses registered with this KRMC account. Under the Summary Tab, you are shown details about your available licenses: Devices Requiring a License Immediately: The number of devices which currently do not have a valid license. Total Usable Licenses: The number of licenses available to be assigned to devices. These licenses are currently not assigned to any device. Devices with Licenses Expiring: This information can be used to help determine when you need to purchase more licenses. It is good practice to always have enough Usable Licenses available to replace any licenses set to expire within 30 days. You can easily figure out the number of licenses you will need to purchase in the future by entering a timeframe into the license calculator located at the bottom of the Summary Tab and then clicking the Calculate button. Important! Newly imported KRMC and AV Licenses are automatically assigned to the first available active device without a valid license. Licenses cannot be manually assigned to specific devices. For more information about KRMC License Management, pleases refer to Appendix C: KRMC License Management on p.70 55

56 Licenses 10.2 Licenses Tab The Licenses Tab displays detailed information about the individual KRMC and AV licenses assigned to each device. You will be able to view which devices have a valid license and how many days are left on that license. Important! Newly imported KRMC and AV Licenses are automatically assigned to the first available active device without a valid license. Licenses cannot be manually assigned to specific devices. If you do not want a device to receive a license then you should consider either deleting it or deactivating it from KRMC (see sections Codes on p.36 and Deactivate Device on p.38). You can view the exact number of days remaining on a license before it expires by hovering your mouse over a progress indicator bar: 56

57 Licenses 10.3 Parking Licenses Tab Parking Licenses are used to deactivate a device (see section Deactivate Device on p.38). The Parking Licenses Tab displays a device history of all deactivated devices. Deactivated devices remain in KRMC, however a deactivated device will not receive remote actions from KRMC. Additionally, the Parking Licenses Tab will identify which Admin deactivated the device and when it was deactivated Orders Tab The Orders Tab will allow you to view any orders that were processed on your account and displays the number of each license purchased with that order. Important! Newly imported KRMC and AV Licenses are automatically assigned to the first available active device without a valid license. Licenses cannot be manually assigned to specific devices. 57

58 Settings 11. Settings Page The Settings Page provides you with options for viewing and configuring KRMC system settings. You can navigate to the various settings by clicking on the tabs located at the top of the page Global Provision Profile...p Administrator Settings (Super Admin only)...p Event Bar Options...p Notification Options...p Administrative Password (Super Admin only)...p Server Settings...p.64 58

59 Settings 11.1 Global Provision Profile Tab The Global Provision Profile is available to the Super Admin. It is a security profile that is used as the standard configuration for all devices registered within this KRMC Cloud Pro account. The Admin Provision Profile is available to Admins and is used as the standard configuration for all devices managed by their Admin account. KRMC managed devices must adhere to the Global/Admin Provision Profile if the profile is active. Administrators may configure separate profiles for individual devices and users, but these profiles must meet the minimum requirements set by the Global/Admin Provision Profile. Click on Save and Activate to activate the Global/Admin Provision Profile. Any changes made to the Global/Admin Provision Profile will create a Reprovision action to all applicable devices. Click on the Save button to update the security policies for each device the next time they are seen by the KRMC server. Click on the Deactivate button to deactivate the Global/Admin Provision Profile. Warning! For security reasons, deactivating the Global/Admin Provision Profile is not recommended. 59

60 Settings 11.2 Administrator Settings Tab (Super Admin only) The Administrator Settings allows a Super Admin to force two factor authentication for all KRMC Admins logging into KRMC. When enabled, all current Admins will be required to log in to KRMC using both their login password as well as an authentication code delivered by . Any new Admins created while this option is enabled will also be required to login with 2 factor authentication. Important! If you disable Force 2 Factor Authentication from the Administartor Settings tab, it will only prevent new Admins who are created after this option is disabled from having to use 2 factor authentication during login. Any Admins that previously had to login with 2 factor authentication will still have to do so. To disable the requirement for an Admin to login using 2 factor authenticaion, it must be manually disabled for the individual Admin (see section 9.1 Admins Tab on p.44 for more information). For more information about logging in with two factor authentication enabled, please see section Logging in with 2 Factor Authentication on p

