Password Reset PRO INSTALLATION GUIDE

Transcription

1 Password Reset PRO INSTALLATION GUIDE This guide covers the new features and settings available in Password Reset PRO. Please read this guide completely to ensure a trouble-free installation. March 2009 Version 2.0 Copyright SysOp Tools, Inc.

2 Contents Contents... 2 System Requirements for Installed Applications... 3 Installation Options (Single Tier or Two Tier)... 4 Single Tier / Standalone (All on One Physical or Virtual Server)... 4 Two Tier / High Security (Requires at Least Two Separate Physical or Virtual Servers)... 4 Installation Prerequisites... 5 Single-Tier Installation (Install everything on one server)... 5 Two-Tier Installation (Install Web Portal and Master Service on Separate Servers)... 5 Password Reset PRO Installer Screens... 6 Password Reset PRO Configuration Master Service Configuration Settings Configure the Master Service Application FIRST! Set the IP Address of your Web Portal Server(s) and Select TCP Service Port Configure Installed Windows Service (The Master Service ) Configure Web Portal and User ID Security Options Customize Message Text Areas Within the Web Portal Set Log File Path, SMTP Server and Admin Settings Web Portal Configuration Settings Specify the Master Service Server IP address and Service Port Brand your Web Portal! Testing the Web Portal Installation Notifying Users to Enroll and Using the Reporting Console Reporting Console General Overview Send Enrollment Notification s to Users Post Installation Security Enhancements Advanced Network Configuration & Firewall Settings Firewall configuration Web Portal Server Traffic (Extranet or DMZ) Master Service Server Traffic (Intranet or LAN) Special Note: First Time Installing IIS on Server 2003 / 2008? You need to enable ASP.NET (.aspx pages) in IIS Enable ASP.NET as an allowed protocol in 2003 / IIS Add ASP.NET Protocol in Server 2008 IIS7 using Role Services Troubleshooting & Reference Links for IIS and SSL Configuration SysOp Tools Online KB: Configuring & Enabling SSL in IIS6 / IIS7: Installing SSL Certificates: Enabling or Re-Registering ASP.NET in IIS:... 24

3 System Requirements for Installed Applications Operating System Requirements: o Microsoft Windows Server 2003, 2003 R2 (x86 and x64) o Microsoft Windows Server 2008 (x86 and x64) o Installation on virtual servers is fully supported and encouraged Microsoft.Net Framework v (x86) or Microsoft.Net Framework v (x64) must be installed before installation of software application components The following requirements apply to specific application components: Web Portal Application Requires the Following: o Server 2003: IIS 6 or above with ASP.NET 2.0 protocol enabled o Server 2008: IIS 7 default configuration + ASP.NET & required dependencies o Minimum Server Specs: 1GB RAM, 1ghz processor, 2mb available HDD space Master Service Application Requires the Following: o Active Directory domain member server located on the same subnet or SITE as your primary (FSMO) DCs. Direct installation on a domain controller is possible but not recommended. o A domain\user account with Domain Admin or Enterprise Administrator permissions or other appropriate delegated rights with read/write permissions on user objects within your licensed domain or organizational unit. This domain\user account will be used to run the installed Master Service located in Windows Services. o Minimum Server Specs: 2GB RAM, 2ghz processor, domain membership, 50mb available HDD space - 3 -

4 Installation Options (Single Tier or Two Tier) Password Reset PRO can be installed in two configurations based on your infrastructure needs: Single Tier / Standalone (All on One Physical or Virtual Server) Both the Web Portal application and Master Service application are installed and run on the same physical or virtual domain member server. This server MUST be a member of the domain you have licensed! Choose this option if you are limited on physical server hardware, are not overly concerned with external security, or will not publish external (internet) user access to the Web Portal. Two Tier / High Security (Requires at Least Two Separate Physical or Virtual Servers) The Web Portal application (Front End) and Master Service application (Back End) are installed on separate physical or virtual servers. The Web Portal server may reside in a DMZ or other extranet that is firewalled from the internal domain (LAN). The Web Portal server does not need to be a member of the domain and can be a simple workgroup server. The Master Service server MUST be installed on a domain member server located on the same subnet or SITE as your primary (FSMO) DCs. The Web Portal server and the Master Service server will communicate to each other over a single port published through your firewall. Communication between servers is RSA secured and Blowfish encrypted. You can deploy multiple Web Portal servers and Master Service servers for failover, load balancing, or combination of internal (LAN) use and external (Internet) use. Easy! **This is the RECOMMENDED installation if you will allow public (internet) user access to the self-service Web Portal

