The following table describes the optional settings that you can do for Windows Client.
|
Setting |
Description |
|---|---|
|
disable_1N: true |
To disable the automatic detection of username for Card and PKI methods. For more information, see |
|
disable_local_accounts: true |
In a non-DNS mode, it is recommended to disable the local accounts. For more information, see |
|
tenant_name |
If you use Multitenancy, you must point Windows Client to a specific tenant. For more information, see |
|
event_name: <CustomEventName> |
If you want to use DNS and non-DNS based machines, you can use a custom event for the specific machines. For more information, see |
|
card.timeout: X |
To change a default Card waiting timeout. For more information, see |
|
card.fail_on_timeout: true |
To configure the login failure after the Card waiting timeout. For more information, see |
|
logo_path: C:\\dir\\filename.png |
To customize a logo for Windows Client. For more information, see |
|
verifyServerCertificate: true |
To configure the verification of server certificates for LDAP connection. For more information, see |
|
force_offline_enabled: true |
To force offline login manually for users. For more information, see |
|
forceCachedLogon: true |
To configure the cached login for client unlock. For more information, see |
|
sso_aaf_required: true |
To configure single sign-on for Citrix and Remote Desktop. For more information, see |
|
endpoint_name |
To edit the name of an endpoint. For more information, see |
|
authentication_agent_enabled = true |
To enable Authentication Agent chain in the Windows Client. For more information, see |
|
To integrate Advanced Authentication with the Sophos SafeGuard. For more information, see |
|
To configure the credential provider chaining. For more information, see |
You can configure the following settings in the registry:
To configure an automatic login, see Configuring Automatic Login
.
To customize the background image on login page for Windows 7 and later, see Customizing the Login Page Background Screen
.
You can disable the 1:N feature that allows you to detect the user name automatically while authenticating with the Card and PKI methods.
To disable the 1:N feature, perform the following steps:
Open the file C:\Program Data\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Add the line disable_1N: true to the config.properties file.
Save the config.properties file and restart the Windows operating system.
It is recommended to disable local accounts for the non-DNS mode to ensure security.
To disable the local accounts, perform the following steps:
Open the file C:\Program Data\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Add a parameter disable_local_accounts: true to the config.properties file.
If you do not disable the local accounts for a non-DNS mode, it is possible to unlock the operating system and change the password using a local account with password authentication (one factor). This can lead to security issues.
If the Multi-tenancy option is enabled, you must add the parameter tenant_name with a tenant name as the value in the configuration file: C:\ProgramData\NetIQ\Windows Client\config.properties.
For example, specify tenant_name=TOP for the top tenant in the file. If the configuration file does not exist, you must create it.
NOTE:If you do not add the parameter tenant_name, you might get an error Tenant not found.
By default, Windows Client uses the Windows logon event for authentication. However, in some scenarios you must create a separate custom event. For example, when the predefined event is used for DNS based workstations, you can create a custom event with the type as Generic for the non-DNS based workstations. You must point these non-DNS based workstations to the custom event using the event_name: <CustomEventName> parameter in the configuration file:
C:\ProgramData\NetIQ\Windows Client\config.properties
You can configure the time for which the card waiting dialog is displayed, when the user authenticates using the card method. If the user does not present the card for the specified timeout period, the Hardware timeout message is displayed and the card waiting dialog is closed. The user login selection screen is displayed.
By default, the card timeout is 60 seconds.
To configure the timeout for card waiting, perform the following steps:
Open the configuration file C:\ProgramData\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Specify card.timeout: X in the config.properties file. X is the timeout value in seconds.
Save the configuration file.
Restart the Windows operating system.
By default, the card timeout is not considered as a login failure. However, you can configure the card timeout as a login failure.
To enable login failure during card timeout, perform the following steps:
Open the file C:\ProgramData\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Specify card.fail_on_timeout: true in the config.properties file.
Save the configuration file.
Restart the Windows operating system.
To enable the Windows operating system to perform an automatic login, perform the following steps:
Go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
In the registry key, it is mandatory to set the following parameters:
DefaultDomainName
DefaultPassword
DefaultUserName
For more information about how to enable automatic login on Windows, see the Microsoft Support link.
You can customize the logo of Windows Client according to your requirement. The format of the logo must meet the following requirements:
Image format: png, jpg, gif
Resolution: 400x400px
Maximum file size: 100Kb
To customize the logo, perform the following steps:
Open the configuration file C:\ProgramData\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Specify logo_path: C:\\dir\\filename.png in the config.properties file.
You cannot use the logo from shared folders.
Save the configuration file.
Restart the Windows operating system.
This option allows you to ensure a secure connection between a workstation and Advanced Authentication servers with a valid self-signed SSL certificate. This helps to prevent attacks on the connection and ensure safe authentication.
The option for verification of server certificates is disabled by default. You must import the trusted certificates to the Local Computer\Trusted Root Certification Authorities folder.