61 Settings 11.3 Event Bar Options Tab The Event Bar Options tab allows you to configure what information is displayed in the Events Bar (see section 5.6 Events Bar on p.21) and how the information appears in the Events Bar. Any event set with a Low, Medium or High priority will be logged and displayed in the Events Bar: Low priority events are displayed in white text Medium priority events are displayed in yellow text High priority events are displayed in red text Events that have their priority level set to Off will not be displayed in the Events Bar. 61

62 Settings 11.4 Notification Options Tab The Notifications Options Tab allows administrators to enable alerts that are sent to them when certain events occur within KRMC. In order for alerts to be ed to you, you must select one or more of the events listed, enter an address where alerts can be sent, and then click on the Save button. 62

63 Settings 11.5 Administrative Password Tab (Super Admin only) The Administrative Password Tab allows you to create or change the Administrative Password. The Administrative Password is a system-wide password that is required when creating security sensitive actions like Change User Password. Click on the Save button to create or change the Administrative Password. Creating or changing the Administrative Password will create a new action for all devices registered with this KRMC account. 63

64 Settings 11.6 Server Settings Tab The Server Settings Tab allows you to view and change some server level settings. Device Information Updated From (Super Admin only) - Select how device information is synched with KRMC: Device - Information is read from the device and updated in KRMC. Any changes to device information made directly through the device will over-ride information saved in KRMC. Server - Information is read from KRMC and updated to the device. Any changes made to device information in KRMC will over-ride the information saved on the device. Download drive updates automatically (Super Admin only) - When selected, every time a device communicates with KRMC, KRMC checks the drive version and downloads any updates automatically. Timezone - Set the Timezone that you want your KRMC account set in. All your scheduled actions and events will occur and be recorded based on the Timezone that your KRMC account is set to. 64

65 Charts and Reports 12. Charts/Reports Page The Charts/Reports Page provides visual break downs of all device, user and system activity. To view a chart: 1. Select a time frame to generate report data from. When - Select a specific number of days prior to today to pull data from. From / To - Select a specific date range to pull data from. 2. In order to display only the most relevant data, select a maximum number of results to display from the Limit drop down menu. 3. Select a chart type from the Chart menu. After a few moments the chart will appear. For a more detailed description of each chart, see Appendix B: Description of Reports on p.69 65

66 Technical Support 13. Technical Support If you experience any problems using your Kanguru Remote Management Console : Cloud Edition, please call our tech support department. Kanguru tech support is available Monday thru Friday, 9am to 5pm EST. Phone: Option 2 Website: Support: support.kanguru.com Please have your KRMC Cloud ID number on hand when contacting technical support. You Cloud ID number can be found in the KRMC Account Information section at the bottom of the home page. 66

67 Appendix A : Description of Remote Actions Appendix A : Description of Remote Actions Change User Password Change the device s user password. New Password: Enter the new user password for the device. Confirm Password: Enter the new user password again to confirm the password. This password must match the password entered in the New Password field. Administrative Password: Enter the KRMC Administrative Password. User Must Change Password on Next Login: When selected, the user will be forced to change their password after their next login. Message Send a notification message to be displayed on the device host s computer. Delete all data and Disable Device - Delete all the data stored on the device, and then disable the device. Admin settings are not affected by this action. The device user will be unable to login to their device or access the device s secure partition again until it is enabled by an Enable Device remote action. Disable Device - Remotely disable a device. Admin settings are not affected by this action. The device user will be unable to login to their device or access the device s secure partition again until it is enabled by an Enable Device remote action. IP/Domain/MAC Control - Create a list of IP Ranges or Domains or MAC addresses that you will either allow or restrict your devices to access KRMC from. You can include multiple IP Ranges or Domains in the list. Enable Access Control: Check this box to enable IP/Domain control. Functionality: Select whether IP/Domain control will allow or deny certain IP ranges or domains. -- Allow All Except (blacklist): When selected, all devices will be allowed to access KRMC unless it is located under any of the IP ranges or Domains listed. -- Deny all Except (whitelist): When selected, only devices that are located under any of the IP ranges or Domains listed will be able to access KRMC. Control Based: Select whether you want IP/Domain Control to be based on IP Range, Domain or MAC Address. New Values: Select whether you want the newly added IP Range or Domain to either Append or Overwrite the existing list of allowed or blocked IP Ranges/Domains. Add IP Range, Add Domain and Add MAC Address: Depending on whether control is based upon IP Range, Domain or MAC Address, this entry will be either Add IP Range, Add Domain, or Add MAC Address. -- IP Range: Enter the start and end of the IP range that you wish to allow or deny. Enable Device - Remotely enable a device that had been disabled by a Disable Device remote action. 67