5 Installation Prerequisites Follow the instructions below to install Password Reset PRO in a standalone Single Tier (Single Server) configuration or distributed Two Tier (Two Server) configuration (Preferred). Single-Tier Installation (Install everything on one server) Prerequisites You will need the following before proceeding with installation: 1. A physical or virtual server running a supported Windows Server operating system and is a domain member-server (installation on domain controller or Exchange not recommended). 2. Microsoft.Net v installed 3. Microsoft Internet Information Server (IIS) 6.0 or above installed 4. See System Requirements on page 3 for additional detailed specs Two-Tier Installation (Install Web Portal and Master Service on Separate Servers) Prerequisites - Master Service Installation Server You will need the following before proceeding: 1. A physical or virtual server running a supported Windows Server operating system and is a domain member-server (installation on domain controller or Exchange not recommended). 2. Microsoft.Net v installed 3. See System Requirements on page 3 for additional detailed specs Prerequisites - Web Portal Installation Server You will need the following before proceeding: 1. A physical or virtual server running a supported Windows Server operating system. The Web Portal server may reside in a DMZ or other extranet that is firewalled from the internal domain (LAN). The Web Portal server does not need to be a member of the domain and can be a simple workgroup server. 2. Microsoft.Net v installed 3. Microsoft Internet Information Server (IIS) 6.0 or above installed 4. See System Requirements on page 3 for additional detailed specs Prerequisites Network / Firewall 1. Allow a single port to communicate between Web Portal Server and Master Service server through your firewall. The default port is 5000, however you may change this in the application configuration settings. Server to server communication is RSA secured and Blowfish encrypted. 2. Configuring external / public Web Portal access: Please refer to the Advanced Network Configuration section of this guide for further details and instruction. Ready? On the next page we ll begin installation of Password Reset PRO >> - 5 -

6 Password Reset PRO Installer Screens Run the Password Reset PRO installation setup program: 1. Welcome Screen click next. 2. Read the entire license agreement and choose accept to continue - 6 -

7 3. Installation choices: a. Choose Single-Server Full Installation to install the Web Portal and the Master Service on the same server. b. Choose Install Internal Service Only to install the Master Service on an internal domain member server. Select this option if you will install the Web Portal on a different server. c. Choose Install User Web Portal Only to install the Web Portal only. Choose this option if you will install the Master Service on a different server. Continued on next page - 7 -

8 4. Accept default installation paths for the Web Portal (IIS site) and Configuration Tool: 5. Accept the default installation path for the Master Service: Continued on next page - 8 -

9 6. Choose Install to begin the installation: 7. Please wait while the installation completes: Continued on next page

10 8. Finish the installation and launch the Web Portal Configuration Utility and Master Service Configuration Utility. Installation Complete! Next section: Configuring Password Reset PRO >>

11 Password Reset PRO Configuration Master Service Configuration Settings 1. Configure the Master Service Application FIRST! Open the Master Service Configuration Utility. a. Enter your license keys under Add License Key. b. Web Portal Deny List: Enter accounts you want to exclude from accessing the Web Portal. We STRONGLY recommend adding all well known accounts such as Guest and Administrator, and any other sensitive user accounts with an expiring password. As a security feature of our software, all nonpassword-expiring user accounts and System accounts are denied Web Portal login access by default. c. Refresh User Accounts: Password Reset PRO refreshes its list of Active Directory users every 5 hours by default. You can change this interval or click refresh now to do an immediate update. If you just created several new user accounts and want them to use the Web Portal immediately, click refresh now to update Password Reset PRO. Similarly, click Refresh if you made structural changes to your AD. Master Service Configuration Screen Continued on next page

