Technical white paper HP Security Level: Public HP LaserJet Enterprise (FutureSmart) Administrator configurable Service Access Code (PIN) This document details a new feature which allows an Administrator to configure the device Service Access Code (PIN) with a numeric PIN of his or her choice. Table of Contents Administrator Configurable Service Access Code (PIN) 2 What is it? 2 How does it work 3 Increased Flexibility and Security 3 Important Service Access Limitations to be aware of 3 Methods to change the Service Access Code (PIN) 3 Embedded Web Server (EWS) 4 Device Preboot Menu 5 Web Jet Admin 7 1
Administrator Configurable Service Access Code (PIN) What is it? With the introduction of FutureSmart Bundle Version 3.2.3 the device Administrator will now have the ability to change the factory Service Access Code (PIN) to an 8 digit numerical value of their choice. Letters or special characters will not be allowed. This new feature allows greater flexibility and enhanced security. An important part of the enhanced security is that service users will no longer have access to applications they previously had access to if the feature requires authentication: (Figure #1) This change in Service access is true whether the Factory Service Access Code (PIN) or the Administrator Configurable Service Access Code (PIN) is used. (Upgrading to Bundle Version 3.2.3 implements this change) Applications that will be locked if Service authentication is used for the features are: Fax Copy Send to Email Send to Folder Save to SharePoint Send to Device Memory Retrieve from Device Memory Figure #1 2
How does it work Today each HP Enterprise LaserJet Printer comes from the factory with a factory programmed Service Access Code (PIN). Each model has its own Service PIN (Password (e.g. CM4540 models have one unique Service Access Code (PIN) and M525 models have one unique Service Access Code (PIN) etc. etc..) With the new feature a unique 8 digit password can now be set replacing the Service Access Code (PIN) and increase flexibility and security. All devices will always ship from the factory with the factory set Service Access Code (PIN). Increased Flexibility and Security With the introduction of this feature the Admin can now change the factory programed Service Access Code (PIN) of all HP Enterprise LaserJet FutureSmart devices to a unique 8 digit numerical value. This can be extremely useful if a Service Team is managing a fleet of several device models. The admin can set the Service Access Code (PIN) on all models in the fleet to one unique value which keeps the service engineer from having to remember the passwords for several devices. In addition setting a unique Service Access Code (PIN) makes the device more secure because Service Access Code (PIN) are listed in HP Service Manuals. Important Service Access Limitations to be aware of Service technicians that use features within the service menu to diagnose and resolve problems will not be able to access the service menu using the factory Service Access Code (PIN) if the Administrator changes the Service Access Code (PIN). The Administrator will need to provide the customized Service Access Code (PIN) to the service technician before they service can service the device. NOTE: There are critical diagnostic tools, settings and information used to service the device found the Service menus. Denying access to these menus can limit the serviceability of the device. Methods to change the Service Access Code (PIN) There are three methods that can be used to change the Service Access Code (PIN). They consist of: Embedded Web Server (EWS) Preboot menu The fleet management tool Web JetAdmin (WJA) Before changing the Service Access Code (PIN), the device will have to be updated with a version of firmware that supports the new functionality. (FutureSmart Bundle Version 3.2.3 or greater). If the device is downgraded to an older version of firmware the Service Access Code (PIN) will default back to the factory default. 3
Embedded Web Server (EWS) 1. Open the devices Embedded Web Server (EWS) by typing the devices IP address in the web browsers URL window. 2. Navigate to the Security tab. If an Administrator EWS password has not been set access the Security tab and apply the Local Administrator Password 3. Once the Local Administrators Password has been set navigate to the Set Service Access code (See Figure 2) and type in the 8 character password of choice. Remember the password can only contain eight numerical values. Figure 2- Embedded Web Server Set the Service Access Code option 4. Once the value has been input scroll to the bottom of the EWS screen and click on the button. 5. The Service Access Code should now be updated and a confirmation screen should be presented (See Figure 3) 4
Figure 3- Embedded Web Server Confirmation for Setting the Service Access Code option Device Preboot Menu 1) Access the Preboot menu using the following procedure for your device Older Touch Screen and older single function devices: Press the Stop button when the Ready, Data and Attention LEDs illuminate solid. Newer Tablet style Touch Screens: Press the HP logo in the middle of the screen when you see the 1/8 under the logo. 2) Once in the Preboot menu scroll to the Administrator selection. Depending on the model use the 3 or 6 key or the UP and Down arrows to scroll. 5
3) Next, scroll down to the Change Svc PWD selection. 4) Once highlighted, select it with the OK or 6 key depending on the device model. 5) Input the number values for the PIN. Depending on the model use the 3 or 6 key or the UP and Down arrows to scroll through the numbers. Use the OK or 6 key to choose each number. a. Then re-enter the same numbers to reconfirm the password 6) If identical numbers are entered password will be accepted. To Reset the Password Follow the same steps above but select the Reset Svc PWD 6
Web Jet Admin 1. Support for WJA will be provided in the spring 2015 release. hp.com/go/support Current HP driver, support, and security alerts delivered directly For more to your information desktop Please contact your HP representative or go to: hp.com/support Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Trademark acknowledgments, if needed. Created February 2014 7