To enable verification of the server certificates, perform the following steps:
Open the configuration file C:\ProgramData\NetIQ\Windows Client\config.properties.
If the file does not exist, create a new file.
Specify verifyServerCertificate: true (default value is false) in the config.properties file.
Restart the Windows operating system.
NOTE:You must upload the SSL certificate in the Administration portal > Server Options. The SSL certificate provides high level of encryption, security, and trust. For more information about how to upload the SSL certificate, see Uploading the SSL Certificate.
In scenarios where the network connection is slow or unstable, you can allow users to perform an offline login manually. This saves the user’s time for the login process.
To allow users to force offline login manually, perform the following steps:
Open the configuration file C:\ProgramData\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Specify force_offline_enabled: true (default value is false) in the config.properties file.
Save the configuration file.
Restart the Windows operating system.
When you set the parameter to true, an Offline logon check box appears on the user’s login screen. If a user selects Offline logon, Windows Client does not try to reach an Advanced Authentication server but goes directly to cache.
You can also set the offline login as a default value by specifying force_offline_default: true in the config.properties file. This enables the Offline logon check box to be selected by default on the user’s login screen.
NOTE:Before you force offline login, a user must have logged into the workstation once (with online login) to cache the authenticators.
IMPORTANT:The force offline login method has been introduced as a temporary workaround. It is recommended to use the Configuring the Enforced Cached Login
method.
When the network connection is slow or unstable, the client login or unlock process can take several minutes. A solution to this is to enforce the cached login. The Client connects to Advanced Authentication server to validate the credentials in the background after the cached login. By default, the enforced cached login is not used and the Client will always try to connect to Advanced Authentication server to validate the credentials.
Perform the following steps to allow users to use the enforced cached login:
Open the configuration file \ProgramData\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Specify forceCachedLogon: true (default value is false) in the config.properties file.
Save the configuration file.
Restart the Windows operating system.
NOTE:The enforced cached login method is preferred over the Configuring to Force Offline Login Manually
method.
You can configure the Windows Client to use the Single Sign-on (SSO) feature for establishing a connection to a Citrix and a Remote Desktop server. Therefore, when the users are authenticated to the Windows domain, they are not prompted for credentials to connect to the terminal servers such as Citrix StoreFront and Remote Desktop Connection. This prevents users from specifying the credentials again when they login to terminal servers such as Remote Desktop or Citrix StoreFront, after they have performed the authentication to Microsoft Windows. To achieve this, you must install the Advanced Authentication Windows Client on the terminal server.
NOTE:When SSO for Remote Desktop is enabled, the Interactive logon: Smart card removal behavior policy is ignored. You need to disable SSO to make this policy to work.
The SSO feature is enabled by default for accessing the terminal servers. By default, SSO feature works irrespective of the Advanced Authentication Windows Client installation on the terminal client.
To enable SSO only when the Advanced Authentication Windows Client is installed on the terminal client, perform the following steps:
Open the config.properties at C:\ProgramData\NetIQ\Windows Client path.
If the file does not exist, create a new file.
In the config.properties file, specify sso_aaf_required: true (default value is false).
Save the configuration file.
Restart the Windows operating system.
To disable the SSO feature, perform the following steps:
Open the config.properties at C:\ProgramData\NetIQ\Windows Client path.
If the file does not exist, create a new file.
In the config.properties file, specify sso_logon_enabled: false.
Save the configuration file.
Restart the Windows operating system.
You can customize the background image of the login page in Windows 7 and later versions as per your requirement.
The default image is set as background on the login page of the Windows Client.
To change the background image, perform the following steps:
Click Start and specify regedit in the Run command prompt.
The User Account Control (UAC) prompt is displayed.
Click YES to navigate to the Background directory.
NOTE:The Background directory is located in the Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI directory.
Set OEMBackground entry to 1.
NOTE:If the OEMBackground entry does not exist, create an entry and set the value to 1.
Navigate to the C:\Windows\System32\Oobe directory and create a directory as info.
Create a directory backgrounds in info.
Insert the preferred background image in the backgrounds directory and rename the image as backgrounddefault.jpg.
Click Start and specify GPEDIT.MSC in the Run command prompt.
The Local Group Policy Editor prompt is displayed.
Navigate to the Local Computer Policy\Administrative Templates\System\Logon directory.
Enable Always use custom logon background setting.
You can edit the name of an endpoint based on your requirement.
To change an endpoint name, perform the following steps:
Open the configuration file C:\ProgramData\NetIQ\Windows Client\config.properties. If the file does not exist, create a new file.
Specify endpoint_name: <endpoint name> in the config.properties file. For example, endpoint name can be computer 1.
Save the configuration file.
Restart the Windows operating system.
The Authentication Agent allows you to authenticate on one computer where all the devices required for authentication are connected. This helps to get authorized access to another computer or z/OS mainframe, where one of the following condition is true:
It is not possible to redirect the authentication devices.
It does not support devices that are used for authentication.
