DigitalPersona Pro Enterprise

Transcription

1 DigitalPersona Pro Enterprise Version 5 Administrator Guide

2 DigitalPersona, Inc. All Rights Reserved. All intellectual property rights in the DigitalPersona software, firmware, hardware and documentation included with or described in this guide are owned by DigitalPersona or its suppliers and are protected by United States copyright laws, other applicable copyright laws, and international treaty provisions. DigitalPersona and its suppliers retain all rights not expressly granted. U.are.U and DigitalPersona are trademarks of DigitalPersona, Inc. registered in the United States and other countries. Windows, Windows Server 2003/2008, Windows 8, Windows 7, Windows Vista and Windows XP are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners. This DigitalPersona Pro Enterprise Administrator Guide and the software it describes are furnished under license as set forth in the License Agreement screen that is shown during the installation process. Except as permitted by such license, no part of this document may be reproduced, stored, transmitted and translated, in any form and by any means, without the prior written consent of DigitalPersona. The contents of this manual are furnished for informational use only and are subject to change without notice. Any mention of third-party companies and products is for demonstration purposes only and constitutes neither an endorsement nor a recommendation. DigitalPersona assumes no responsibility with regard to the performance or use of these third-party products. DigitalPersona makes every effort to ensure the accuracy of its documentation and assumes no responsibility or liability for any errors or inaccuracies that may appear in it. Feedback Although the information in this guide has been thoroughly reviewed and tested, we welcome your feedback on any errors, omissions, or suggestions for future improvements. You can contact us at Crossmatch 720 Bay Road Suite 100 Redwood City, CA USA Published: 1/27/2015 (v 5.5.1)

3 Table of Contents 1 Solution Overview 10 Introduction Architecture Components Server components Compatible workstation clients DigitalPersona Pro Workstation for Enterprise DigitalPersona Pro Kiosk Client user interfaces Authentication and Credentials Security applications Password Manager Admin Tool Licensing model System Requirements Support Resources Changes from previous version Section One: Installation 2 Pro Server Installation 22 Deployment Overview Upgrading from Previous Versions Compatibility Extending the Active Directory Schema Configure each domain Install DigitalPersona Pro Enterprise Server Configuring DigitalPersona Pro Server for Pro Kiosk Changes Made During Installation DNS Registration Uninstalling DigitalPersona Pro Server Pro Client installation 35 System requirements Upgrading from Previous Versions Compatibility Installation Remote installation Remote installation for patches Client Suite installation Local installation Command line Installation DigitalPersona Pro Enterprise - Administrator Guide iii

4 Table of Contents Installation on Citrix Presentation Server About Transform files Uninstalling Pro Workstation Pro Kiosk installation 46 System Requirements Recent changes Changes compared to version Changes compared to version Upgrading from Previous Versions Installation Remote Installation Remote installation for patches Local installation Command line installation Installation on Citrix Presentation Server About Transform files Optional installations 55 Included in product package Suite installers Administration Tools License Activation Manager Users and Computers Snap-In Attended Enrollment Tool User Query Tool Snap-in GPMC Extensions Defender Separate product packages Password Manager Admin Tool Extended Server Policy Module (ESPM) Pro Cogent FR Plugin Citrix and remote installation 60 Overview Installation on Citrix solutions Installation & Configuration Disabling automatic client updates Installing Citrix support after DigitalPersona Pro client installation Section Two: Administration 7 Administration overview 65 Administration Tools package License Activation & Management 67 DigitalPersona Pro Enterprise - Administrator Guide iv

5 Table of Contents License Activation Manager License activation Pro Enterprise Server activation Server activation from another computer Package or component activation (v 5.3 only) ADUC snap-ins 82 Users and Computers snap-in User properties User object commands Computer object commands User Query Tool snap-in ActiveX control Interactive dialog-based application Command line utility Attended Enrollment 94 Setting up Attended Enrollment To assign, or remove Register/Delete permissions Enrolling user credentials Deleting Fingerprints Policies and Settings 99 Overview Computer Configuration/Policies/Software Settings DigitalPersona Pro Client Security/Authentication Security/Enrollment Licenses Kiosk Administration DigitalPersona Pro Enterprise Server Licenses Computer Configuration\Policies\Administrative Templates DigitalPersona Pro Client (Summary) DigitalPersona Pro Client (Details) Authentication Devices Event logging General Administration Kiosk Administration Managed applications Security/Authentication Security/Features Software Updates DigitalPersona Pro Enterprise Server (Summary) DigitalPersona Pro Enterprise Server (Detail) DigitalPersona Pro Enterprise - Administrator Guide v