12 2. Set the IP Address of your Web Portal Server(s) and Select TCP Service Port Web Portal IP Address: a. Single Tier (single server) installation: Enter (localhost) as the IP address of the Web Portal. b. Two Tier (separate server) installation: Enter the IP address of the server on which you installed the Web Portal application. Tip** To allow access from multiple Web Portal servers to the Master Service, you can enter additional external web portal server IP addresses separated by a semicolon (;). Perfect for failover, load balancing, or combination of LAN and Internet access portals. IMPORTANT: Persistent or sticky sessions are required for use behind a load balancer. Service Port: a. Select the TCP network port to be used for connecting the Master Service server to the Web Portal Server. You MUST allow this port access through your firewall if the servers are separated by the firewall. Change the port number as needed. b. For Single-Tier installations with both Web Portal and Master Service on the same server, it is OK to leave the port setting as-is. Master Service Configuration: Continued on next page

13 3. Configure Installed Windows Service (The Master Service ) It is extremely important to configure the installed Master Service correctly. If you do not grant the service appropriate domain permissions and start the service, users will not be able to log in to the Web Portal. a. Click Open Windows Services button. The Windows Services snap-in opens. b. Find Password Reset PRO Master Service and open the service properties. c. In the Log On tab of the service properties, set the Log on as to a valid domain\user account that has Domain Admin or Enterprise Admin rights, or delegated permissions to modify user objects including password change, password reset, account unlock, and write properties on all licensed password expiring user objects. d. Click Apply, then start or restart the service for the settings to take effect. e. Make sure the Startup Mode is set to Automatic Security Note: The service account credentials and password used by Password Reset PRO are ONLY stored natively by Windows, nowhere else! This ensures native Windows security remains intact when installing our software. Tech Note: When a user creates a Portal Logon Identity in the Web Portal, their identity information is written to an existing attribute within their Active Directory user account. This identity information allows a domain user to access the Web Portal when their password is expired or when their account is locked out. Therefore, it is imperative for the Master Service to have permissions to write the identity information to the AD user object. Master Service Configuration:

14 4. Configure Web Portal and User ID Security Options. a. Max Failed Domain Login Attempts: Maximum number of allowed domain authentication attempts in the Web Portal when user enters domain account / domain password combination. This activity takes place when a domain user is setting up a new Web Portal ID profile. **Make sure this setting is 1 less than your domain password lockout policy threshold! Example: If your domain lockout policy is set to 5 bad attempts, set this to 4. b. Max Failed Profile Login Attempts: Maximum number of allowed ID profile authentication attempts in the Web Portal when user enters Security Image / Security Word combination. This activity takes place when a domain user with an established ID Profile is attempting to log in to the Web Portal. The default setting is 2 bad attempts, typically 4 bad attempts is a good setting. c. Profile Security Word Settings: Sets a level of complexity for Web Portal users creating or changing their Profile ID security word. By adding complexity, this keeps users from using overly-simple security words. d. Min Length: Sets the minimum length of the security word. We recommend setting this to the same length as your domain password policy setting. e. Banned Words: List of words than cannot be used as part of a profile security word. The default list of words includes easy to guess words when compared to the table of security images, and also includes the variable %username% which excludes use of their domain user name. We recommend not removing any of the default words. f. Reset User Web Portal ID: Allows you to reset a user s security profile on the Web Portal. Only use this if a user has forgotten their Web Portal login. After resetting the user s ID profile, the user must revisit the Web Portal and create a new login. Master Service Configuration:

15 5. Customize Message Text Areas Within the Web Portal. This allows you to present custom messages to your users that reflect your organizational requirements. The locations where users see these custom messages are on the Change Password page, Reset Password page, Submit Help Request page and Contact Admin page. a. Domain Password Requirement: Change this text to match your internal domain change password policy. Users will see this text when changing or resetting their domain password in the Web Portal. We have provided example text here to help get you started. This text should describe your domain password policy settings. b. Help Request Page: Within the Web Portal, users have an option to send a help request to an administrator or help desk. This message is displayed on the Help Request page for the user. We have provided default text to get you started. c. Contact Admin Page: If a Web Portal user is denied access or encounters an error, they are diverted to a Contact Admin page to request help. This message is displayed on the Contact Admin page for the user. We have provided default text to get you started. Tech Note: You can use basic HTML markup tags to improve the looks of the web portal messages. Do not include script tags or image tags as they will not work. Master Service Configuration: Continued on next page