The Authentication Agent can be installed only on the Windows computer.
You must select Authentication Agent in the Chains list of Windows Client to initiate the authentication process on another Windows computer where the Authentication Agent is installed.
To enable the Authentication Agent chain on the Windows Client, perform the following steps:
Navigate to C:\ProgramData\NetIQ\Windows Client path and open the file config.properties.
If the configuration file does not exist, you must create it.
Specify authentication_agent_enabled = true in the configuration file.
Click Save.
Restart your computer.
This scenario describes how you can perform authentication on one Windows computer and auto-sign in to another Windows computer using the Authentication Agent.
Thomas uses two Windows computers simultaneously. However, the devices required for authentication such as FIDO U2F token and card reader are connected to one Windows computer. He cannot get authenticated to the other computer because there are no authentication devices connected to this computer and cannot redirect the devices. In this case, Thomas can use Authentication Agent to perform authentication on one Windows computer and get seamless access to another Windows computer without the authentication devices.
Consider the following setup:
Windows A is a computer with the Authentication Agent installed and is connected with the devices used for authentication such as FIDO U2F token and card reader.
Windows B is computer without the authentication devices and the Authentication Agent chain is enabled using the config.properties file.
The following sequence describes the authentication process using the Authentication Agent:
Specify user name and select the Authentication Agent chain in Windows B computer.
The Authentication Agent on Windows A computer launches a restricted browser.
Select the preferred chain to log in to Windows B in the restricted browser.
Perform the authentication using the FIDO U2F token and card reader in the restricted browser.
Thomas is logged in to Windows B computer automatically.
This section provides the configuration information on integrating Advanced Authentication with Sophos SafeGuard 8 easy solution. Therefore, when the users are authenticated to Windows Client, they are not prompted for credentials to connect to the Sophos SafeGuard.
With this integration, Advanced Authentication is set as primary credential provider in the Windows Client. The Advanced Authentication server validates the user provided credentials and transmits the credentials to the Sophos credential provider to allow Single sign-on to the Sophos SafeGuard.
To integrate Advanced Authentication with the Sophos SafeGuard 8, perform the following steps:
Navigate to the path C:\ProgramData\NetIQ\Windows Client and open the file config.properties.
Specify the following parameters with corresponding values in the configuration file:
credprov_chaining_clsid: {5CDFA681-61C8-423d-999E-32EA10C5F7ED}
credprov_chaining_enabled: True
credprov_chaining_password_field: 9
credprov_chaining_username_field: 8
Save the configuration.
Log out and log in again.
This option allows you to integrate Advanced Authentication with any other credential provider in Windows Client. Therefore, when users are authenticated to Windows Client, they are not prompted for credentials to connect to other credential provider installed in the workstation.
To integrate Advanced Authentication with other credential provider, perform the following steps:
Enable the debug logs for Windows Client.
For more information about debugging the logs of Windows Client, see Debugging Logs for Advanced Authentication
.
Navigate to the path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\ and search for the CLSID of the preferred credential provider with which you want to integrate Advanced Authentication.
Ensure to copy the CLSID for further use.
Navigate to the path C:\ProgramData\NetIQ\Windows Client\ and open the file config.properties.
Specify the following parameters in the configuration file:
credprov_chaining_clsid: <CLSID>
credprov_chaining_enabled: True
credprov_chaining_dump_fields: True
credprov_chaining_password_field: 0
credprov_chaining_username_field: 0
For example: The CLSID of Sophos SafeGuard is 5CDFA681-61C8-423d-999E-32EA10C5F7ED. Therefore, set the CLSID parameter as follows:
credprov_chaining_clsid: {5CDFA681-61C8-423d-999E-32EA10C5F7ED}
Log out and log in again.
Navigate to the path C:\ProgramData\NetIQ\Windows Client\Logging\Logs then search for the parameter CpChaining::dumpFields in the logs file.
Search for the fields that contain the label for the user name and password fields. Set the ID of these fields to the following parameters in the configuration file:
credprov_chaining_password_field:
credprov_chaining_username_field:
For example: Consider the Sophos SafeGuard 8 login form contains the user name and password fields. The ID of these fields are 8 and 9 respectively. Therefore, the parameters are set as follows:
credprov_chaining_password_field: 9
credprov_chaining_username_field: 8
For more information, see Configuring Integration with Sophos SafeGuard 8
.
Save the changes in the configuration file.
NOTE:There may be more than one field that contain labels such as username and password. Here, you must use different fields and test the log in process.
Log out and log in again.
After providing the credentials, if you are able to sign in to the credential provider automatically, remove the parameter credprov_chaining_dump_fields: True from the configuration file.
NOTE:While searching the labels, ensure to examine the label type. You can use a label with one of the following value that indicates the label type:
0 - invalid
1 - large text (label)
2 - small text (label)
3 - command link
4 - edit box
5 - password box
6 - tile image
7 - check box
8 - combo box
9 - submit button