ACTAtek Certified Access Control Professional Text Book

Transcription

1 ACTAtek Certified Access Control Professional Text Book 1

2 Introduction The ACTAtek is a Linux, web-based Biometrics and RFID smart card ID management system for access control, time attendance and payroll systems. ACTAtek is SSL-encrypted with all software and hardware built into the system. It can be used in a standalone mode without the need of a dedicated architecture, but it can also be used in conjunction with existing infrastructure. It is easily and highly scalable, one can install one unit day and expand to thousands tomorrow using existing TCP/IP network. The system can support all legacy cardbased systems and provides immediate integration with a company's IT and security systems. The ACTA3 is a perfect hardware platform for your workforce management applications giving your end-customers a Real-time, biometric/smartcard authentication, security based on location/time based access control, time attendance reporting, leave management, workflow management for visitors/contractors, shift roster scheduling and payroll. It also give your end-user the added benefit of a robust and reliable web-based access control and video surveillance solution in one platform. We provide solutions (hardware and software) across the range of small business to enterprise-wide deployment of Biometric and RFID Smartcard ID Management in global networks (with our SmartTime and Access Manager offerings). Networking IP devices and real time data gathering, processing and reporting are becoming significant challenges for SME and Fortune 500 companies. ACTAtek has been providing scalable solutions for over 10 years now the platform is mature, robust and flexible. It is matter of pride for us to share with you that ACTATEK product line has been awarded by numerous internationally recognized prestigious awards such as SC Magazine UK 5 Star Products for World s best product rating, Frost & Suvillan Market Leadership Award. 2

3 Table of Contents Introduction... 2 Chapter Access Control What is Access Control? Access Control System Operation Credentials Types of Authentication Different type of Smart card supported by ACTAtek Biometric Authentication Performance Identifying Good and Bad Image Fingerprint Enrollment Understanding of Fingerprint Automatch Chapter ACTAtek Product Overview ACTAtek Built-In relay and dry contact ACTAtek Console Log In Chapter Web Administration Personal User User Administrator Network Administrator Super Administrator SSL Encrytion Terminal Status Super Administrator Guide Terminal User Administration Access Control Terminal Settings Terminal... 19

4 3.13 View Event Log Deleting Event Logs Add Event Log View User List Delete/Deactivate/Activate Users: Add New Users Add A New User: Departments Add a New Department: Modify Existing Departments: Delete Existing Departments: User Messages Add a New Message: Delete an existing User Message: Access Control Access Groups View/Delete Existing Access Groups: Add a New Access Group Modify an Access Group Add a New Access Right To Delete/ Modify Access Right Holidays Settings Terminal Settings Terminal Setup Authentication/Log Setup Log Setup Additional Security Options Terminal List Door Open Schedule Bell Schedule Connection Profile Terminal Clock

5 3.36 External Devices Cloud Storage Service Short Message Service(SMS) Alert Log Settings Alert Log Backup System Data Restore System Data Firmware Upgrade Download Report Capture Fingerprint Capture Picture Remote Door Open Reboot Register Chapter Additional Security Options Auto IN/OUT Reject Repeated Event: Anti-pass back: Lunch Break / Lock Out: Chapter Door Connections Fail-Safe Lock with 1 ACTAtek Unit Fail-Safe Lock with 2 ACTAtek Units Fail-Secure Lock with 1 ACTAtek unit Fail-Secure Lock with 2 ACTAtek Units Connection From ACTAtek to I/O Box Chapter Hardware Reset Chapter ACTAtek Applications ACTAtek Agent (Middleware)... 63

6 7.2 ACTAtek TA Access Manager Suite Accessing AMS Configuring ACTAtek Terminals View Device Information Enable Access Manager Mode Register ACTAtek to AMS Access Manager Suite Functionalities Auto User Synchronization Add Users View/Edit User Bulk Changes On Users Add/Edit/Delete Departments Add/Edit/Delete Access Group Add Access Right View/Edit Access Right Edit Triggers Trigger Schedule Setup Holiday Setup Door Open Schedule Bell Schedule View Event Logs Add Manual Event Logs View/Delete Manual Event Logs View Terminal List Copy Terminal User Copy Group Access Right Copy Trigger Department Association Data Import Reports Daily In/Out Report:... 84

7 Detail Report: Absent Report: Late Report: User Status Report: Roll Call / Fire Report: Auto In/Out Report: Chapter Access Manager Advance Features APB Requirements Auto In/Out Anti-Passback Lunch In/Out Chapter Upgrading AMS Software Database Backup Upgrading AMS from x to x ACTAtek FAQ General Information FingerPrint Enrollment Networking Time Attendance

8 Chapter Access Control 1.1 What is Access Control? In the fields of Physical Security by using electronic access control, is a selective restriction of access to a place and resources. A permission to access a resource is called Authorization either by using two analogous mechanism of access controls that are composed of Locks and Login Credentials. It is a practice of restricting entrance to a property, building, or a room to authorized person. The electronic access control system grants access based on the credential presented. When access is granted, the door is unlocked for a predetermined time and the transaction is recorded. When access is refused, the door remains locked and the attempted access is recorded. The system will also monitor the door and alarm if the door is forced open or held open too long after being unlocked. 1.2 Access Control System Operation The Access Control requires an authorized credential when presenting to a reader. The reader sends credentials information such as ID s, cards, PIN or biometrics to its database to compare all this credential s number to an access rights lists, grants or denies the presented request. If there is a match between the credential and reader database, then reader relay will trigger to unlock the door. Often the reader provides feedback, such as a flashing red LED for an access denied and a flashing green LED for an access granted. However some Access Control devices such as ACTAtek can work on a standalone mode and network mode. It has its memory to store user s credentials such as templates and logs. It has an option to operate and control doors without the need of any control panels and servers to store data s. But logs data are very important when it comes to Time and Attendance requirements. It is utilized in monitoring, timestamp reports and payroll. 1.3 Credentials A credential is a physical/tangible object, a piece of knowledge, or a facet of a person's physical being, that enables an individual access to a given physical facility or computer-based information system. Typically, credentials can be something you know (such as number or PIN), something you have (such as an access badge), something you are (such as a biometric feature) or some combination of these items. The typical credential is an access card, key-fob, or other key. There are many card technologies including magnetic stripe, bar code, Wiegand, 125 khz, MHz, 26-bit card-swipe, contact smart cards, and contactless smart cards. Also available are key-fobs, which are more compact than ID cards, and attach to a key ring. Typical biometric technologies include fingerprint, facial recognition, iris recognition, retinal scan, voice, and hand geometry. 8

9 1.3.1 Types of Authentication User ID and Password (PIN) User ID and Fingerprint (ID Matching) Fingerprint (Automatch) Smartcard (Quick Access) Smartcard and Fingerprint Smartcard and Password Different type of Smart card supported by ACTAtek Philips Mifare Operating Distance Card Memory Standards Operating Frequency EM Technology Operating Distance Standards Operating Frequency HID Proximity Technology Operating Distance Standards Operating Frequency HID iclass Technology Operating Distance Card Memory Standards Operating Frequency 3-3.5cm 1KB/4KB ISO14443A/B, ISO MHz Up to 8cm EM4001 Compatible 125 khz Up to 8cm Proximity 125 khz 3-3.5cm 1KB/4KB iclass MHz 1.4 Biometric Authentication Refers to the identification of humans by their characteristics or traits. Biometrics is used in computer science as a form of identification and access control. It is also used to identify individuals in groups that are under surveillance. Biometric identifiers are unique to individuals; they are more reliable in verifying identity than token and knowledge-based methods. 1.5 Performance The following are used as performance metrics for biometric systems: False acceptance rate or false match rate (FAR or FMR): the probability that the system incorrectly matches the input pattern to a non-matching template in the database. It measures the percent of invalid inputs which are incorrectly accepted. In case of similarity scale, if the person is imposter in real, but the matching score is higher than the threshold, then he is treated as genuine that increase the FAR and hence performance also depends upon the selection of threshold value. 9