6 Table of Contents User Configuration\Policies\Software Settings DigitalPersona Pro Client (Summary) DigitalPersona Pro Client (Detail) Security/Authentication Security/Enrollment User Configuration\Administrative Templates DigitalPersona Pro Client (Summary) DigitalPersona Pro Client (Detail) Single Sign-On 129 Configuring Single Sign-On Disable Session Authentication Create managed logons GPMC Extensions 130 Overview Implementation Guidelines Install Workstation Administrative Templates Locally Recovery 134 User recovery Computer recovery Account lock recovery Pro Reports 136 Overview Setting up DigitalPersona Pro Reports Web console Creating a report Creating a new subscription Adding a report to an existing subscription Editing a subscription Bookmarking a report Deleting a report or subscription Pro Events 145 Credential Management User Management Secret Management Service Management Password Manager Credential Authentication DNS Registration Deployment Windows Logon Authentication Domain Management DigitalPersona Pro Enterprise - Administrator Guide vi

7 Table of Contents 17 Extended Server Policy Module Utilities 153 Cleanup Wizard Section Three: Pro Clients 19 Pro Workstation 155 Getting Started Workstation setup Opening the dashboard Using the dashboard Managing user credentials Self Password Recovery Enrolling your fingerprints Enrolling a PIN Enrolling scenes for the Face credential Setting up cards and tokens Setting up a smart card Setting up a contactless or proximity card Enrolling a Bluetooth device Changing your Windows password Security Applications Status Windows authentication Smart card authentication Password Manager Backing up and restoring your data Setting your preferences ID Card Learn more Pro Kiosk 173 Feature overview Comparing Pro Workstation and Pro Kiosk Logging On to Windows Using One Touch Logon Logging on to Windows without Kiosk Automatic logon using the Shared Kiosk Account Changing Your Password User Account Control Using the Password Manager Admin Tool with Pro Kiosk Logging On to Password-Protected Programs User logon Switching Users on Pro Kiosk Computers Using multiple Kiosk accounts with Citrix DigitalPersona Pro Enterprise - Administrator Guide vii

8 Table of Contents 21 Pro Administrative Console 179 Opening the Administrative Console Using the Administrative Console Configuring your system Setting authentication policies Logon Policy Session Policy Specifying credentials settings Configuring your applications settings General tab Applications tab Section Four: Appendices 22 Glossary 192 Concepts Terminology Citrix Deployment Scenarios 200 Overview Installation and configuration Fast Connect with XenApp and Pro Workstation XenApp server configuration Pro Server configuration Maintaining local and remote Kiosk identities Setting up kiosks for local and remote identities Using kiosk local and remote identities IGEL Universal Desktop support Requirements Setup Policies and Settings - Alphabetical list Embedded Windows dependencies 210 Required components for supported Windows Embedded platforms Required files for supported Windows Embedded platforms Identification List Pro Events for version Credential Management User Management Secret Management System, Services, Settings and User Sessions External components Password Manager Admin Tool DigitalPersona Pro Enterprise - Administrator Guide viii

9 Table of Contents Fingerprint Match DNS Registration License Management License Management, ID Server licensing OTP Management Status Notifier Logon Schema extension 228 Introduction Schema extension overview Schema objects details Class details Standard Classes Extensions Index 293 DigitalPersona Pro Enterprise - Administrator Guide ix

10 Solution Overview 1 This chapter provides a high-level overview of the DigitalPersona Pro Enterprise solution, and includes the following major topics. Topics Introduction 11 Architecture 11 Page Components 12 Authentication and Credentials 15 Security applications 15 Licensing model 16 System Requirements 17 Support Resources 17 Changes from previous version 18 More details on specific components and modules are provided in the remainder of this Administrator Guide. Additional implementation, administration and reference-level documentation is provided through a series of Quick Start Guides and Application Guides for many of the components and modules as well as for major features. A series of integrated help files provide the finest level of detail for all user-centric features as well as many administrator features and functions. References to procedures, UI elements and images in this guide are always made to the current version of DigitalPersona Pro products. References to, and images of, Microsoft Windows products are to Windows Server 2008 and Windows 7 unless otherwise noted. DigitalPersona Pro Enterprise - Administrator Guide 10

