Administration Guide. . All right reserved. For more information about Specops Password Policy and other Specops products, visit

Transcription

1 . All right reserved. For more information about Specops Password Policy and other Specops products, visit

2 Copyright and Trademarks Specops Password Policy is a trademark owned by Specops Software. All other trademarks used and mentioned in this document belong to their respective owners. 2

3 Contents Key Components 6 Domain Administration Tool 7 Domain Administration 7 Domain s 7 Password Policy Sentinel state 8 Configured password policies 8 Language files 9 Password policy templates 10 Group Policy Snap-In 11 Create a Specops Password Policy GPO 11 Applying policy settings 11 Policy s 12 Start 12 General s 12 Password Rules 14 Passphrase 15 Configuring Specops Password Client From The Administrative Template 17 Configure Specops Password Client from the Administrative Template 17 Specops Password Policy Registry s 18 3

4 About this guide This guide is intended for administrators who are responsible for managing user accounts in their Microsoft Active Directory environment. Before you perform the tasks in this guide, please ensure you have correctly installed Specops Password Policy. You can find the Specops Password Policy Installation Guide at 4

5 About Specops Password Policy Specops Password Policy helps you increase password security in your Microsoft Active Directory environment. You can use Specops Password Policy to enforce password rules and help users select stronger passwords. Specops Password Policy extends the functionality of Group Policy and can be configured in any number of group policies within Active Directory. Specops Password Policy is customizable. Users with access to sensitive information can be assigned policies that enforce password complexity while users with little or no access to sensitive information can be assigned a less restrictive password policy. This allows your organization to meet password related regulatory requirements in a quick and cost effective manner. Specops Password Policy is a component of the Specops Password Management suite. Specops Password Management is a holistic approach to password security that increases security, cuts costs, and extends the reach of password based security. You can learn more about the Specops Password Management suite and other Specops Password related products at 5

6 Key components Specops Password Policy can be configured from any computer in the domain where the Specops Password Policy Administration Tools are installed. The administration tool can be used to configure different aspects of the product. Domain Administration tool: The Domain Administration tool controls domain wide settings for Specops Password Policy. Group Policy snap-in: Manages Specops Password Policy settings. 6

7 Domain Administration tool You can use the Domain Administration tool to manage configurations that apply to your entire domain. Once you have modified the settings, your changes are automatically saved. You can access the Domain Administration tool via the start menu. Domain Administration You can use the Domain Administration tab to perform the following tasks: Disable and enable Specops Password Policy: Applied to your entire domain and determines if the Sentinel processes incoming password changes. Edit license information: Used to view, add, or edit your license information. Domain s You can use the Domain s tab to perform the following tasks: Save previous password with reversible encryption: Allows you to save the user s previous password with reversible encryption in Active Directory with reversible encryption in Active Directory. Note: If the checkbox isn t checked, the password is saved with one way encryption. Edit s: Affects how s are sent for password expiration reminders. 7

8 Edit s To configure this setting you must enter the following information: The mail server you want to send the s from The address you want to send the s from A display name for the sender Password Policy Sentinel state You can use the Password Policy Sentinel state tab to verify that you have installed the Sentinel on all writable domain controllers. If you notice a domain controller is missing the Sentinel component, you can: Run the Setup Assistant again to install it, or Manually install the Sentinel Component on the affected domain controller Configured password policies You can use the Configured password policies tab to perform the following tasks: View the list of all Group Policy Objects in your domain that contain password policy settings. 8

9 Edit an existing Group Policy Object. Edit selected GPO 1. Click Edit selected GPO to launch the Group Policy Object Editor. 2. In the Group Policy Object Editor, expand User Configuration, Windows s, and select Specops Password Policy. 3. Click Configure Password Policy. 4. Edit the settings, and click OK. Language files You can use the Language files tab to update to new versions of language files. This will only update if there are new versions of language files available on the computer where the Domain Administration tool is installed after an upgrade. 9

10 Password policy templates You can use the Password policy templates node to create a new password policy template or view a pre-existing templates, such as the Microsoft Enterprise Client security guidelines, or the NSA recommendation for normal users. A password policy template will help keep your policy settings consistent throughout your domain. Create a new Password Policy Template 1. Click Create New Password Policy Template. 2. In the Template name field, enter a name for the template. 3. In the field, enter a description for the template. 4. Specify the settings, and click Save. 10