10 False rejection rate or false non-match rate (FRR or FNMR): the probability that the system fails to detect a match between the input pattern and a matching template in the database. It measures the percent of valid inputs which are incorrectly rejected. Receiver operating characteristic or relative operating characteristic (ROC): The ROC plot is a visual characterization of the trade-off between the FAR and the FRR. In general, the matching algorithm performs a decision based on a threshold which determines how close to a template the input needs to be for it to be considered a match. If the threshold is reduced, there will be fewer false non-matches but more false accepts. Correspondingly, a higher threshold will reduce the FAR but increase the FRR. A common variation is the Detection error trade-off (DET), which is obtained using normal deviate scales on both axes. This more linear graph illuminates the differences for higher performances (rarer errors). Equal error rate or crossover error rate (EER or CER): the rate at which both accept and reject errors are equal. The value of the EER can be easily obtained from the ROC curve. The EER is a quick way to compare the accuracy of devices with different ROC curves. In general, the device with the lowest EER is most accurate. Failure to enroll rate (FTE or FER): the rate at which attempts to create a template from an input is unsuccessful. This is most commonly caused by low quality inputs. Failure to capture rate (FTC): Within automatic systems, the probability that the system fails to detect a biometric input when presented correctly. Template capacity: the maximum number of sets of data which can be stored in the system. 1.6 Identifying Good and Bad Image A good fingerprint image is one in which the core of the fingerprint is well-defined and easily recognizable. The core of a finger is defined as the point located within the inner most recurring ridge, it is normally located in the MIDDLE of the fingerprint. It is therefore critical when enrolling that you place the finger on the scanner where the entire core can clearly be seen. Good Image: The whole fingerprint core can be seen clearly. Bad Image: An image where the crackles & displacement of the fingerprint core makes it unrecognizable. 10

11 1.7 Fingerprint Enrollment Step 1: Place the center of any one finger directly above the sensor right in the center, as Shown above. Step 2: Place the center of the same finger (enrolled in Step 1), slightly aligned to the left. Step 3: Place the center of the same finger, slightly aligned to the right. After each placement, wait for the message Template Stored on the LCD screen to appear, and then remove your finger and press Enter/Return to enroll the second or third finger(s) Understanding of Fingerprint Automatch In other terms it is called Automated fingerprint identification is the process of automatically matching one or many unknown fingerprints against a database of known and unknown prints. It is closely related technique used in applications such as attendance and access control systems. On a technical level, verification systems verify a claimed identity (a user might claim to be John by presenting his PIN or ID card and verify his identity using his fingerprint), whereas identification systems determine identity based solely on fingerprints. Fingerprint matching algorithms vary greatly in terms of false positive and false negative error rates. They also vary in terms of features such as image rotation invariance and independence from a reference point (usually, the "core", or center of the fingerprint pattern). The accuracy of the algorithm, print matching speed, robustness to poor image quality, and the characteristics noted above are critical elements of system performance. Fingerprint matching has an enormous computational burden. Some larger Access Control vendors deploy custom hardware while others use software to attain matching speed and throughput. In general, it is desirable to have, at the least, a two stage search. The first stage will generally make use of global fingerprint characteristics while the second stage is the minutia matcher. The biometric fingerprint module uses optical scanner technology with a 500 dpi resolution and it can be accessed either with a 1:1 authentication (ID match) or 1:N authentication.(auto- Match) Note: The 1:N authentication(auto-match), although convenient, has its limitation in the maximum number of users. With any database, the more users in the system, the slower the authentication & verification time of the unit since the system has to check its entire database for that 1 specific fingerprint for authentication. It is therefore highly recommended for users to key in their ID, and then presents their fingerprint for a much quicker & accurate verification process. 11

12 Chapter ACTAtek Product Overview State of the art embedded, encrypted Linux web server technology that offers: Biometric, Smartcard, Password all-in-one multiple credential authentication Standalone or network mode operation Optional photo and video capture for added security SSL encrypted communication between terminals & browser Instant notification via SMS, and onscreen 2.8 TFT display 500 DPI optical fingerprint scanner Ease of Installation and Management Embedded software, no software installation necessary. Control, configure & administrate via web browser Multi-lingual interface (LCD & Web interface) Optional built in POE. Expandability and scalability Up to 500 photos (FIFO internal storage) 1000, 3000, 5000,10000, 15,00 or 20,00 users Up to 75,000 event logs Weigand 26-bit output (Option: External I/O board) Multiple credential authentications o Fingerprint only o Smart Card only o Smart Card + Fingerprint o ID + Fingerprint, and o ID + PIN. o Smartcard option: Mifare, HID iclass, HID Proximity, EM & CEPAS IP65, weather & impact resistant casing 12

13 2.1 ACTAtek Built-In relay and dry contact JP18:Used for 12V 1A power output. JP20:Used for video output. The output can be connected to any television or monitors with AV input. J3:Used for alarm purpose, when the case of the unit is open, the alarm will be triggered. When it is triggered, the two pins will be short circuit. J4:Used as door switch1. JP17:Used for debug or connecting external IO board. JP19:Used for connecting external card readers. J6:Working as a doorbell. If doorbell key on the front panel is pressed or it is enabled from the web page the two pins will be short circuit. P4:Used to connect external modem. J2:Used for door strike. NO (normal open) is open circuit normally, and will be short circuit when door is open. NC (normal close) is short circuit normally, and will be open circuit when door is open.k Sytem Configuration 2.2 ACTAtek Console Log In 13

14 14

15 Chapter Web Administration ACTAtek3TM is using TCP/IP network protocol with its embedded web server technology, which allows the administrator to have remote access via any standard web browser, e.g. Internet Explorer or Firefox. We will use Internet Explorer as our demonstrative guide; it works the same way for Firefox or any other standard web browser e.g. Chrome/Safari. 15

16 ACTAtek3TM permits for 4 access levels: o Personal User o User Administrator o Network Administrator o Super Administrator 3.1 Personal User The personal user login only allows for users to check their attendance records, and view their reports. No changes or modification is admissible through this configuration option. This is for employees who wish to check their attendance records or other reports generated by the system. 3.2 User Administrator The user administrator access level lists a different set of configuration changes that can be made to pertain to HR or Payroll requirements. The changes can be made to Access levels of different departments, addition and monitoring of job functions, reporting, as well as, managing the employee list. Add / Delete of employees can be done here, restricting access to doors for different employees can also be done by the user administrator. 3.3 Network Administrator The network administrator is in charge of system configurations, such as, networking settings, terminal settings, clock setups, or password setups. Everything that involves technical knowing will be done by the network administrator. This role is usually assigned to a techsavvy person, who is capable of making appropriate configuration changes and has basic knowledge of networking setup and IT-related issues. 3.4 Super Administrator The super administrator login combines the functions of 1-3, so the administrator is in charge of the whole system, including technical and administration functionalities. This guide is focusing on the Super Administrator usage which essentially covers all the functions. 3.5 SSL Encrytion When (default IP Address of the ACTAtek3TM unit) is typed on the address bar of IE or Firefox or any other web browser, the login page will appear. Click on Secure to login using secure SSL data encryption, so that ALL the exchange of data is encrypted and secure. 16

17 After selecting Secure login, the above screen will be displayed and to go on to login to view the web interface of ACTAtek3, select either Accept this certificate permanently or Accept this certificate temporarily for this session. It is recommended to have the temporarily selected if you are not using your PC / laptop for this http session, so that others cannot use this site without the proper authentication. Make the selection and click OK. If you do not wish to continue in secure mode, select Do not accept this certificate and do not connect to this Web site, or simply click Cancel. The login page will reappear, input the login ID and password, and login level to proceed. 3.6 Terminal Status The first page displayed, as above, will be the same no matter which login is chosen. It will show a brief status of the terminal. The information displayed includes: 17