68 Appendix A : Description of Remote Actions Self Service Password Management - Gives the Defender device user the ability to manually reset their Defender login password. In the event that the Defender login password is lost or forgotten, the user can reset their password without resetting the device and regain access to their data. If a device user forgets their password and self-service password management is enabled, all they need to do is click the Forgot Password button at the Defender s login window and a password reset code will be sent to their designated ID. Once they enter this reset code, they will be able to setup a new login password and access their data again. Enable and Force - Enable the self-service password management feature on the drive and activate it immediately by requiring the user to provide an address where the password reset code can be sent. Enable but allow the user to setup later - Enable the self-service password management feature on the drive but allow the user to provide their address at a later time. Note: Simply enabling self-service password management does not allow the device user to reset their password. Self-service password management must be activated by providing a valid address. Disable Password Reset - Disable the self-service password management feature. The Forgot Password option will not be available on the Defender login window. Reset for New User - This action is designed specifically for reprovisioning a managed Defender drive for a different end user. The Reset for New User action will delete all user data and contact information from the previous device owner, while retaining information critical to device management, i.e. Admin Password, KRMC status, AV license info, proxy settings and access control restrictions. Important! If the Reset for New User action is greyed out for a device, please update the device with the latest KDM client version. A Reset for New User action can only be created for devices running KDM client version and later. 68

69 Appendix B : Description of Reports Appendix B: Description of Reports Devices Registered devices - The number of devices that have been registered with KRMC within the selected time period. Devices types - The number and percentage of different Defender model types that have been registered with KRMC within the selected time period. Successful actions - The number of successful actions that have occurred for each device that has had at least one successful action within the selected time period. Pending actions - The number of pending actions for all active devices with at least one pending action within the selected time period. Failed actions - The number of failed actions that have occurred for each device that has had at least one failed action within the selected time period. Connected devices - The number of devices that have not been connected within the selected time period. Number of logs - The number of log events generated by each device within the selected time period. Actions Actions per days - The number of pending, successful and failed actions that have occurred within the selected time period. Actions type per days - The number of action types that were created within the selected time period. Actions status per type - The number of pending, successful and failed actions for each remote action type that have occurred within the selected time period. Actions type - The number and percentage of action types which have been created within the selected time period. Actions status - The number and percentage of action statuses within the selected time period. Events - The number and percentage of system events which occurred within the selected time period. Licenses A/V licenses - The number and percentage of AV licenses available and assigned to devices. A/V licenses validity - The number of days remaining on your AV licenses. KRMC licenses - The number and percentage of KRMC licenses available and assigned to devices. KRMC licenses validity - The number of days remaining on your KRMC licenses. 69