16 6. Set Log File Path, SMTP Server and Admin Settings a. Choose a local SMTP relay server for sending administrator alerts and daily summary report s. Make sure your Exchange server virtual SMTP relay is set to allow connection and relay from the IP of the Master Service server. ** If you do not correctly set up connectivity to your mail relay server, you will not receive any s or reports from Password Reset PRO! b. Send Immediate s to: Add an address for receiving immediate alerts such as account unlock events and system errors. Immediate alerts are sent in real-time as they happen and should be sent to an IT Administrator. c. Send Help Request s to: Add an address for receiving user help requests from the Web Portal. You may want these s to go to your helpdesk group or ticketing system. d. Send Daily Reports to: Add an address for receiving the Daily Summary Report . This report contains a summary of all Web Portal events for the last 24hr period. Typically this should go to a helpdesk group or UT administrator group for daily review. Click Test to send a current copy of the Daily Summary Report. e. Audit Reports: Export a list of all active password expiring user accounts that do not have a logon profile established on the Web Portal. The user s name, domain account and address are exported to an XML-based Excel spreadsheet (Excel 2003 or later required) for easy review. Extract addresses from the exported data and send a reminder to your users, encouraging them to create a profile on the Web portal. Tech Note - Disabling s: If you leave an address field blank, the feature will be disabled. Testing delivery: Use the Test button to verify connectivity. You should receive a test to the specific address. Master Service Configuration:

17 Web Portal Configuration Settings 7. Specify the Master Service Server IP address and Service Port. Open the Web Portal Configuration Utility to begin entering settings. (Make sure you have completed configuration of the Master Service Application in steps 1-6 first). Master Service Server IP Address: a. For Single Tier (all on same server) installation, enter (localhost). b. For Two Tier (separate server) installation, enter the IP address of the server where you installed the Master Service. c. Service Port: Set the Service Port to the same port you specified in the Master Service Configuration. By default the Service Port uses TCP 5000 d. Use the Test button to test the connection between Web Portal application and Master Service application; you should receive a success message. If you receive an error message, investigate and resolve. e. IIS Web Server Status: Shows you the current state and settings of the Web Portal on your server. These settings can be changed through the IIS manager. f. Click Save Changes and you should see the link turn blue. Click the link to test-launch the Web Portal and verify your settings. Tech Note: If the Service Port number does not match in the Master Service configuration and the Web Portal configuration settings, the connection between the applications will fail. If you have a firewall or router between the Web Portal Server and the Master Service Server, make sure you allow bidirectional port traffic for this TCP port between the two servers. Web Portal Configuration Settings

18 8. Brand your Web Portal! You may change the Web Portal page title, image header and add footer text / hyperlinks. Max header image size is 800px by 150px. We recommend keeping the banner height around 65px high. Web Portal Configuration Settings Browser Title Text Area Header Image Area Footer Text & Link Area

19 Testing the Web Portal Installation By default, the installation configured your Password Reset PRO Web Portal to use HTTP port You can change the port settings in the Server IIS manager. We strongly urge only allowing SSL connections (HTTPS) for external (internet) access to the Web Portal. 1. Log on to the server where you installed the Web Portal application. Open your browser and type The Web Portal will take about 30 seconds to compile the ASP.NET code and then display the main logon page. The compile time only occurs the very first time you load the Web Portal. Users accessing the Web Portal will not experience this delay after the 1 st -time compile. 2. If you have already set up DNS for the web server, try accessing the Web Portal from a workstation on the LAN by typing: If the page displays, this means you have everything operational with DNS and Password Reset PRO s settings. You can now configure SSL and add your SSL certificate as required, and require users to access the server via https: protocol. 3. Log on to the Web Portal with an active password-expiring user account and set up a new user ID Profile. Log off the Web Portal and then log back on with your new Profile ID. This will give you an understanding for how the process works and what your users will see. Note: Keep in mind that non-password-expiring user accounts cannot use the Web Portal! Log on and try it out!