18 3.7 Super Administrator Guide After logging in under Super Administrator (Default ID: A999, password: 1), the left panel will differ from the other administrator(s), as can be seen below. All options will be available for configuration and modification of the system and user configurations. The System Administrator is usually the person who is in charge of the whole system, which includes the networking and technical side of works, as well as the HR and administration side. The Super administrator option is either a top executive who has control over the company data and knows the technical aspect too. Moreover, for small companies the roles of both the User and Network administrator(s) may be combined to one, and this is main role of the Super Administrator. From the left panel, the user administrator will be able to choose from the following: 3.8 Terminal 1. Log off - To log off from the system. 2. Terminal Status - To view the overall terminal status 3.9 User Administration 1. Attendance Report - To view the attendance report of users in the system. 2. Daily Report - To view the daily report of users in the system 3. View Event Log - To view the event log of the users in the system 4. Add Event Log - To add an event log into the system 5. View User List - To view the list of users in the system 6. Add New User - To add a new user into the system 7. Departments - To view the list of departments or add a new department 8. User Messages - To send the personalized messages to individual users during clock IN/OUT.(Standalone mode) 3.10 Access Control 1. Access Groups - To view or modify existing access groups or add a new group 2. Triggers - To view or modify the trigger list. 3. Holidays Setting - To setup the systems for recognizing holidays for unique settings Terminal Settings 1. Terminal Setup - To view modify the terminal settings, e.g. IP / Gateway. 2. Authentication / Log Setup - To setup the behavior of authentication log. 18

19 3. Terminal List - To view the list of terminals connected. 4. Access Client Setup - To setup the ACTAtek to the Access Manager. (Under [Access Manager] mode) 5. Door Open Schedule - To view or modify the door opening schedule. 6. Bell Schedule - To view or modify the bell schedule period. 7. Connection Profile (reserved) - Use for manual Agent configuration. 8. Terminal Clock - To view or modify the terminal clock settings. 9. External Devices - To connect external I/O board to the ACTAtek3 unit Terminal 1. Cloud Storage Service - Google Drive Spreadsheet integration 2. SMS Service -To setup the SMS service 3. Alert Log -To setup which action gives out alert log 4. Syslog -To enable the remote system log 5. Backup System Data - To backup the system data. 6. Restore System Data -To restore the system data from a previous setting 7. Firmware Upgrade - To upgrade the firmware or patch files provided by ACTAtek support team 8. Download Report -To download access log report to CSV or TXT format 9. Capture Fingerprint - To capture fingerprint images (for review purpose). 10. Remote Door Open - To open the door using the web interface. 11. Reboot - To reboot the unit remotely. The above is a brief overview of what the features on the left panel are, in the next section, you will be able to understand for more details about what each function does, and how to set up your ACTAtek3TM and manage the system accordingly View Event Log Under User Administration, the first option listed is View Event Log, by clicking this following screen should be displayed: There are 6 different searching options available to view the Event Log which include User Name, User ID, Department, Event, Period or specify the Dates To & From. The information listed by an event log is User ID followed by Name, Department, Date & Time, Event, Terminal, Capture Image and Remark. The Remark column shows how the user has gotten access by PIN, Fingerprint or Smartcard. It shows the login ID for PIN, the Smartcard number by card. If the Log Unauthorized Event is enabled, you can see which method the unknown user tried to gain access whether it is smartcard, fingerprint or PIN. To sort the list, click on the column header, for instance, to sort by Event, click on the column header Event, which is in blue, and the list will be sorted in alphabetical order. By default, the displayed list is sorted by Date/Time. 19

20 3.14 Deleting Event Logs To delete event logs, click the drop-down menu at the bottom of the page, and you have an option to clear logs that are older than the available selection time. These are this week, last week, this month and last month Add Event Log There are many times when a user forgets to clock in or clock out from their terminal. This option is especially introduced for Administrators to make the export of the data more accurate so that it can be easily handled by any payroll system without much hassle. Only User Administrators and Super Administrators have the power to add/modify an event log, which could cause changes to the report and must be treated carefully. The following shows you how to add an event log into the system. Select Add Event Log under User Administration from the left of your screen, and the above screen should be displayed. Enter the Employee ID for whom the event is being added, and enter the Date & Time in yyyy/mm/dd & hh:mm:ss formats. Select the Event & Terminal being added from the drop down menus. Select the radio button Enable to add a remark to this event log entry (optional). Click Add to append the event to your unit or Reset to cancel any changes made. Once Add is successfully completed, the confirmation message Add Event Log Successful should appear in red color View User List To view the users already enrolled in the system, either by fingerprint or smart card or PIN, click on View User List under User Administration from the left column. 20

21 There are 5 different searching options available to view the User List which include Last Name, First Name, User ID, Department or Access Group. The information listed in a user entry is User ID followed by Last Name, First Name, Other Name, Active, FP, SMC, PSW, A/M, A/M Group, and IN/OUT. Description of Information displayed: Feature Active FP SMC PSW A/M A/M Group IN/OUT Description The Status of the User: Black Active, Grey - Inactive Whether Fingerprint is an available authentication option. Whether Smart Card is an available authentication option. Whether Password / PIN is an available authentication option. Whether Auto-match is an available authentication option. Whether Auto-match Group is an available authentication option. Whether the user is currently In or Out of Premises. To sort the list, click on the column header, for instance, to sort by Last Name, click on the column header Last Name, which is in blue, and the list will be sorted in alphabetical order. By default, the displayed list is sorted by ID Delete/Deactivate/Activate Users: To delete users from the system, you can select the checkboxes on the left of the ID under User List. If all the users need to be deactivated/deleted/activated, click the Select All to check ALL boxes. To cancel the selection, click on Deselect All. Once selected, click the respective buttons at the bottom of the page, as shown below. Once deleted, the user will no longer be in the system and all their relevant information will be removed from the system, so make sure you really want to delete them before carrying out the process. Deactivation can take place if users or employees are no longer required to use the system for a period of time to prevent unauthorized access to the premises. Once you deactivate a user, the dot in the column Active will appear grey. To activate them again, check the box next to their ID and click Activate. This is a lot more flexible than deleting a user, since it will keep the user in the system but just restrict access for the specified time Add New Users There are 2 ways of adding users to the system; you can either add them directly at the web interface, or at the terminal. We have already discussed how to add a user at the terminal (in Section 6.2), now let us look at how to add a user directly from the web interface. 21

22 3.19 Add A New User: Click on Add New User from the left column under User Administration, the following page will be displayed: Enter the User ID, Last Name, First Name, Other Name, Admin Level and enter the password in the following field. Check the relevant boxes for the relevant Access Group, this will limit or give them access at different times or doors, depending on the configuration made. Assign the Department for the user accordingly. Select a desired fingerprint security level which ranges from Low Normal High Highest. This selection affects only to the ID match ONLY and does not affect to Automatch feature. Select the status of the user, whether they can use Auto Match or Password, and you can set the expiry date of the user if any. After that, you can click Add to add the new user. Note: Auto Match will be available when there is a FingerPrint enrolled already. Note: First Lunch IN time (Reset) will be available when [Lunch Break Lock Out] feature was set,and F1 trigger event log was generated Departments This option under User Administration can be used to Add new departments, modify existing departments or delete them. 22

23 3.21 Add a New Department: Click on Departments under User Administration from the left column. Enter the Department Name, and description and click Add to append the department to the existing list Modify Existing Departments: Click on the Department ID, which will fill in the blanks above and make any changes, after which, clicking Modify would confirm the modification, or Reset to abort the modification. 23

24 3.23 Delete Existing Departments: Select the check boxes of the Departments to be deleted, once selected, click Delete to remove them from the list of Departments, or Clear to abort the deletion. Please note deleting a Department will cause its underlying Access Groups to be deleted too User Messages This option can be used to send personalized messages to individual users, who will be able to view them once they are authenticated at the ACTAtek3TM unit Add a New Message: Click on User Messages under User Administration on the left column, the following screen should be displayed. Enter the User ID and User Message in the User Message text box. Optionally, the message can either be displayed on the LCD screen of the ACTAtek3 or sent directly to their address, or Notify to SMS. Click Submit to send the message to the user or Reset to abort the message. Please ensure that the message does not contain more than 25 characters per line, a maximum of 5 lines are accepted per message. Note: You can enable Delete the message after display once if the user message will only displayed one time Delete an existing User Message: Check the box of the relevant message, and if all need to be checked, click Select All, and click Delete. If the delete does not need to be made, click Deselect All to uncheck all boxes Access Control Access Groups An Access Group allows for users to be given standard access for the workplace. Different departments may have different access rights and some corporations have employers who are on shift duties, and may need different access levels for each shift, depending upon their time of entry and exit from the workplace. To 24