70 Appendix C : KRMC License Management Appendix C: KRMC License Management KRMC License Management (Cloud Edition) When Defender Devices are first purchased: 1. KRMC-Cloud is a license for managing Kanguru Defender hardware encrypted devices ranging from Flash Drives to Hard Drives/SSDs. It is available as a 1 Year, 2 Year, or 3 Year option. 2. KRMC-Cloud is an optional license and is a separate line item from the devices themselves. In order to incorporate your devices with KRMC-Cloud, a license must be purchased for every device that is to be managed. As an example, if 100 Defender devices are purchased, the order would need to include 100 KRMC-Cloud licenses. 3. When the first order is placed, an auto-generated is sent to the person identified as the account Super Admin with instructions for how to setup KRMC the first time. An account is setup under that person s , and the 100 licenses are deposited into the account. 4. Devices can be registered to the KRMC account in three ways: By Kanguru as a service, prior to shipment. By IT/Admin of the device using a free, downloadable tool from Kanguru s support site, allowing for up to 8 devices to be registered in seconds, at one time, using a common USB Hub. The tool and guide are available for download here: en-us/articles/ cloud-provisioning-tool-version One at a time by users. Many Admins do not wish to involve users in remote management registration, however, it is possible and sometimes necessary when devices are purchased and issued to users without remote management, and it becomes desirable at a later point. For this method, users plug in a device and Enable KRMC during the Setup Wizard, at which time, the Super Admin of the account can provide a KRMC Cloud Server ID associated with their account to register the devices to KRMC. Or if the device is already configured, the user can open Security Settings from the Kanguru taskbar icon, Enable KRMC, and register. Note: Once a device is registered to a KRMC account, using any of the above options, it cannot be changed by users. A certificate is exchanged with the KRMC server and the devices is connected to it until the Super Admin removes the device from the KRMC account. Renewing KRMC Licenses: 1. The Super Admin should log into KRMC and review the Device page on a regular basis. Organize the device list by Last Connected to see if any devices have not been connected for a long period of time. Devices not seen for at least 18 months can be removed, if desired, from the KRMC account or parked as deactivated (for information on parking, see section 10.3 Parking Licenses Tab on p.57). This will prevent licenses from being assigned to devices that may be lost, out of commission, etc. Once devices are cleaned up and only those that are to be continually managed remain, move on to next step. 2. Log into KRMC, go to the Licenses page and run the calculator for the period of time that you wish to purchase licenses for. As an example, if six months is selected, the system will calculate how many KRMC licenses are required to accommodate devices with expiring licenses over the next six months. Once the licenses are purchased, they will sit in the account and automatically assign to devices as their licenses expire over that period of time. As mentioned, KRMC licenses can be 1 Year, 2 Year, 3 Year. If 1 Year licenses were bought, then as device licenses expire over that six month period, new 1 Year licenses will be assigned automatically from the pool and the devices will continue to be manageable by KRMC for another 365 days. 70

71 Appendix C : KRMC License Management KRMC Cloud Pro KRMC Cloud Pro is an optional, site license that upgrades the KRMC Cloud account to allow for unlimited, assignable sub-admins. It is available as a 1 Year, 2 Year, or 3 Year license. Typically for larger organizations, KRMC Cloud Pro allows the account Super Administrator to add sub-admins and configure what the sub-admin can and cannot do. As an example, a sub-admin may be allowed to reset user passwords, but not allowed to wipe the user s device of all data. Renewal is easy; once a site license is purchased, it is immediately delivered to the KRMC account and the account is upgraded to KRMC Cloud Pro. Notification is sent by to the Super Admin within 60 days of license expiration. If the KRMC Cloud Pro license is allowed to expire, the sub-admins will remain, but they will not be allowed to log in to manage the console. Once the license is renewed, the subadmin accounts will be active again. 71