11 Chapter 1 - Solution Overview Introduction DigitalPersona Pro Enterprise is an enterprise-level central management solution for Endpoint Protection that enables administrators to manage security and authentication within Active Directory networks including data protection, access management and recovery. It represents an optimal solution to multiple security needs, including: Strong Authentication for PC, application and RADIUS logon Single Sign-On (SSO) for Enterprise applications For further information on how DigitalPersona Pro Enterprise can help you solve your security needs, we have white papers, datasheets and case studies on our website at enterprise. Architecture The conceptual architecture of DigitalPersona Pro Enterprise consists of four layers. Management Provides an Active Directory-based solution for the enterprise; enabling the IT Administrator to configure, deploy and administer security policies throughout the organization. Security Applications Provides pluggable applications and features that are managed through the DigitalPersona Pro management infrastructure. Clients - Workstation software installed on notebooks, desktops and shared-user kiosks. Credentials Provides support for multiple authentication credentials that may be used in specified combinations for verifying the identity of users accessing managed computers and security applications. DigitalPersona Pro Enterprise - Administrator Guide 11

12 Chapter 1 - Solution Overview Components DigitalPersona Pro Enterprise is a client-server product. It consists of server and client components that work within an existing Active Directory environment. Server components DigitalPersona Pro s server components fulfill four main purposes: They allow IT Administrators to manage security and authentication policies via Active Directory Group Policy Objects. For these purposes, DigitalPersona Pro includes various GPMC (Group Policy Management Console) extensions, installed under the Software Settings and Administrative Templates nodes, to link product policies and settings to Active Directory containers. They provide centralized, server-side authentication of various types of credentials (e.g. fingerprints, smart cards, bluetooth, one-time passwords etc.). For these purposes, DigitalPersona Pro runs authentication services within your domain and receives authentication requests from managed computers. They allow centralized backup and roaming of computers and users credentials and passwords. For these purposes, DigitalPersona Pro uses Active Directory as a database of relevant data. They also allow other general administrative tasks, including: Access recovery into locked workstations Deployment of license activation codes. The main server components of the DigitalPersona Pro Enterprise product are briefly described in the following table, and more fully described in the referenced pages. Server component Purpose Page Pro Enterprise Server DigitalPersona Defender Pro Administration Tools Provides domain-wide, centralized administration of Pro clients and enables strong authentication through various credentials, such as Bluetooth tokens, Windows passwords, fingerprints, smart cards and more. Enables two-factor authentication in workstation clients, and works with any OATH-compliant hardware token. Provides additional tools for administration of various DigitalPersona Pro features and utilities including License Management, GPMC Extensions, Access Recovery, Attended Enrollment and the Password Manager Admin Tool , 64 DigitalPersona Pro Enterprise - Administrator Guide 12

13 Chapter 1 - Solution Overview Compatible workstation clients The DigitalPersona Pro Enterprise solution supports the following clients: DigitalPersona Pro Workstation for Enterprise - This primary client enforces security and authentication policies on managed Windows computers while providing intuitive access to end-user features and functionality. It may be centrally managed by Pro Enterprise Server, or installed as a stand-alone product. DigitalPersona Pro Kiosk for Enterprise - This specialized kiosk client provides DigitalPersona Pro features for environments where users log on to a shared, common Windows account or kiosk. It is centrally managed by Pro Enterprise Server. NOTE: The Pro Workstation for Enterprise and Pro Kiosk for Enterprise clients may be installed individually on computers or deployed through Active Directory GPO, SMS (Systems Management Server) or logon scripts. They cannot be installed through ghosting or imaging technologies. DigitalPersona Pro Workstation for Enterprise DigitalPersona Pro Workstation for Enterprise is the primary client application for end-users, providing an intuitive means for increasing both security and convenience through a variety of configurable options including enrollment and use of multiple credentials, and the use of automated logons for enterprise resources, programs and websites. For more details, see the chapter Pro Workstation on page 155. DigitalPersona Pro Kiosk DigitalPersona Pro Kiosk for Enterprise is a client application specifically designed for environments where users need fast, convenient and secure multi-factor identification on workstations shared by multiple users. Although users share a common Windows account, DigitalPersona Pro Kiosk for Enterprise provides separately controlled access to resources, applications and data. For a full description of its features, see the chapter Pro Kiosk on page 173. DigitalPersona Pro Enterprise - Administrator Guide 13