25 fasten the procedure of giving access rights, it can now be done for groups, instead of individuals to simplify the process and give it more transparency. This option can only be configured by the User Administrator or the Super Administrator View/Delete Existing Access Groups: Click on Access Groups under Access Control from the left column, which will display the following page: You can search the access groups by Department, and click Search. To Delete the Access Group(s), check the relevant box and click Delete, or use the Select All option to select ALL the access groups; or use the Deselect All option to clear the selection Add a New Access Group Under Add Access Group, select the relevant Department from the drop down menu and input the name of the access group being added, and click Add Modify an Access Group Click on the access group number to view the Access Group. There are two parts in this page. 25

26 The top part displays the Access Group Name and associate Department. This can be modified by renaming the Access Group Name and/or assigning to a different Department. The bottom part shows a list of Access Right exist under this Access Group Add a New Access Right Click on Add Access Right. Select which terminal this access right is assigned to, and set whether Quick Access is enabled or disable. ( Disable : it can be used for dual access e.g.smart Card plus FingerPrint to access the device.) Click on Set Terminal for proceed, as shown in the following page. On the next page select the days applicable for Day. Check Always will apply to all days. Then select the From and To time this access right is either enabled or disabled. (Disabled access means nobody is allowed access to the unit from the relevant access group. Each user is assigned an access group when they are added into the system.) Once the timings are assigned, select whether the access is enabled / disabled in that period, and select Set Time to confirm. 26

27 By default all access is disabled. You can now either add another time setting for the same access right by select Set Time or create another Access right by selecting Submit & Create another Access Right and repeat the above steps, or confirm this access group by clicking Submit Access Group To Delete/ Modify Access Right To delete any access right, under the Modify Access Group page, check the relevant box then click Delete. If all access rights are to be removed, click Select All then click Delete to remove them from the system, or click Deselect All to undo the selection. To Modify the Access Right, click on access right number under Access Right ID. The information that can be modified includes: Quick Access: -Choose to access the device using FingerPrint or Smart Card or PIN (Quick access: Enable) or dual access (Quick access: Disable) The Access Time: -From which day and when does this Access Group is allow to access the terminal. 27

28 Users can then set each terminal's trigger schedule individually. Setting a Trigger schedule will display the respective Trigger as the default Trigger on the bottom right corner of the ACTAtek3 LCD screen, and will save the Event Log with the selected Trigger name when the user access the device. The below following page which it will show the time settings for the trigger, grey dots stand for disabled, while the black dots stand for enabled. 28

29 To modify the time settings & other information for the relevant trigger displayed, The information to be modified includes: Trigger Name - Display name for the Trigger. Day - The days for the setting to be adjusted. From (Time) - Select the onset of this trigger. To (Time) - Select the end of this trigger. Set - Set whether to enable or disable it. To confirm the change, click Modify to set the Trigger Name and Set Time to update the schedule Holidays Settings The Holidays Settings option is for companies that have unique access rights or options for those days. Holiday setup can be done from Access Rights Control by clicking on Holidays, which will show the following screen: To add a new holiday, either click on the calendar to find the dates to add. Or type out the date in yyyy/mm/dd format and click Add. To remove holidays, click on the holidays already in the list and they will be automatically removed from the system Terminal Settings Terminal Setup To make any system configuration changes to the system, click on Terminal Setup under Terminal Settings from the left column. All system changes that are technically related will be available from this option for the network and super administrator. 29

30 The options that can be changed include Network Settings, Fingerprint Matching Setting & Miscellaneous Setting: Terminal Description - The Description of the terminal IP Address - The IP Address of the terminal (Dynamic or Static) Subnet Mask -If enable DHCP, it will be automatically entered. Default Gateway -If enable DHCP, it will be automatically entered.. DNS Server - If enable DHCP, it will be automaticallyentered. Security Level (for Automatch) - The Fingerprint Security level for the system. Lower the level for higher and successful matching rate. Wiegand Output - This option is to enable Wiegand output from the unit to the external I/O board. Console Display Timeout Settings Welcome Message Timeout -You can select from 1sec to 3 sec. Console Display Timeout -You can select from 30 sec to 1 hour. Terminal Mode Standalone: the device will work with previous ACTA2 SOAP/API. Access Manager: the device is able to register with the Access Manager. Job Code -Disable / Enable. Door Strike 1 Option - Setting for Door Strike to open door. -Emergency Mode -For users who were assigned to EMERGENCY department can open door. -Relay Delay - This will keep the door open for the seconds specified. 30

31 Door Strike 2 Door Strike 2 Door Strike 2 Door Strike 2 Network Camera Language Webserver Port Allowed IP 2-digit Duress Code SMTP Server - Door Strike 1 Clone - To set Door Strike behave as Door Strike1 - Access Denied - To be triggered when the login is access denied. - Bell Schedule - To enable the Bell schedule option. - Active Alarm - Trigger the Alarm connector when door opened more than 30 seconds - To enable external network camera during Remote Door Open. - This option lets you select between various languages. - Specify other port to use for the webserver. - Restrict IP address(es) to access this web interface. - Numeric code use as duress code. This is used as prefix in the user password. - SMTP Server for outgoing mail sent by the unit Authentication/Log Setup Log Setup -Log Event: To choose to disable or enable event logs generated at the device. -Log Size: To choose to store off-line event logs storage size.e.g.10k or 75K. -Log Unauthorized Event: To choose to disable or enable on whether to store the unauthorized event or not. -Accept Unregistered Smartcard: To choose to disable or enable on whether to accept and record the unregistered smart card or not. -Photo Option for Log (Authorized Event/ Unauthorized Event): To choose whether to take a snapshot for the authorized event or unauthorized event. 31

32 Additional Security Options -Auto IN/OUT: It is a feature for time attendance that allow the system assume the first authentication is IN and follow by OUT without having the user to select the function key of IN or OUT. -Auto Rest IN/OUT: The device will reset at 2359hrs and the next authentication will be IN. -Reject repeated event: It is a feature that the device will reject the same event within the defined time. This is prevent double scanning, especially using RFID card -Anti-passback: It is a feature to prevent from the tail-gating.if someone did not have IN event first, he/she will not be able to access the device as OUT event. -Lunch Break / Lock Out: It is a feature to make sure the staff takes their lunch break as the defined time period. Lunch lockout period is configurable from 1 to 120 minutes. This lockout period is the time between F1 (LunchIN) and F2 (LunchOUT). User is not granted access when he fails to meet the above conditions Terminal List The Terminal List option under Terminal Settings can be used to view the list of terminals, and their respective name, type, serial number and IP Address, as shown below. Under Server list, you can check the Event Logs sending status about the last sync. date and time with Agent ver.2 s or Access Manager software s back-end database Door Open Schedule The Open Door Schedule is a feature to control the open access to the door entrance. Fill out the parameters in the page to set up the time for the open access time of the door entrance. 32

33 3.33 Bell Schedule The Bell Schedule option needs to be enabled via Door Strike 2 Option under Terminal Setup page. Once enabled, ACTAtek3 is able to trigger a bell wired to the door strike 2 connector for the scheduled time. 33

34 34

35 3.34 Connection Profile - Reserved for the Agent configuration - Used for Dial-up Modem 3.35 Terminal Clock The Terminal Clock can be modified according to the region you are in. It is extremely useful to have a correct timing for all time attendance purposes or for reporting purposes since that s the time the system will record for any access. If the SNTP (Time server) is enabled, then the ACTAtek3TM will sync. its time with SNTP server each 3 hours. If the SNTP is disabled, the ACTAtek3TM will either have to follow the time on the PC or a time can be set for the device according to the local time settings. To let ACTAtek3TM to follow the time on the PC, select On for Auto Adjust. To disable this auto adjust, select Off and the time setting will be available for users to input the New Date and New Time. Click Set Time to set the device s date/time after Auto Adjust finished. Besides, please select the correct Time Zone where the device was installed at which region. Click Set to save any modifications made External Devices If ACTA3 was connected to the external I/O board, you can see the connection status at external devices page.(note:acta3 device will automatically detect the external I/O board once connected.) 35