20 Notifying Users to Enroll and Using the Reporting Console Reporting Console General Overview Password Reset PRO includes a powerful Reporting Console designed to assist you with enrolling and maintaining Web Portal users, and quickly audit / report on Web Portal events. All data in the Reporting Console is exportable to Excel 2003/2007 for further review and distribution. Tab Views Available in the Reporting Console: Licensed User Accounts: (Licensable Users). Shows all active password expiring user accounts covered under your current license key(s) and licensed user count. All users in this tab view are able to log in and use the Web Portal. Licensed Users Not Yet Enrolled: Shows Licensable Users covered under your current license key(s) that have not enrolled in the Web Portal system. Use this view to select users not enrolled and send them an enrollment notification . Note that user accounts with an expired logon, expired password, or locked account will NOT be able to initially enroll in the Web Portal and cannot be selected to send a notification . Unlicensed User Accounts: Shows new active password expiring user accounts NOT covered by your current license key(s) due to insufficient licensing. All users in this view are NOT able to use the Web Portal until you add more users to your current license key. If you see users in this view contact our Support Team: (M-F 8am-6pm PST) Excluded User Accounts: Shows user accounts that are excluded from using the Web Portal. Common exclusions are: Password does not expire, Account is a System account (UAC=544), Account is on Deny List in Master Configuration Tool. Typically you should only see user accounts in this view which are used to run services, resources or domain systems. Disabled Accounts: Shows user accounts that are set to administratively disabled (UAC=514) Web Portal Event History: Activity audit log of all Web Portal history events up to configured log file purge date. Info / Export Data: Help text for the Reporting Console. Use the Export Data button on this tab to export selected Report Console data to an Excel 2003 / 2007 file for further review and distribution. Send Enrollment Notification s to Users Now that your installation of Password Reset PRO is functional and you have (hopefully) applied an SSL certificate / HTTPS access to the Web Portal, you need to invite your users to enroll and begin using the system. The Reporting Console contains a mass function that allows you to select licensed users not yet enrolled in the Web Portal system, and send them a professional customized invitation . The Reporting Console also provides ability to keep track of who has enrolled and who has not, allowing you to send additional invitation s as needed

21 Post Installation Security Enhancements Follow the optional Post Installation Steps to further configure your Web Portal installation and strengthen security. By now your Password Reset PRO Self Service Portal is operational. If you plan on making the Web Portal publically accessible to your remote users via the internet, we urge you to strongly consider the following steps for strengthening perimeter security: Configure IIS and the Web Portal with a public IP and only allow Port 443 Allow SSL connections only to the Web Portal (disable Port 80 access) Install a trusted SSL certificate from a Certificate Authority such as Verisign Advanced Network Configuration & Firewall Settings Password Reset PRO may be used in a high security environment by placing the Web Portal application on a separate non-domain server in a DMZ or extranet, physically separated from your domain / intranet (LAN) by a firewall. Install the Master Service application on a domain member server located inside the internal network (LAN) within the same subnet or SITE container as your primary Active Directory Domain Controllers. Firewall configuration Firewall rules should be configured as follows for a Two Tier (Separate Server) Installation: Web Portal Server Traffic (Extranet or DMZ) Description In/Outbound Protocol Port External user HTTP/S connectivity from Internet Internal connectivity to / from Master Service server Inbound TCP 443 (or other port specified in your IIS configuration as needed) Outbound TCP 5000 or alternate port configured in the Master Service Configuration (Network and Service Settings tab) Master Service Server Traffic (Intranet or LAN) Description In/Outbound Protocol Port Internal connectivity to / from Web Portal Inbound TCP 5000 (default) or other port configured in the Master Service Configuration > Internal connectivity to Active Directory Domain Controller Network and Service Settings tab Outbound TCP Full LAN / domain connectivity