14 Chapter 1 - Solution Overview Client user interfaces Pro Enterprise Workstation contains two separate program interfaces; a user dashboard and an Administrative Console. Access to the Administrative Console requires local administrator privileges. The Pro Kiosk client provides the same user dashboard, but does not have an Administrative Console. Settings that govern the features and behavior of the user dashboard are in most cases controlled through Active Directory GPO settings. However, settings that are left Not Configured in Active Directory may be configured by the local administrator using the Administrative Console. These local settings will then be effective for all users on the specific computer. Whenever a setting is configured (enabled or disabled) in Active Directory, the local administrator cannot modify the setting through the Administrative Console. For this reason especially if the needs specific to your environment require you to provide end users with local administrative rights DigitalPersona strongly recommends IT Administrators explicitly configure each desired setting in Active Directory, rather than relying on default behaviors associated with the unconfigured state. DigitalPersona Pro Enterprise - Administrator Guide 14

15 Chapter 1 - Solution Overview Authentication and Credentials The default, and simplest, means of authentication, i.e. making sure that you are a person authorized to access a computer or other resource, is your Windows account name and password. Authentication is generally required in logging on to Windows, accessing network applications and resources, and logging into to websites. DigitalPersona Pro clients provide a means for the IT Administrator to easily setup and enforce strong authentication such as two-factor and multi-factor authentication using a variety of supported credentials. DigitalPersona Pro supports the use of various credentials for authentication, including Windows passwords, fingerprints, smart cards, contactless cards, proximity cards, face, PIN, Bluetooth and One- Time-Passwords. An additional Self Password Recovery credential may be used solely for recovering access to a managed client computer in place of a forgotten password. Initial setup and enrollment of credentials is provided through a Setup wizard, or may be controlled by an administrator using Attended Enrollment. Security applications DigitalPersona Pro Enterprise security applications integrate with the basic functionality of the solution. Additional DigitalPersona Pro Enterprise security applications may be available. Contact your DigitalPersona partner or reseller for further information, or go to our website at: Password Manager Admin Tool The Password Manager Admin Tool simplifies and secures access to password-protected software programs and websites through the use of managed logons that allow users to identify themselves through the use of any supported credential or combination of credentials specified by the administrator, as defined in the Authentication and Credentials topic above. Administrators use the DigitalPersona Password Manager Admin Tool to create managed logons specifying information for logon and change password screens for websites, programs and network resources. These managed logons are then deployed to managed workstations, where they are accessible to the user through the Password Manager application and the mini-dashboard. Managed logons always take precedence over personal logons created by users. For additional information on the Password Manager Admin Tool, see the DigitalPersona Password Manager Admin Tool Application Guide (available on our website at Support), or see the help file within the program. DigitalPersona Pro Enterprise - Administrator Guide 15

16 Chapter 1 - Solution Overview Licensing model DigitalPersona Pro Enterprise features and functionality as described in this Administrator Guide are included in the core version of the product, unless otherwise indicated. The basic licensing model is the User license, which permits enrolling of user credentials by a specified number of DigitalPersona Pro Enterprise users. The specific DigitalPersona Pro SKU and/or package you purchased may entitle you to licensing of one or more additional modules or components that are integrated with DigitalPersona Pro. You should have received from DigitalPersona or from a DigitalPersona authorized reseller all of the license activation keys and/or files that are part of the package you purchased. Make sure you contact your DigitalPersona representative, should you have any questions. Some modules or optional components may need to be activated individually. For information on other licensed versions of the product which may be available, and licensing for specific features, contact your DigitalPersona Account Manager or Reseller - or visit our website at: Licenses may be activated through Active Directory using the License Activation Manager. For more information about DigitalPersona Pro Enterprise license activation, see License Activation & Management on page 67. DigitalPersona Pro Enterprise - Administrator Guide 16