36 3.37 Cloud Storage Service Requires Google spreadsheet account to be able to get event logs real-time for every user. Step1. Login to your personal or company's Google Drive account. Step2. Create a "new spreadsheet". Step3.Download and import the "template event log file",and then "open" a new spreadsheet. Note: Download link of template eventlog file 36

37 37

38 Step4. Configure Google Drive setting about who can access the file. See below. 38

39 Step5.Wrtie down and spreadsheet key of Google Drive file. See below. Step6.Login to ACTAtek3's Web UI to set up,and enable ACTAtek3's Cloud Storage Service with correct login detail and right new created Google Doc spreadsheet key. See below. 39

40 Step7.After that, please do the "hardware reboot".(power off & power on). Step8.After the device reboot, the user can start to access the device to generate new event logs which the new event logs will be pushing to Google drive file. You can open your Google Doc link to check the event logs any time from any place. See below. 40

41 3.38 Short Message Service(SMS) 3.39 Alert Log Settings You can configure the alert log settings so that the device will be able to send the system s alert event log to the administrator via or SMS. See below Alert Log You can configure the remote syslog settings to store the device s system logs to the remote server. See below. 41

42 3.41 Backup System Data Backing up is an essential part of any system. It can provide the added security and flexibility that is needed for these devices. With the Backup System Data feature, the system s configuration files can be saved, so as the user data. In general speaking, the user information, event logs, access group, and triggers will be saved during the backup. In that case, it could help the units share the configuration with different devices in the network, or rollback to a previous setting when something goes wrong with the system. To backup the system configuration, click on Backup System Data under Tools from the left column of options. Once selected, click Download to download the data on to the PC. The system will then prompt to save the file in the PC, click on the specified location and save the file Restore System Data If the device may have some issues, and required to restore, you can click Restore System Data option under Terminal in the left column. Click Browse to locate the specified and previous backup system file, once located, click Open. Then click Upload to upload the file back into the system for the previous configuration to take place. 42

43 3.43 Firmware Upgrade Firmware releases will be carried out on a regular basis. ACTAtek R&D team will continue to add new features to ACTAtek3, and provide the download links of the latest firmware for our clients to download. To upgrade your unit with the latest firmware, click on Firmware Upgrade from the left column under Terminal. Click Browse to locate the firmware (once downloaded to your machine from our website). Click Open once the file has been located, and Upload to upload it to your system. You will then be prompted to upgrade your system, this should take a couple of minutes. Once upgraded, please do reboot the unit to take effect the new firmware. Also from this page, the current firmware version can be seen, and the upgrade count is also available to show you how many times the system has been upgraded, for your reference purposes. Once upload is clicked, the system will install the new firmware and your system will reboot automatically to let the new changes take effect. After the device finished Firmware upgrade, you can click Log Off and re-login to the device s Web UI to check the Terminal Status page Download Report The Download Report option allows for easy download of attendance reports of employees in CSV or TXT format. Reports can be downloaded by various different options, as shown below. 43

44 Reports can either be downloaded by: User Name User ID Department Period From/To (Date yy/mm/dd) Event Format CSV or TXT Click Download for the report to be downloaded to your system for payroll or other management purposes Capture Fingerprint The ACTAtek3TM can capture fingerprint in real time and help in analysis of why certain fingerprints are being rejected by the unit or what is causing the rejection. This option helps the technicians better understand the fingerprint issues and what they can do to improve readings. This image is captured via the terminal menu under User Management --> Capture Fingerprint. Once the fingerprint is captured, it can be viewed via the web interface, as shown below. These images should only be used for analysis purposes, and ACTAtek is not liable for any mis-use of these images, please also note that all fingerprint data collected can only be used for scanner analysis with no other purposes. 44

45 3.46 Capture Picture You can use this feature to take a picture for the staff s employee photo or the taken picture can be used for the remote door open purpose Remote Door Open Most organizations or corporations or even small business have visitors coming in and out for meetings, or to drop parcels, etc. Those visitors are not enrolled in the system since they are not part of the company s payroll or should not have access to the office at odd hours. For these reasons, the Remote Door Open feature comes in handy since visitors do not need to be enrolled in the unit to gain access, but the reception or someone near a computer can simply open the door using this feature, which enhances flexibility and convenience of the system. To open the door remotely from any computer, click on Remote Door Open under Tools, which will display the following page: 45

46 Once selected, click Open the Door to open the door remotely. If successful, the message The door is opened will be displayed Reboot To reboot the ACTAtek3 remotely, the 'Reboot' option can be selected. Click on the 'Reboot' button to reboot the unit Register You will be redirected to our support website to register the device s warranty at our support website. Please follow up the product registration steps as shown in the webpage. 46

47 Chapter Additional Security Options 4.1 Auto IN/OUT Admin users can enable this feature at Authentication /Log Setup web page. When this feature is enabled, the trigger set is Auto. Triggers are automatically changed based on previous trigger status of individual user. The picture above shows how Auto IN/OUT works. User login at his trigger is IN and event logs are updated User logout at hours his trigger type is automatically changed to OUT and event logs are updated. 47

48 Following screen shots shows the Time Attendance report and event logs: Reset feature for Auto IN/OUT, if enabled, resets trigger at midnight (00.00 hrs) Consider the following case: 48

49 On Day 1, user login, the trigger is Auto IN, event logs are updated. User forgets to logout (due to tailgating). As the Reset option for Auto IN/OUT is enabled, the triggers are reset over midnight Next day when the user login, the trigger is Auto IN, as per usual. Attendance for Day 1 is not calculated as there is no OUT trigger. Following are the Time attendance and event logs screen shots 4.2 Reject Repeated Event: Admin user can enable this feature at Authentication/LogSetup web page. Reject repeat event duration in seconds has to be fill in, maximum duration being seconds. This duration is for the Reject repeat event to be effective. When the duration is set to 0, Terminal setup failed Invalid Limit for Reject repeated log message would be displayed on web UI and the duration would be infinite. 49

50 When this feature is enabled, the device detects repetition of any trigger type within the specified duration. Consider the following situation: User login using F1 trigger at He once again login using same trigger (F1) within 8 seconds. The device responds Reject Repeated Login. But the subsequent login after the specified duration, will be successful and eventlogs are updated. Following is the screenshot of event logs. 4.3 Anti-pass back: The main purpose of anti- pass back system is to prevent a card holder from passing their card back to a second person to gain entry into the same controlled area. This also improves the accuracy of roll call Last Known position reports and deters tailgating. Anti- pass back sequence being IN-OUT-IN-OUT-IN-OUT. If the user logs IN using his card and then passes his card back to a friend, the card would not work the second time. Because the attempt to use card second time would create IN-IN sequence that is violation of anti-pass back rules. Admin users can enable this feature at Authentication/Log Setup web page. 50

51 Consider the following case: This is the normal anti-pass back sequence. As long as the user follows IN-OUT-IN-OUT sequence, there will be no violations. 51

52 Consider the following case: User login (FP/Smart card/password user), upon successful authentication, event logs are updated. User login once again, the sequence IN-IN is generated which is anti-pass back violation. And hence an error message Anti-pass back violation would be displayed without granting access to the second user and event log (rejected event) will be updated. Following is the screen shot of event logs being generated: Following is another example of anti-pass back violation: Anti-pass back is reset at midnight hours. Consider the following condition: 52

53 User login using IN trigger, upon successful authentication event logs are updated. User logout using OUT trigger, event log is updated. User login once again IN-OUT-IN, user is granted access and event log is updated. But the user forgets to logout due to tailgating. Next day when the user login, he is granted IN access as per usual, as the triggers are reset in midnight (00.00 hours). Following is the screen shot of event logs being generated: 4.4 Lunch Break / Lock Out: Admin user can enable this Authentication/Log Setup web page. Lunch duration called lock out can be fixed between the range 1 to 120 minutes. Default value being 30 minutes. 53