11 Group Policy snap-in The Group Policy snap-in, installed with the Administration Tools, allows you to create and manage Specops Password Policy settings in Group Policy Objects. The settings are stored as a part of the GPO. Managing Specops Password Policy settings in Group Policy allows you to control how and where the policies are applied. Create a Specops Password Policy GPO 1. In the GPMC, expand your domain node and locate the Group Policy Object. 2. Right click on the GPO node and select New. 3. Enter a name for the Group Policy Object and click OK. Applying policy settings The password policy will apply to all user accounts in locations where your GPO is linked. If more than one GPO is linked on the same level, the link order of the GPOs determine the order the GPOs will be processed. If conflicting settings from multiple GPO s apply to a user, Group Policy will resolve the conflict. Group Policy Objects are applied in the following order; The GPO closest to the user object in AD will have the highest precedence: Local Group Policy Objects Site linked Group Policy Objects Domain linked Group Policy Objects OU linked Group Policy Objects If the above order does not enable you to apply your preferred settings, you can use security filtering to control on a permission level which users and computers will be affected by the GPO. Security filtering allows you to apply different policy settings to objects located on the same level in Active Directory. 11

12 Policy settings In the Group Policy Management Editor expand User Configuration, Policies, Windows s node, and select Specops Password Policy. Click Create New Password Policy to configure the policy. You can use policy settings to manage password security for users in your organization. Start You can configure a password policy to use classic password rules, and/or passphrases. A passphrase is a special type of password based on a sentence, or a series of words. The requirements of a passphrase, by default, are that it needs to be long. General s Password history Number of remembered passwords Minimum passwords age (days) Specify the number of passwords the system will remember. Users will be prevented from reusing the stored passwords. Specify the number of days that must elapse before the user is allowed to change their password. 12

13 Disallow incremental passwords Minimum number of changed characters Disallow reusing part of the current password Password expiration Maximum password age (days) Warning at logon before expiration (days) Send warning (days) Prevent users from selecting new passwords that only differ from the old password by the last character. Specify the number of characters that must be changed in a password. Specify the number of consecutive characters from the old password that are not allowed in the new password. Specify the time (in days) that can elapse before a password expires. Specify the time (in days) before the password expires that the user receives notifications to change their password by the Specops Password Client. Specify the time (in days) before the password expires that the user receives s with a reminder to change their passwords. Account lockout settings Disable account lockout Password reset options Ignore this policy on password reset Require user to change password on next logon Unlock locked accounts automatically on reset Prevent accounts from being locked out from Active Directory. Ignore policy settings when the password is being reset. Note: Do not enable this setting if the user can reset passwords through a self-service solution such as Specops Password Reset. Require the user to change their password on the next logon after the password has been reset. Automatically unlock user accounts when their passwords are reset. Client message This setting is used to control the contents of the message sent to the users when they fail to meet their password rules 13

14 Client message language User feedback on failed attempt Additional information to end users at password change Specify the language localization to use in the message. Display the policy rules, failed rules, or a custom message after a failed attempt. Specify any additional information you want to give the end users when they change their passwords. Password Rules Password length requirements Minimum password length Maximum password length Character group requirements Number of required character groups Required alpha characters Required upper case characters Required lower case characters Required non alpha characters Required digits Required special characters Required Unicode characters Specify the minimum number of characters in a password. Specify the maximum number of characters in a password. Specify the number of character groups that the password must have characters from. Specify the minimum number of alpha characters (A-Z) in a password. Specify the minimum number of upper case alpha characters in a password. Specify the minimum number of lower case alpha characters in a password. Specify the minimum number of non-alpha characters (digits, special characters, Unicode characters) in a password. Specify the minimum number of digits (0-9) in a password. Specify the minimum of special characters in a password. Specify the minimum number of Unicode characters that must be present in the password. Note: Enable this feature only if the user has the ability to enter Unicode characters directly from their keyboards. Regular expressions 14

15 Use regular expressions Allows the use of Regular Expression (RegEX) string matching against password. Password content restrictions Disallow username in password Disallow full username in password Disallow part of username in password Disallow digit as first character in a password Disallow digit as last character in a password Disallow consecutive identical characters Prevent the use of the username in the password. Prevent the use of full account name (first name, last name, display name) in the password. Prevent the use of parts (three or more consecutive characters) of the account name (first name, last name, display name) in the password. Prevent the use of a digit as the first character in a password. Prevent the use of a digit as the last character in a password. Specify the number of identical consecutive characters that can be used in a password. Dictionary Disallow words from dictionary Disallow reversed dictionary words Prevent the use of words from your configured dictionaries in passwords. Prevent the use of reverse words from your configured dictionaries in passwords. Note: You can use the default dictionary or import a dictionary. Passphrase Passphrase requirements Minimum passphrase length Require one or more lower case characters Require one or more upper case characters Require one or more digits The minimum number of characters in the passphrase. One or more lower case characters in the passphrase. One or more upper case characters in the passphrase. One or more digits in the passphrase. 15