17 Chapter 1 - Solution Overview System Requirements Product/Component DigitalPersona Pro Enterprise Server DigitalPersona Pro Workstation for Enterprise DigitalPersona Pro Kiosk for Enterprise Minimum Requirements Microsoft Windows Server 2008 R2 (32/64-bit) or Windows Server 2003 SP2 (32/64 bit) or Windows SBS 2003 SP2 Active Directory 12 MB disk space plus 5Kper user Windows Server 2008 R2 (32/64-bit) or Windows Server 2003 SP2 (32/64-bit) or Windows 7/8/Vista (32/64-bit) or Windows XP Professional SP3 (32/bit).* Home editions of Windows 7/Vista/XP are not supported. 50 MB disk space, 100 MB during installation Microsoft Internet Explorer 6-10, Chrome 11+ or Firefox 4+ to create/ use Password Manager personal logons or use managed logons. Microsoft Internet Explorer 6-10 to create managed logons using the Password Manager Admin Tool Windows 7/8/Vista (32/64 bit) or Windows XP Professional SP3 (32 bit). Home editions are not supported. 50 MB disk space, 100 MB during installation Microsoft Internet Explorer 6-10, Chrome 11+ or Firefox 4+ to use managed logons * Also supported: Windows XP Embedded SP3, Windows Embedded Standard 2009 and Windows Embedded Standard 7, with dependencies as documented on page 210. Personal logons allow end-users to create automated logon to programs, websites and network resources. Managed logons have the same function but are created by an administrator and deployed to end-users. NOTE: When using Internet Explorer on Windows 8, Password Manager features are only available when the browser is launched from the legacy desktop, not from the Metro UI. Support Resources The following resources are provided for additional support. Readme files in the root directory of each product package contain late-breaking product information. AskPersona.com ( is a DigitalPersona knowledge portal providing answers to many frequently asked questions about our products. DigitalPersona Maintenance and Support customers will find additional information about technical support resources in their Maintenance and Support confirmation . Online help is included with each component and application. DigitalPersona Pro Enterprise - Administrator Guide 17

18 Chapter 1 - Solution Overview All DigitalPersona Pro Enterprise documentation is available on our website at: Changes from previous version 5.5 vs The major differences between the 5.5 release and the previous release are summarized below. 1 Support for Microsoft 2012 server. 2 Support for NetMotion. 3 Fingerprint authentication for Citrix XenDesktop 4 Microsoft Windows Logo Certification. 5 The User Query Tool has been modified to enable reporting users who have answered the Self Password Recovery questions. 6 Support for U.are.U 5160 PIV Certified fingerprint sensor, Eikon II and Eikon Mini fingerprint readers. 7 Passwords are treated as credentials, and therefore consume a license, only when used for SSO and for authentication into the Pro Administrative Console. 8 The Delete License command has been refined so that user data from the local cache is removed during the process, and the warning (from v5.4.1) not to use DigitalPersona Pro on this account in the future is no longer necessary. 9 Enhancements to the processes for enrolling and using Card credentials (Smart Cards, Contactless Cards and Proximity Cards) to simplify their use and align the experience more closely with that of other credentials. 10 Support for two models of Dell/Wyse thin clients; D90 & Z90 running Ubuntu and SUSE) using ICA or RDP clients. Requires separate part number and download vs 5.4 The major differences between the release and the previous 5.4 release are summarized below. 1 Delete License - A new feature available through the DigitalPersona Users and Computers snap-in allows the administrator to delete the DigitalPersona user license for a selected user. This new command on the context menu for a user in the Active Directory Users and Computers console releases the DigitalPersona license associated with this user back to the license pool. DigitalPersona Pro Enterprise - Administrator Guide 18