54 All the triggers are available to the user when this feature is enabled. Following are the triggers used to implement the logic: 1. IN This trigger is considered for user login, IN time is recorded for generating attendance report. 2. OUT This is considered as user logout and OUT time is recorded for generating attendance report. 3. F1 Lunch IN trigger. Only the first lunch IN time will be recorded. This time can be viewed and View User List/Modify User. The first lunch IN time is used to calculate the lock out duration for individual user. First lunch IN time will be reset for all the users, every midnight at hours. 4. F2 Lunch OUT trigger. User is allowed to use F2, only when he has first lunch IN time and has over lock out duration. Upon successful lunch OUT, the first lunch IN time will be reset, thus allowing user to have second lunch in. Consider the following case: User login at 9.00 hours and logout at hours First lunch in is at hours. The subsequent F1 triggers will not be considered for calculation of lock out period. But event logs will be updated. 54

55 Following is the screen shot of attendance report and event logs being generated: Working Hours Lunch 1 Lunch 2 ( ) = 9 hours ( ) = 1 hour ( ) = 0.5 hour Total working hours (working hour - (lunch 1 + lunch 2)) (9 - ( )) = 7.5 Consider another example: User has used several triggers throughout the day. Logic to generate Attendance report still remains the same. Following are the screen shots of attendance report and event logs: 55

56 Working hours ( ) = 9 hours Lunch 1 (F2 - F1) ( ) = 1 hour Lunch 2 ( ) = 1 hour Total Working hour (Working hour - (Lunch 1 + Lunch 2)) (9 - (1 + 1) ) = 7 hours Consider another example: Always the lunch IN/OUT time lies within user log IN/OUT range. If the Lunch IN (F1) trigger happens after OUT trigger, then it is considered as invalid entry. 56

57 Error message: Invalid Entry Working Hours: ( ) = 4 hours Total working hours: 4 hours First lunch IN time for all the users will be reset at midnight (00.00 hours). Consider the following case: User is having a valid IN and OUT event. But after lunch IN, the user forgets to do lunch out due to tailgating. User logs IN the next day. For lunch out authentication, the first lunch in made by the user after hours will be considered for calculation and not the lunch IN time that he made the previous day. Following is the attendance and event log screen shots: 57

58 Chapter Door Connections This Chapter assumes that the reader is comfortable with the following terms and concepts; A knowledge of basic DC voltage and circuitry An understanding of basic wiring diagrams Fail-Safe and Fail-Secure Notes: ACTAtek supports 12VDC door strikes/maglock with a maximum current draw now exceeding 1amp. The door strike / maglock must not share power with the ACTAtek. Do not attempt to use the power supply included with the ACTAtek to power both an ACTAtek and a door strike / maglock. Approved centralized power supplies with isolated and filtered outputs may be used. Please contact your sales representative for a list of approved power supplies. ALL DC STRIKE INSTALLATIONS RECOMMEND TO USE A DIODE TO PREVENT EMI DAMAGE!! The diode should be installed on the lead wires of the strike / maglock. The following polarity should be observed when installing the diode: Positive DC voltage is connected to the Cathode end of the diode. Negative DC voltage is connected to the Anode end of the diode. Diode Selection: a) Use P/N:1N4004, if the Door Strike rates at 12VDC/1A; b) Use P/N:6A1, if the Door Strike operating current is within 1-6A. 58

59 5.1 Fail-Safe Lock with 1 ACTAtek Unit 5.2 Fail-Safe Lock with 2 ACTAtek Units 59

60 5.3 Fail-Secure Lock with 1 ACTAtek unit 5.4 Fail-Secure Lock with 2 ACTAtek Units 60

61 5.5 Connection From ACTAtek to I/O Box Instructions on how to connect the reader to your I/O box 1. Connect the RS232 cable provided to the RS232 (JP 17) on ACTAtek 3 unit. 2. Connect Power cables to JP13 of External I/O Board as per diagram. 3. Power up External I/O Board ( Wait for around 2 sec OR wait for amber led remain ON only before continue step 4.) 4. Power up ACTatek3 5. Then Access the terminal WEB UI under [Terminal Settings>External Devices] then hit refresh button to add the I/O board. 61

62 Chapter Hardware Reset 62

63 Chapter ACTAtek Applications 7.1 ACTAtek Agent (Middleware) The ACTAtek Platform is easily configured to become a client/server setup allowing remote, automated data gathering and pushing the data back to the backend database. ACTAtek Agent can support different type of database such as MS Access,MS SQL, Orcale, MySQL, CSV and TXT. This key feature would help the 3rd party application to cut down the development file and to be easily integrated with the ACTAtek ID Management platform such as TA/PayRoll and HR management applications. Key features: Real-time collect Event Logs Support different database for 3rd party software integration MS SQL / MS Access Oracle 9i or above MySQL or CSV/TXT 7.2 ACTAtek TA PC based/client based application where it caters small business to provide the following: Basic TA, Shifting and OT calculation Merge both Database from different terminals Data Import for large number of users 63

64 7.3 Access Manager Suite Introduction Access Manager Suite (AMS) provides centralized web-based control and management to multiple ACTAtek terminal environment setups. It also comes packed with features without any limitation in its software so that the system administrator can have full control of the ACTAtek system at all times, either on site or remotely. In addition, the AMS software gathers event log data from all ACTAtek terminals into a centralized database to simplify user redundant tasks. To enhance user management, AMS will facilitate all data synchronization of ACTAtek terminals from user modifications to newly added users. Adding or editing users in the AMS control center becomes an easy process along with managing access groups and rights, departments, open door schedules, and reports. The AMS software is designed to be robust and versatile so that ACTAtek terminals on different networks, either public or private, can connect and communicate globally. Network Diagram System Requirements CPU Processor Memory Hard Disk Space Network Controller Hardware Requirements Dual Core 2.0 GHz or faster (32-bit/64-bit) 4.0 GB or higher 20.0 GB or higher 100 Mbps or higher 64

65 Operating System Database Server Software Support Software Requirements Windows XP Professional (32-bit) Windows Vista Business (32-bit/64-bit) or above Windows 7 Professional (32-bit/64-bit) or above Windows 8 Professional (32-bit/64-bit) or above Microsoft SQL Server 2005 Microsoft SQL Server 2008 MySQL Oracle Microsoft.Net Framework 2.0, 3.5, & 4.0 Supported Web Browser Internet Explorer 7.0 or higher Firefox 3.5 or higher Chrome 6.0 of higher Safari 5.0 or higher Microsoft.Net Framework Requirements AMS Version:.Net Version Requirement: to x (Latest).Net to Net 2.0/3.5 To download Microsoft.Net Framework, follow the link below: Accessing AMS Method Local computer access to AMS Network access to AMS URL ADDRESS OF SERVER/AccessManager/ Enter the URL applicable to the method of accessing AMS to the address bar of a web browser. 65

66 Activate AMS Press Log In at the top right to obtain this page. Contact ACTAtek support staff and provide the Product Key to them and in return, you should receive an Activation Key back. Log Into AMS Administrator Default Login Details Username Admin Password 1 66

67 Setup Database In AMS Once you've logged in as an administrator, go to Control Panel and then Database Configuration. 67

68 Choose the correct Database Type. Enter in the Database Server Address which includes either the IP address of the database server followed by the instance or localhost followed by the instance. For the Database Name, ensure that you have entered a database name that does not exist in your database server so that is creates a new AMS database. Supply the appropriate User Name and Password with rights to create the database in your database server. Press Setup to proceed and the successful output can be seen below. 68

69 Server Setup In AMS Next step is to go to Control Panel and then Server Setup. Enter a desired Terminal Group name and ensure the Server IP Address corresponds to the detected Server IP. Now provide the time zone information in accordance with your region. A public SNTP server is pool.ntp.org. Now provide a Magic String of your choice which will be used as the encryption and decryption key while transporting event logs over the network. Press the Setup button to save changes. A successful message will appear like in the below image. 69

70 Add New AMS Login Accounts To add new AMS login accounts, go into Control Panel and then Register/Edit/Delete Account under System Accounts. Provide a new Login ID, Name, and Password. Check the boxes for Admin and Activate and press the Register button to add the new administrator account. Assign Permission To AMS Login Accounts Go into Control Panel and then Assign Permission under System Accounts. Press the Select clickable link to change permissions for the corresponding user. Now check and uncheck areas in Access Manager you wish to restrict or grant access for this particular user. Press the Apply button to save the changes. 70

