Defender Group Policy Templates Installation and Configuration Guide

Transcription

1 Defender Group Policy Templates Installation and Configuration Guide Introduction Defender provides two Group Policy administrative templates that can be used to provide additional features and configuration options that are not available in the Defender Administration Console. Defender Group Policies There are currently two administrative templates available providing the following features: 1. DefenderGroupPolicy.adm An option to limit the maximum configurable expiry time for the Temporary Helpdesk Token response feature. Configuration options for programming Defender Desktop Tokens when managing Defender using the ActiveRoles Server Web Interface. An option to include a Send Mail feature allowing the sending of the token activation code by for a newly programmed Desktop token. 2. DefenderBindingGroupPolicy.adm A configurable performance enhancement for large installations. The Defender Binding Group policy is included in hotfix and later. 1

2 Installing Group Policy Administrative Templates This section describes how to install the Defender Group Policy administrative templates on your server. The Defender Group Policy administrative templates are located in the \Main_Product\Defender Administration Console folder in the Defender installation files. 1. On a domain controller copy the file named DefenderGroupPolicy.adm and / or DefenderBindingGroup- Policy.adm to %windir%\inf. 2. Start the Group Policy Object Editor (run gpedit.msc). 3. Navigate to Computer Configuration \ Administrative Templates. 4. From the Action menu, select Add/Remove Templates On the dialog that is now displayed, select Add, then select DefenderGroupPolicy.adm and / or DefenderBindingGroupPolicy.adm. 6. On the Add/Remove Templates dialog, select Close. Defender specific settings can now be edited and deployed, together with standard Windows policy settings. On Windows 2008 the template will appear within the Classic Administrative Templates (ADM) folder. 2

3 Defender Group Policy Template The following section describes how to configure the individual features of the Defender Group Policy Template: Temporary Responses ActiveRoles Server Web Interface - Token Programming Mail Configuration Temporary Responses This feature can be used to set a maximum limit on the expiry time for temporary helpdesk token responses. 1. From the Group Policy Object Editor (run gpedit.msc), Temporary Responses Properties dialog, select Enabled. 2. In the Maximum expiry time field, select the maximum length of time that a temporary Helpdesk Token response can remain valid. 3

4 When assigning a temporary helpdesk token response to a user the maximum expiry time is now set to the value within the group policy. 3. Select Apply and then OK to save your settings. 4

5 ActiveRoles Server Web Interface - Token Programming This feature is only for use with the ActiveRoles Server (ARS) Web Interface. If you are using ARS Web Interface in your environment and would like to limit the types of tokens and / or token programming modes that are available when programming tokens this feature can be enabled. 1. On the ActiveRoles Web Interface - Token Programming Properties dialog, Select Enabled 2. Enable or disable the token types and token programming modes from the Options section. 3. Select Apply and then OK to save your settings. 5

6 Mail Configuration This feature is used to provide SMTP server settings and configuration options. With this feature enabled a Send option is available on the Save Activation Codes dialog when the Token Programming Wizard is running. 1. On the Mail Configuration Properties dialog, Select Enabled. 2. In the SMTP Server field, enter the IP Address of your SMTP Server. 3. In the SMTP Server Port field, enter the port number required e.g In the Address from which to send mails field, enter the address from which all activation code s will be sent. 5. In the CC address to which mails are sent field, enter the address to which a copy of each activation code will be sent. 6. To send the in HTML format leave Send message as plain text unchecked. To send the in plain text enable this checkbox. This configuration option is new in Defender Administration Console hotfix With this option unchecked the will be sent in HTML format. When using HTML an auto activate option. (to automatically copy the activation code) is then available from the for Android and itokens. 7. If required, you can include standard text that will be printed at the bottom of each activation code that is sent. 8. Select OK to save all settings. 6

7 Sending an Activation Code by With this feature enabled a Send checkbox and Send To field are available on the Defender Token Programming Wizard, Save Activation Codes dialog. To send the activation code for a newly programmed Desktop Token to the user by 1. Check the Send checkbox. 2. In the Send To field, enter the token recipient's address. If an address is configured on the user's Active Directory Account, this will automatically display in the Sent To field. 3. Select Next to save the settings and continue with the Defender Token Programming Wizard. For further information, refer to the Defender Token Administration Guide. Microsoft.Net Framework 3.5 is a requirement for this feature. 7

8 Defender Binding Group Policy Template This is a new feature introduced in Defender Administration Console hotfix which provides a configurable performance enhancement for large installations to ensure that Defender will always use the Active Directory (AD) server that Active Directory Users & Computers (ADUC) is connected to when reading / writing data. ADSI Configuration With this feature enabled and the 'Allow serverless bind' checkbox unchecked Defender will use the server that ADUC is connected to when reading and writing Defender objects in AD. With this feature enabled and the 'Allow serverless bind' checkbox checked Defender will allow Active Directory Service Interfaces (ADSI) to select which server to bind to when reading or writing Defender objects in AD. There is no requirement to install this group policy or enable this feature unless you wish to change the default behaviour of the Defender Administration Console. If this feature is not enabled then Defender will work in the same way as it has done in all previous versions i.e. allowing ADSI to select which server to bind to Dell Inc. ALL RIGHTS RESERVED. Quest, Quest Software, the Quest Software logo and Defender are trademarks of Quest Software, Inc., and its subsidiaries. See for a complete list of Quest Software's trademarks. Other trademarks are property of their respective owners. 8