19 Chapter 1 - Solution Overview Note that use of this command will delete all DigitalPersona credentials and other user data stored in Active Directory. The user account should no longer be used with DigitalPersona Pro, and the product should not be reinstalled in the same user account. If use of DigitalPersona Pro is attempted on this account, an Access Denied error will be reported due to previously locally cached credentials. See page User Query Tool - Additional functionality has been added to the User Query Tool which now returns a flag indicating whether a license was taken by a specified user, and provides the ability to delete the license. See pages 86 and following. 3 Kiosk access restrictions - Note that in versions prior to 5.4.1, kiosk access restriction through an identification list (see page 215) applies only to fingerprint access, and access through other credentials, such as WIndows password, is not restricted. Beginning with version 5.4.1, the restriction applies to all supported credentials vs 5.3 The major differences between the 5.4 release and the previous 5.3 release are summarized below. 1 DigitalPersona Reporter has a brand new interface, with dozens of reports for compliance and auditing, the ability to schedule, and export in popular formats such as PDF, XLS, XML, and the ability to extensively filter and customize reports. Pre-canned reports support HIPAA, PCI and Sox compliance standards. 2 New simplified Client Suite Installer and Administrative Suite Installer provides a more convenient way to install related Digitalpersona Pro Enterprise components. 3 DigitalPersona Pro Workstation for Enterprise can now be installed in Evaluation mode, which does not require connection to a DigitalPersona Pro Enterprise Server. 4 Client licenses are no longer required for DigitalPersona Pro Workstation and Pro Kiosk. Pro Server User Licenses are required to cover the number of users enrolling credentials in the DigitalPersona Pro Enterprise environment. Instructions for installing the previous version (5.3) Client Package and Component licenses are included for reference beginning on page New Fast Connect feature allows for SSO to Citrix Published Applications and Desktops with XenApp and XenDesktop. See Citrix Deployment Scenarios on page Quick Actions now support the use of smart (contact, contactless and proximity) cards, and the new Fast Connect feature. See Quick Actions tab on page Support has been added for Windows 8, in Legacy mode only. 8 Additional per-user policies and settings. See User properties on page 82. DigitalPersona Pro Enterprise - Administrator Guide 19

20 Chapter 1 - Solution Overview 9 The User Query Tool now reports the dates that fingerprints were first enrolled and last enrolled. See User Query Tool snap-in on page Password Manager Pro has been renamed the Password Manager Admin Tool. 11 Some pages and settings in the Administrative Console have been changed. Management of DigitalPersona Pro Users is no longer available through the Administrative Console. See Pro Administrative Console on page The DigitalPersona Pro 5.4 package includes a new version (v5.7) of DigitalPersona Defender. 13 Support for new contactless (Felica) and proximity (Indala) cards. 14 User secrets (i.e. Password Manager logon account data) created on disconnected computers are now synchronized with the Pro Server data once reconnect ion is established. 15 New centrally-managed, roaming, question-and-answer-based Self Password Recovery feature allows the user to recover access to any domain computer where they have logged on at least once. 16 Support for YubiKey tokens used as RFID tokens or as OTP tokens through DigitalPersona Defender. 17 On Windows Server 2003, DigitalPersona administrative templates are installed in a new location, the Windows\Inf\{language} folder. When upgrading previous versions of Pro Server to on Windows Server 2003, all adminstrative templates have to explicitly be removed from GPOs, and the new adm files added to Administrative Templates. 18 DigitalPersona Drive Encryption is not supported in this version. DigitalPersona Pro Enterprise - Administrator Guide 20

21 Section One: Installation This section of the DigitalPersona Pro Enterprise Administrator Guide includes the following chapters: Chapter Number and Title Purpose Page 2 - Pro Server Installation Requirements and procedure for installing DigitalPersona Pro Enterprise Server. 3 - Pro Client installation Requirements and procedure for installing DigitalPersona Pro clients. 4 - Pro Kiosk installation Requirements and procedure for installing DigitalPersona Pro Kiosk clients. 5 - Optional installations Requirements and procedure for installing optional DigitalPersona Pro Enterprise components DigitalPersona Pro Enterprise - Administrator Guide 21

22 Pro Server Installation 2 This chapter provides instructions for the installation of DigitalPersona Pro Enterprise Server on a domain controller. Instructions for uninstalling DigitalPersona Pro Enterprise Server are on page 31. Deployment Overview Here is a high-level overview of the steps required for initial deployment of DigitalPersona Pro Enterprise Server on the domain controller for a Windows 2003/2008 Server network. Procedure 1 Extend the Active Directory schema to include attributes and classes used by DigitalPersona Pro Enterprise Server. Requires AD Schema Administrator rights. You can view the details of the changes that will be made to the schema by opening the file dp-schema.ldif located in the AD Schema Extension folder in the product package. 2 Configure each domain on which DigitalPersona Pro Enterprise Server will be installed by running DPDomainConfig.exe (located in the folder "AD Domain Configuration" in the product package). Requires AD Domain Administrator rights. 3 Install the DigitalPersona Pro Enterprise Server software. Note that this will set firewall rules necessary for the operation of DigitalPersona software. 4 (Windows Server 2003 only) Add DigitalPersona Administrative Templates to OUs. 5 (Optional) Configure Pro Enterprise Server for use with DigitalPersona Pro Kiosk, if Pro Kiosk will be used in the domain. Detailed instructions for installation begin on page 22. Page , Upgrading from Previous Versions Before upgrading from a previous version, it is critical that you refer to the DigitalPersona Pro Upgrade Notes available at Direct upgrades from DigitalPersona Pro for Active Directory versions previous to are not supported. If you need to upgrade from a version prior to 4.4.3, you will need to upgrade to Pro and then upgrade to Pro Enterprise 5.4. A Migration Guide is available from DigitalPersona or your authorized DigitalPersona Pro Enterprise - Administrator Guide 22