72 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services Appendix D: Integrating KRMC with Microsoft Active Directory Federation Services This section provides background and steps required to integrate AD FS with KRMC for enabling SAML based Single Sign On (SSO) for KRMC. Prerequisites: This feature currently supports only SSO logins for KRMC Super Administrators (SA) and Regular Administrators (RA). The following prerequisites apply for this feature to work: The SA and RA accounts who will use SAML SSO must already be configured as KRMC administrators in the KRMC UI. Please refer your KRMC manual for information on how to create a RA account in KRMC. Customer must have Microsoft Active Directory Federation Services (AD FS) to integrate with KRMC. KRMC does not currently support SSO via 3rd party identity providers, though this may change in the future. Exclusions: KRMC SSO currently does not support detailed user management via AD FS. Only SAML based SSO logins for existing KRMC administrator accounts is supported. Background: Active Directory Federation Services (AD FS) is a software component developed by Microsoft that can provide users with Single Sign On (SSO) access to systems and applications located across and outside the organizational boundary. For further reading, a link to AD FS on MSDN is here : Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between 2 different systems, commonly referred to as Identity Provider (IdP) and Service Provider (SP). For further SAML reading, please refer to : Integration Steps: When integrating KRMC with your AD FS, the following 3 steps are involved: Step 1: AD FS configuration Setting up relying party trust Step 2: AS FS configuration Setting up claim rules Step 3: KRMC configuration Providing your AD FS information in KRMC user interface These steps are detailed on the following pages. 72

73 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services Step 1: AD FS configuration Setting up relying party trust 1a. Open AD FS Management and select Relying Party Trusts. 1b. Click on Add Relying Party Trust on the right side, in the Actions section. Click Start on Welcome screen. 1c. In the Select Data Source screen, select the last option Enter Data About the Party Manually and then click Next. 73

74 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services 1d. On the next screen, enter a Display Name for KRMC SAML login and then click Next. 1e. On the choose Profile screen select AD FS profile and then click Next. 1f. Leave default values for Configure Certificate and then click Next. 74

75 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services 1g. Select Enable support for the SAML 2.0 WebSSO protocol, enter the KRMC SAML login URL: <KRMC URL>/app.php/saml_login as the relying party SAML 2.0 SSO service URL, and then click Next. 1h. Add relying party trust identifier: <KRMC URL>/app.php/saml_login and then click on the Add button. Click Next. 75

76 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services 1i. Select Permit all users to access this relying party for Authorization Rules and then click Next. 1j. Leave default values on the Ready to Add Trust screen and then click Next. 1k. On the Finish page select Open the Edit Claim Rules dialog and then click Close. 76

77 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services Step 2: AD FS configuration Setting up claim rules 2a. To create a new rule, click on Add Rule. 2b. Select Send LDAP Attributes as Claims and then click Next to create the rule. 77

78 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services 2c. On the next screen do the following: 1. Enter name for rule. 2. Select Active Directory as Attribute store. 3. From the LDAP Attribute column, select Addresses. 4. From the Outgoing Claim Type, select Address. 5. Click Finish to save the new rule. 2d. Create another new rule by clicking Add Rule, this time selecting Transform an Incoming Claim as the template. On the next screen do the following: 1. Enter name for rule 2. For Incoming Claim Type select Address 3. For Outgoing Claim Type, select Name ID 4. For Outgoing Name ID Format, select 5. Click Finish to save the new rule. 2e. Click OK to finish. 78

79 Appendix D : Integrating KRMC with Microsoft Active Directory Federation Services Step 3: KRMC Configuration - Providing your AD FS information in KRMC user interface 3a. Open and login to KRMC in your web browser. 3b. Navigate to Settings-> Server Settings to reveal the SAML settings configuration area. 3c. Configure the SAML settings on this page. To get the required information, please check with your IT team or refer the AD FS metadata XML file: -- Entity ID: This is the Entity Id Issuer. -- SAML SSO URL: This is the URL where KRMC will redirect the administrator for authentication. This would usually point to your organization s SSO URL. -- Certificate: This is the X.509 certificate. A sample metadata file and the necessary fields within the file are shown below: Additionally, your KRMC needs to be configured to either force SAML logins for your administrators or to allow non-federated KRMC logins as well. Please select the appropriate option as needed in your environment. If you wish to restrict your KRMC administrators to only authenticate using SSO, please select AD Federation using SAML only and then click Save SAML Settings. Caution! Please ensure that the SSO integration is working as expected before restricting the administrator login option to SSO only. 79

80 Kanguru Solutions 1360 Main Street Millis, MA v Kanguru Solutions Legal terms and conditions available at Please review and agree before use. Thank you.