71 7.5 Configuring ACTAtek Terminals Accessing the ACTAtek Web Interface Super Administrator Default Login Details Username A999 Password 1 By entering the IP address of the ACTAtek in a web browser of a computer that is connected to the same network as the ACTAtek, you will be able to bring up the web interface as shown above. Now you will be able to login to the ACTAtek over the network for configuration. *It is important to use capitalized letters in the Login ID field. 7.6 View Device Information To obtain the ACTAtek's device information such as the current IP address, serial number, connectivity status, and more; press the enter key 6 times on the key pad. Follow this sequential pattern: on the key pad. 7.7 Enable Access Manager Mode Once you have logged in as super administrator through the web interface of the ACTAtek terminal, click on Terminal Setup in the Terminal Settings menu. Scroll down on the page and locate the Miscellaneous 71

72 heading. In Terminal Mode setting, switch over from Standalone to Access Manager and press the Submit button at the bottom of the page to save the changes. 7.8 Register ACTAtek to AMS After Access Manager terminal mode is set, proceed by clicking on Access Client Setup in the Terminal Settings menu. Provide an Endpoint URL that point to the Access Manager Suite Server via an IP address followed by the port and the location. Press the Set button to test the Endpoint URL. Endpoint URL: IP ADDRESS OF AMS:80/AccessServer/AccessService.asmx Example: :80/AccessServer/AccessService.asmx If the Register button appears, that means the ACTAtek terminal was able to connect to the Endpoint URL that was provided. 72

73 Troubleshooting: If you are not able to get to the screen with the Register button and Server Status reports offline, check: 1) Endpoint URL for typing mistakes. 2) The IP address of the AMS server is correct. 3) The firewall settings on the AMS server are set correctly such that port 80 is open. Press the Register button to register this ACTAtek terminal to Access Manager. The ACTAtek terminal that is the first to register to AMS with a clean database will push all its user data from the ACTAtek terminal into the AMS database. All following ACTAtek terminals that will be registering to AMS will have its user data replaced by the downloaded copy from the AMS database during registration. When the ACTAtek terminal has finished the registration process, a successfully message as indicated below would appear. 73

74 To verify that the ACTAtek terminal is now registered and connected successfully with AMS, you can login to the AMS web interface and press Terminal List in the menu. It should now list this registered ACTAtek terminal in the terminal list found in AMS. 7.9 Access Manager Suite Functionalities Auto User Synchronization By default, auto user synchronization is set on enabled. All user changes made on the ACTAtek terminals or in Access Manager will propagate updates to all connected ACTAtek terminals to ensure a synchronized state. If you are not sure, leave Auto User Synchronization on enabled for the best performance. This feature can be disabled by going into Control Panel and then System Configuration and selecting Disabled. By pressing the Update button, the changes will then be saved. 74

75 7.10 Add Users To add a new user, go into Access Manager tab, then User Admin and Add Users. The User ID and Password fields must only contain any of these characters found in " ABC". The User ID must also have a length of 3 or more characters long. For fingerprint and smart card enrollments, this will have to be accomplished on any of the registered ACTAtek terminals by providing the associated User ID to the fingerprint or smart card enrollment process. In the status field, ensure Active is checked to enable this new user in the system. You may also wish to check Password if this user can enter through PIN method otherwise leave it unchecked if you do not wish to let this user authenticate through PIN method. Additional settings which you may choose to set for any new user are: department & groups, user information, user expiry date, and user messages. All these user settings can be modified in View/Edit User if you choose not to set any now View/Edit User This feature allows you to make any changes except User ID to an existing user in the system. You can choose to edit, view, or delete an existing user over Access Manager. To delete multiple users, check the boxes that are associated to the users that you would like to delete and press the Remove button. 75

76 To narrow down a specific user, the search options allows you to search by User ID, First Name, Last Name, Department, and or Group. To view the search result, press the Search button Bulk Changes On Users Bulk changes on users allow the administrator to make changes to multiple users in Access Manager at the same time. Press the Refresh button to reveal a list of users in Access Manager and check the boxes associated to the users that you want to make changes to. Changes include enabling or disabling user settings for: user active status, fingerprint, automatch, password, and smart card. Additionally, adjustable user settings apply to fingerprint quality, departments, and groups. For each change, press the Set button to save the changes to the queue. When all the changes are made, press the Commit button to permanently make the changes to the selected users. The registered ACTAtek terminals will now enter System Maintenance Mode while these changes are being made Add/Edit/Delete Departments Departments are used for associating users into main groups. This feature allows the administrator to add, edit, or delete departments in Access Manager. Departments also help categorize users and will be the foundation for setting up Access Groups and Access Rights. To associate users to departments, you will edit a selected user in View/Edit User and in the Department tab, check the listed departments relevant to this user and press the Update button to save the changes. 76

77 7.14 Add/Edit/Delete Access Group The default settings of Access Manager already have predefined access groups. The administrator may choose to customize or remove irrelevant access groups and departments to personalize their setup and environment. Setting up an access group is the next step in creating an access right. Access groups are used to distinguish different levels of access in a department Add Access Right An access right is an access control policy used for binding an ACTAtek terminal to an access schedule with the associated department and access group. This will enforce users in that associated department and access group to the access schedule as defined by the administrator. The advantage of using access rights is that it will provide the access control rules to ACTAtek terminals. For example, using access rights can limit certain user groups to certain ACTAtek terminals. Additionally, it can restrict the time and days when a user can have access. To setup an access right, provide an Access Right Name followed by selecting a Dept/Group Name from the list which this access right will affect. Users in this department and access group will have this policy applied to them. Next, select an ACTAtek terminal from the Terminal Name / SN list to apply this access right to and set Quick Access to enable. 77

78 In the Day & Time field, the administrator defines the restrictions and the rules in terms of a schedule. By default, the schedule has all time and days of the week disabled which can be referenced below by the light grey dots. After making setting changes to the Day & Time field, press the Modify Time button to review the changes made. The filled black dots are set for enabled while the light grey dots are set for disabled. In the example above, the affected department and access group can only access the ACTAtek terminal on every Tuesday from 07:00 to 17:59. Press the Add button to add this access right to Access Manager. Notice that this access right only affects a single ACTAtek terminal therefore to have this access rights affect all your ACTAtek terminals, you will have to add a new access right for each individually ACTAtek terminal. Use the existing access right schedule drop down list to load any already defined access schedules. If an access right does not exist in Access Manager for a particular department and access group, this means that the users belonging to this group will not have access to any of the ACTAtek terminals and they will receive an access denied message upon authentication. To associate users to this department and access group, you will edit a selected user in View/Edit User and in the Group tab, check the listed department and group relevant to this user and uncheck all that are no longer relevant. Press the Update button to save the changes. A user can belong to more than one access groups. 78

79 7.16 View/Edit Access Right The administrator can view/edit/delete any defined access rights in Access Manager by using this functionality. By default, all registered ACTAtek terminals will create an access right with the department General and group General Staff. This means all newly registered users will have access to all the ACTAtek terminals in the system. The administrator may want to remove these default access rights so that the newly registered users must be placed in their correct department and group before allowing them access on the ACTAtek system Edit Triggers Make changes to the trigger name/value for an individual ACTAtek terminal by clicking Edit for the corresponding trigger and terminal ID you wish to edit. The administrator can choose to disable all unused triggers by clicking on the edit action and selecting disabled and then followed by clicking on Update. Make all trigger changes to an individual ACTAtek terminal and you can use the Copy Trigger function found in the Terminal menu to copy triggers from this ACTAtek terminal to all the remainder ACTAtek terminals if they share the same triggers to reduce redundant work Trigger Schedule Setup Based on a schedule, the administrator can choose enable or disable triggers. To setup this functionality, select an ACTAtek terminal from the drop down list. In the Day & Time field, select a trigger ID, time frame, date, and specify either enabled or disabled. To save this schedule, press Modified Time button and the changes will now reflect on the trigger schedule field. When ready, press the Setup button to make the final changes. By default, the trigger schedule settings are on disabled and affect no days of the week unless checked. 79