23 Chapter 2 - Pro Server Installation channel partner for upgrading from DigitalPersona Pro for Active Directory to DigitalPersona Pro Enterprise 5.3. Also, make sure to review the readme.txt files included with each component in the product package that you are installing. Compatibility DigitalPersona Pro Enterprise Server version 5.4 is compatible with the following DigitalPersona products: DigitalPersona Pro Workstation for Enterprise and above. DigitalPersona Pro Kiosk for Enterprise and above. DigitalPersona Password Manager Admin Tool and above DigitalPersona Privacy Manager Pro 5.51 or higher DigitalPersona Defender Server 5.7 DigitalPersona Pro Server Enterprise 5.4 should NOT be installed over (or upgraded to) DigitalPersona Pro Server for Active Directory versions prior to used in a mixed environment with Pro Server for Active Directory versions 3.x or 4.x or with Pro Workstation/Kiosk 3.x/4.x. If any previous version of DigitalPersona Pro Server for Active Directory was installed, the administrator should uninstall it and run the DigitalPersona Cleanup wizard (located in the product package) to delete all the previous DigitalPersona Pro data. This release is not compatible with, and requires the uninstallation of any other DigitalPersona products on the same computer. Extending the Active Directory Schema Prior to installing DigitalPersona Pro Server, the Active Directory schema must be extended to create new attributes for the user object and new classes, as well as to make modifications to existing classes. The Active Directory Schema Extension Wizard automatically handles all of the necessary changes to the schema. This schema extension is version 2. The schema extension version number is independent of the DigitalPersona Pro product version number. Each Pro product release will identify the schema extension version it requires. This schema extension is global to the Active Directory forest. If you want to view the script that is used to extend the schema (dp-schema.ldif), it is available in the product package at the following location: AD Schema Extension\dp-schema.ldif DigitalPersona Pro Enterprise - Administrator Guide 23

24 Chapter 2 - Pro Server Installation The Active Directory Schema Extension Wizard must be run from the schema master domain controller, or the data may not replicate fast enough to allow the wizard to continue. If the data is not replicated fast enough, the wizard will terminate, and you should then wait one replication cycle before running the wizard again. After the schema extension, and again after configuring your domains, you must wait for Active Directory schema replication to be completed. The amount of time this takes will depend on the complexity of your Active Directory structure. You must have Schema Administrator privileges to run the Schema Extension Wizard. To run the Active Directory Schema Extension Wizard 1 Double-click DPSchemaExt.exe, which is located in the Schema Extension folder in the Server installation package, to start the Schema Extension Wizard. 2 Read the terms and conditions on the License Agreement page. If you agree with them, select I accept the license agreement and then click Next. 3 When prompted to proceed with the schema extension, click Yes. 4 Next, specify a location and name for the log file generated by the Schema Extension Wizard in the Save Log File As dialog box. Then, click Save. 5 If the schema is not writable, the wizard will inform you of the fact and will allow you to make it writable. If this dialog box displays, click Yes to make the schema writable and perform the schema extension. 6 The wizard will extend the schema and provide information such as the class and attribute names. To close the wizard, click Finish. The name of each new attribute and class added to the Active Directory schema follows Microsoft naming conventions. The names are assigned a dp prefix, which is registered with Microsoft. The OID base, generated by Microsoft, is Configure each domain For each domain on which you plan to install DigitalPersona Pro Server, you need to run the DigitalPersona Pro Active Directory Domain Configuration Wizard, which configures the required domain-specific data including the necessary cryptographic keys. Running the wizard requires administrator privileges on the domain controller. You should run this wizard only once on each domain where Pro Server will be installed. When installing multiple DigitalPersona Pro Enterprise Servers, it is critical that you run the wizard only once during any replication period, allowing full replication to be completed before going on to run the wizard on the next domain. DigitalPersona Pro Enterprise - Administrator Guide 24