16 Require one or more special characters Passphrase message One or more special characters in the passphrase. A description of the policy that will be displayed to end users when changing their password. The message should explain the policy requirements the passphrase should meet. Custom requirements Use custom passphrase requirements When this option is enabled, you can add additional requirements, such as regular expressions, to the passphrase policy. Custom Regular Expressions Sample passphrase Create the regular expressions that will be used to validate passphrases. Type a sample passphrase to test against the regular expression. 16

17 Configuring Specops Password Client from the Administrative Template The Specops Password Client can be configured using the administrative template in the Group Policy Management Console. You can configure the following settings using the Administrative Template: Query all writable domain controllers to display assigned policy rules when password change fails. Use domain controllers from the DNS cache to display assigned policy rules when password change fails. Notification interval (in minutes) Assign a timeout period to the query. Configure Specops Password Client from the Administrative Template 1. Open the GPMC and navigate to the GPO you want to edit. 2. Right click on the GPO and select Edit 3. In the Group Policy Management Editor dialog box, expand Computer Configuration, Policies, Administrative Templates, Specops Password Policy, and select Client s. 4. Double-click the click setting you want to configure. 5. Make the necessary changes, and click OK. After you finish: Create a Central Store for Group Policy Administrative Templates and add the Specops Password Policy Administrative template. Create a Central Store for Group Policy Administrative Templates The Central Store for Administrative Templates allows you to store all template files in a single location on SYSVOL where they can be accessed and presented on any server from your domain. To create a Central Store for Group Policy Administrative Templates, copy the %windir%\policydefinitions folder from your Windows machine to the policies folder on the SYSVOL share in your domain. For more information about the Central Store and best practices, visit: 17

18 Specops Password Policy Registry s Below you will find a list of the registry settings used by the components of Specops Password Policy. The settings can be changed using the Registry Editor. Password Policy Sentinel Registry key HKLM\Software\Specopssoft\Specops Password Policy\Filter\ CheckExpiredPasswordsStartTime Specifies the time of day that the PDC emulator domain controller should check for expiring passwords and send to accounts configured to use the expiration notice functionality. HKLM\Software\Specopssoft\Specops Password Policy\Filter\ Debug Enter the time of day in 24-hour format. For instance, 03:00 for 3.00 AM or 15:00 for 3.00 PM. Default = 00:00 (midnight) Enables debug logging for the sentinel component. Default value = 0 (set to 1 to enable logging) The default log path is: %WINDIR%\Debug\SPP3FLT [LSASS].log Administration Tools Registry key HKLM\Software\Specopssoft\Specops Password Policy\Administration\ Debug Enables debug logging for the GPMC snap-in and the Domain Administration tool. Default value = 0 (set to 1 to enable logging) The default log paths are: %USERPROFILE%\AppData\Local\SpecopsSoft\ SpecopsPasswordPolicy2GpmcSnapIn.log %USERPROFILE%\AppData\Local\SpecopsSoft\ SpecopsPasswordPolicyDomainAdministration.log Password Client Registry key HKLM\Software\Specopssoft\Specops Password Policy\Client\ Determines how often the Specops Password Client checks if it needs to notify the user about an expiring password. 18

19 CheckIntervalInMinutes Default value = 120 This setting is typically controlled through the admxtemplate that gets installed with the administration tools. HKLM\Software\Specopssoft\Specops Password Policy\Client\Debug Enables debug logging for the GPMC snap-in and the Domain Administration tool. Default value = 0 (set to 1 to enable logging) The default log paths are: %USERPROFILE%\AppData\Local\SpecopsSoft\ SpecopsPasswordPolicy2GpmcSnapIn.log %USERPROFILE%\AppData\Local\SpecopsSoft\ SpecopsPasswordPolicyDomainAdministration.log 19

20 Support For helpful tips and solutions for troubleshooting the product, download the Specops Password Policy Troubleshooting Guide from: If you are unable to resolve a product related issue, contact Specops Support for assistance. Online We recommend submitting your case directly on our website at: Telephone International Monday - Friday: 09:00-17:00 CET North America SPECOPS ( ) Monday - Friday: 09:00-17:00 EST 20