80 7.19 Holiday Setup The administrator can specify days that are considered as holidays. Simply select the date from the calendar and type in a descriptive description. Press the Add button to save it in Access Manger. The administrator can remove any existing holidays that were added previously. The use of holidays is for grouping days that can be effected by a schedule. For example, access rights are affected by a schedule therefore an administrator can define an access right to deny all entries for specific access groups on holidays since the law may forbid the staff from working and entering the facility Door Open Schedule The administrator may set an open door policy to enforce any doors controlled by the ACTAtek terminals to be opened based on a set scheduled and closed otherwise. By default, the schedule settings are on disabled and affect no days of the week unless checked. In the Day & Time field, set enabled with a selected time frame and check all days that will be affected by this change. By pressing Modify Time, this will update the Time Schedule to reflect the future modifications. Notice that the black filled dots represent enabled and the light grey dots represent disabled. The example below indicates the door will remain open on every Monday from 00:00 to 23:59. Ensure to select an ACTAtek terminal in the drop down list to affix this schedule to so the affected ACTAtek terminal will know to leave its door open. Press the Setup button to finalize all the changes to the ACTAtek terminal. For all remainder ACTAtek terminals, you may choose to use an existing open door schedule that has been applied to another ACTAtek terminal or create another customized open door schedule if necessary Bell Schedule If any of the ACTAtek terminal is connected to a bell ringer, the administrator can set the bell to ring based on the programmed bell schedules. By default, there is no bell schedule in Access Manager. To add a new bell schedule, select an ACTAtek terminal from the drop down list for this schedule to take place and configure the Day & Time fields. Check the days in the week for this schedule to come into effect and press the Setup button to save all changes. 80

81 7.22 View Event Logs Administrators can view event logs that have been collected from the ACTAtek terminals in real time. Additionally, the administrator may choose to use the search option to search for specific events and export the results in a CSV file. The View EventLog Viewer button shows all event logs collected in real time with the newest at the top of the list. By pressing on the Search button, the results will be displayed as a static page Add Manual Event Logs The administrator can add events to Access Manager for corrections in the system. To begin, specify the User ID of an existing user. Now select the terminal ID, the appropriate event trigger, the date, the time, and leave a remark as a reason to add this manual event. Press the Add button to complete the process and the manual event will be added into Access Manager which can then be searchable in View Event Logs View/Delete Manual Event Logs The administrator can view all event logs that have been added manually into Access Manager and delete any incorrect manual events. Put a check in the boxes to the corresponding events and press the Remove button to permanently delete them. 81

82 7.25 View Terminal List View Terminal List shows the status and details of all registered ACTAtek terminals. This page will provide the ACTAtek terminals' serial number, model, IP address, firmware version, user count, and sync information Copy Terminal User Copy terminal user allows the administrator to copy the user data found in Access Manager or in another ACTAtek terminal as the source to another ACTAtek terminal as the destination. When auto user synchronization is disabled, copy terminal users may be deemed useful Copy Group Access Right Copy group access right allows the administrator to copy the access rights associated to the source terminal to a destination terminal as selected in the drop down list. In addition, access rights are listed to show which access rights will be copied over to the destination terminal from the source terminal. 82

83 7.28 Copy Trigger Copy trigger allows the administrator to copy the triggers found in one ACTAtek terminal to another. Select an ACTAtek terminal to use as the source and another ACTAtek terminal as the destination. Press Copy button to save the changes Department Association Department association allows the administrator to associate newly registered user to specific departments. To accomplish this, predefine an ACTAtek terminal from the terminal list and select a department and press the Associate button to add this association. Now all newly added users on this terminal will automatically be associated to the specified department Data Import The data import utility allows the administrator to import multiple users into Access Manager using a CSV file. Firstly, set your delimiter and check First row contains field names. Next, press the Browse button and select the CSV file containing the user's information. Press Load button and it will read the CSV file into Access Manager. Now press the Data Mapping tab to configure all additional settings for the users which will contain user level and privileges, departments, groups, and user status. 83

84 Press the Import button to import the configured settings and users to Access Manager Reports To run reports, the administrator has the options to filter by user ID, department, and time frame. Press the View Report button in each report section to generate the report as required. When the report is finished generating, you may choose to export it as an Excel, Word, or PDF file Daily In/Out Report: Shows a report with the first IN event and last OUT event of the day with the total working hours Detail Report: Shows a report with sequential IN and OUTs event of the day with the total working hours Absent Report: Shows a report of users that were absent or present on the day Late Report: Shows a report of users that were late with the restriction where the administrator specifies the finished time. 84

85 User Status Report: Shows a report of users with a status (anyone that has punched in with a trigger) on the day of. The administrator may choose to add filters to only display a specified trigger before pressing the View Report button Roll Call / Fire Report: Shows a report of users with a status of "IN" or "OUT" or both as specified by the administrator prior to searching Auto In/Out Report: Shows a report with sequential IN and OUTs event of the day with the total working hours if the AMS has Auto In/Out feature on. Chapter Access Manager Advance Features 8.1 APB Requirements Software & Firmware Access Manager Suite Actatek 3 Firmware Version or newer 3_ or newer The advance features will require the Access Manager Suite Server to reside on the same local area network as the ACTAtek terminals for the best possible outcome. Authentication is determined by the status of the users from the Access Manager Suite Server when working with multiple ACTAtek terminals therefore a low latency network is required. 8.2 Auto In/Out The Auto In/Out feature allows the ACTAtek terminal to auto determine the IN or OUT status of an user during authentication and records the punch event accordingly. To enable this feature, go into the Control Panel tab and then System Configuration. Change APB setting from DEFAULT to AUTO IN/OUT and press Update button to save. The ACTAtek terminals will now only show AUTO on the LCD screen. 85

86 If the Auto Reset box is checked, it will reset the Auto In/Out system such that all users will punch IN event after the specified time has been reached on the ACTatek terminal per day no matter if they have last punched IN or OUT. Reset All can be used at anytime by pressing the Update button. This will reset all users with the status you have selected. For example, if you reset all with IN status, Auto In/Out system will determine the next punch as an OUT event for all the users. 8.3 Anti-Passback The Anti-Passback feature is used for controlling area of access such that the user must proceed with IN event and then forced to use OUT event and not IN again. An example scenario where Anti-Passback would be used is to ensure that the user enters through the first door with ACTAtek terminal set on IN and then exit using the second door with ACTAtek terminal set on OUT. To enable this feature, go into the Control Panel tab and then System Configuration. Change APB setting to ANTI-PASSBACK and press Update button to save. To use this feature, only triggers IN and OUT will be affected by Anti-Passback. 86

87 8.4 Lunch In/Out The Lunch In/Out feature is used when you would like to enforce a lunch time period so no users can punch in from break until the set time is reached. If they try to punch back in from break before the set time has reached, it will reject them on the ACTAtek terminals. To enable this feature, go into the Control Panel tab and then System Configuration. Change APB setting to LUNCH IN/OUT and press Update button to save. Set a LUNCH OUT time to allow LUNCHOUT trigger to be used when the user goes on their break. Set a LUNCH IN time to allow LUNCHIN trigger to be used after their break is over. The ACTAtek terminal will allow LUNCHIN trigger after the time has passed the set LUNCH IN time in AMS. Next, Edit Triggers on an ACTAtek terminal through the AMS web interface. Set F1 to "LunchOUT" and F2 to "LunchIN" or F3 to "LunchOUT" and F4 to "LunchIN." Use Copy Trigger function and copy them over to all remainder ACTAtek terminals. When the user presses the F1 shortcut key on the ACTAtek terminal, it will bring them to the LunchOUT trigger and etc. When the user punches with trigger LunchOUT, it will signify to AMS that the user is on lunch 87

88 break. When the user punches in with trigger LunchIN, it will be accepted if the punch was made after 13:00 as seen in the images above or else they will be rejected. Chapter Upgrading AMS Software 9.1 Database Backup 9.1.1Upgrading AMS from x to x Make sure to make a back up of the AMS database before proceeding. When upgrading your AMS 88

89 89

90 90

91 auto user sync off, the resync user button will not resync users from AMS to the terminal 91