22 Special Note: First Time Installing IIS on Server 2003 / 2008? You need to enable ASP.NET (.aspx pages) in IIS Enable ASP.NET as an allowed protocol in 2003 / IIS6 If you have not already configured your IIS6 server to run ASP.NET applications, perform the following step to enable ASP.NET in IIS. NOTE! When you first install IIS6/7, ASP.NET and.aspx (dynamic pages) are not enabled in Server 2003 or 2008 by default. 1. Server 2003: Install ASP.NET by opening a Command Prompt and running the following command: C:\Windows\Microsoft.NET\Framework\v >aspnet_regiis.exe i 2. Server 2003: Enable ASP.NET Web Service Extension by opening IIS Manager > Web Service Extensions. Select ASP.NET v and click Allow. 3. Server 2003: Open the Password Reset PRO Web Portal properties > ASP.NET tab and select 2.0 as the.net version. You should now be able to view the web portal. Change Add ASP.NET Protocol in Server 2008 IIS7 using Role Services In order to allow.aspx pages to be served in 2008 with IIS7, you must install ASP.NET & included dependencies through Server Manager > Roles > Web Server > Add Role Services. You will find ASP.NET under the Application Development component selection list. This will create the appropriate handler mappings at the global IIS level to serve your.aspx pages and other asp.net content. When you first install IIS7 these components are not selected as part of the default install. If you have not installed IIS7 yet, at installation time select ASP.NET and all prompted dependencies under Application Development optional components. If you do not perform this step, your server will not be able to display.aspx pages

23 Troubleshooting & Reference Links for IIS and SSL Configuration The below resource links are provided for your convenience. Please be advised these links are outside of the control of SysOp Tools, Inc. SysOp Tools takes no responsibility for the accuracy, completeness, availability or content of information obtained through the below resource links. SysOp Tools Online KB: If you find yourself stuck on the installation / setup of Password Reset PRO, please check our online KB located at Our KB is updated regularly and is a great source of common troubleshooting info. Contact our Support Team through the Contact Us page on our website located at: We ll do our best to help! Configuring & Enabling SSL in IIS6 / IIS7: Quick steps for IIS6: 1. Add a valid Certificate Authority SSL server certificate to the Password Reset PRO web site root folder (Internet Information Services > Password Reset PRO Web Site > Properties > Directory Security > Server Certificate ) 2. Define port 443 for the SSL protocol under the Password Reset PRO Website properties 3. Set security settings on the website properties for anonymous > IIS user account (IUSR_machine typically). 4. Disable Integrated Windows authentication and make sure Anonymous access is enabled for the web app (Internet Information Services > Password Reset PRO Website > Properties > Directory Security > Anonymous access and authentication control > Edit ) 5. Require SSL for your website (Internet Information Services > Password Reset PRO Website > Properties > Directory Security > Server Certificate > check the Require Secure Channel box.) 6. Restart the website and test accessing the website over Further information links: Set up SSL Protocol in Server 2003 IIS6 Set up SSL Protocol in Server 2008 IIS7 (Video Tutorial) *Tip- Enforce the Require SSL setting in IIS to ensure secure connection to the web portal

24 Installing SSL Certificates: Install Certificate Authority SSL Cert in Server 2003 IIS6 Install Certificate Authority SSL Cert in Server 2008 IIS7 Enabling or Re-Registering ASP.NET in IIS: How to Enable ASP.NET Protocol (view.aspx pages) in Server 2003 IIS6. Are your.aspx pages not displaying? Make sure you have enabled the asp.net protocol. Re-Registering ASP.NET in IIS6 or IIS7 Sometimes you may need to re-register ASP.NET 2.0 with IIS6 or IIS7 in order to see the available 2.0.NET version selection for the website, and to see the ASP.NET protocol in the IIS manager list of allowed protocols (under the Web Service Extensions folder). Register or Re-register ASP.NET 2.0 in Server 2003 IIS6 or Server 2008 IIS7 Open a command prompt and run "C:\Windows\Microsoft.NET\Framework\v \aspnet_regiis.exe -i -enable". Open IIS manager, and.net 2.0 should now be a selectable option for the web application. Make sure to enable ASP.NET as an allowed protocol. Test opening an.aspx page. << End of Installation Guide >>