Quest Soft Token for Windows Desktop User Guide This guide provides information on installing, activating and using the Quest Soft Token for Windows Desktop. What is the Quest Soft Token for Windows Desktop The Quest Soft Token for Windows Desktop is a two-factor authentication token that can be used with Quest Defender, to gain secure access to network, web, and applications-based resources. The Token can be programmed as a synchronous OATH compliant token or using Defender SNK, AES or 3DES encryption in both synchronous and asynchronous (challenge / response) modes. The picture above shows an example of the Quest Soft Token for Windows Desktop. The token response 510959 is used as the One Time Password (OTP) when prompted to authenticate. The Quest Soft Token for Windows Desktop is also referred to as the Defender Desktop Token.
Installing the Quest Soft Token for Windows Desktop software Your system administrator will provide you with the Quest Soft Token for Windows Desktop software. This file may be made available to you through a network share, a CD or optionally through the Defender Token Deployment System. To install the Quest Soft Token for Windows Desktop software using the installation file, perform the following steps: 1. Locate and run the Defender Desktop Token Installer.exe file. The Defender Desktop Token Installation Wizard starts: 2. Select Next. The Defender Desktop Token Installation Wizard (License Agreement) page is displayed. Check the box to accept the License agreement, then select Next. The Defender Desktop Token Installation Wizard (Install Location) page is displayed: 3. Select Finish to accept the default location. Alternatively, selcct Browse to choose a different location, then select Finish. The Installation Progress dialog box is displayed: 2
4. The Installation Complete dialog box is then displayed: 5. Select Finish. On completion of the installation a Defender Desktop Token program group is created. 3
Activating the Quest Soft Token for Windows Desktop In order to use Quest Soft Token for Windows Desktop for token authentication an activation code is required. This may be provided by your Defender administrator or, if available, through the Defender Token Deployment System. This section details the steps required for both types of activation. Using an Activation code provided by your administrator 1. From the Start menu, select Programs, Defender Desktop Token. The Token Activation Wizard (Welcome) dialog box is displayed: 2. Select Next. The Enter Activation Code dialog box is displayed: When the Defender Administrator generates a Defender Desktop Token for a user, a username.txt file is automatically created. This file can optionally contain the token details for a single user or token details for multiple users. For further information, refer to the Quest Soft Token for Windows Desktop Administration Guide. 3. Select Browse to select the required username.txt file. The activation key is automatically copied from the username.txt file and pasted into the Code field. Alternatively, you can copy the activation code and paste it into the Code field. 4
4. Select Next. The Token Activation Wizard - Select Storage Location dialog box is displayed: 5. To store the activated Quest Soft Token for Windows Desktop: in your application data folder, select the Your application data folder button in a different folder, select the Another Folder radio button, then select Browse to navigate to the required location on an attached device, such as an Aladdin USB token, select the Attached Device button, then select the required device from the list. 6. If you have more than one active Quest Soft Token for Windows Desktop and want this token to be selected for authentication by default, check the Make this token the default token checkbox. If you have more than one active Quest Soft Token for Windows Desktop and do not want to authenticate using the default token, you can specify an alternative token during logon. 7. Select Next. The Token Activation Wizard - Select Passphrase dialog box is displayed: Figure 8: Token Activation Wizard (Select Passphrase) dialog box 5
8. In the New Passphrase field, type the passphrase that you will enter to unlock the Desktop Token before authentication. 9. In the Confirm Passphrase field, type the passphrase again to confirm your choice. As you type your passphrase, the strength box indicates the strength of the passphrase by showing a red (weak) or green (strong) indicator. Quest recommends the use of a strong passphrase. A strong passphrase should contain a combination of uppercase and lowercase letters, numbers and punctuation marks, and be at least eight characters long. If you choose a weak passphrase, the following message is displayed: To use the passphrase you entered in the Token Activation Wizard - Select Passphrase dialog box, click Yes. To return to the Token Activation Wizard - Select Passphrase dialog box and enter a different passphrase, click No. Your Administrator can enforce the use of a strong password. 10. The Token Activation Wizard (Enter Token Name) dialog box is displayed: 11. In the Token Name field, type a name that will help you identify this token. If you choose not to give the token a name, the token serial number will be used as the token name. 12. Select Next. The Token Activation Wizard (Defender Desktop Token 6
Activation Complete) dialog box is displayed: On completion of the activation procedure, the token can be managed from the Start menu, Defender Desktop Token program group, shown below: If you specified a default token during the activation procedure, the Enter Passphrase dialog for the default token will be displayed when you select the Defender Desktop Token program group from the Start menu. To display the token management options, or select an alternative token for authentication, click Tokens. For authentication information, refer to Authenticating with a Defender Desktop Token. 7
Using the Defender Token Deployment System The Defender Token Deployment System is a web based application that allows for the Quest Soft Token for Windows Desktop to be requested directly through a local web site. The activation code can be received by e-mail or a self-activating version of the token software can be downloaded. The Token Deployment System is an optional Defender component. For full instructions on using the Defender Token Deployment System please refer to the Defender Token Deployment System User Guide. These instructions refer to the token activation process only. 1. After choosing the Windows Desktop token from the Token Deployment System website and completing the verification process the Install and Activate Token web page is displayed. 2. This page provides the following a link to download the token software from http://www.quest.com/defender/windowsdesktoptoken.aspx. the activation code, which can be copied and pasted to the Quest Soft Token for Windows Desktop activation dialog. A link to download a self-activating installer. An option to send these details to your e-mail address. 8
Download Token Software The Quest Soft Token for Windows Desktop software can be downloaded from http://www.quest.com/defender/windowsdesktoptoken.aspx. Using this link will download the Defender Desktop Token Installer.exe installer. ACTIVATION CODE The activation code for your token can be copied and pasted in to the Quest Soft Token for Windows Desktop activation dialog as below. Please see the Using an Activation code provided by your administrator for complete details on this process. SELF-ACTIVATING INSTALLER This option will download a self-activating installer to your local workstation. The exact procedure and messages displayed to download the file will depend on your browser version. Using the self-activating installer link will automatically launch the token activation wizard for you so it will be ready to use once the installation process is complete. E-MAIL OPTION A link is provided to send the web page information to an e-mail address. By default this will be the e-mail address configured on your AD user account. Optionally your system administrator may allow the e-mail address to be changed so that the information can be sent to a different e-mail address. Select Send E-Mail to send the details, a confirmation will be displayed on the webpage that the e- mail has been sent. 9
Token Management Options The following token management options are available from the Defender Desktop Tokens console. MENU OPTION DESCRIPTION click to display a list of folders that will be searched to locate Defender Desktop Tokens. Edit Folders To remove a folder from the list, click the required folder, then click Remove. To add a new folder to the list, click Add then type the location of the folder to be included in the token search. Select and Close select the token and enter the passphrase when prompted. Close Select to close the dialog 10
Token Activate New Token Default Rename select Activate New Token to start the Desktop Token Activation Wizard. For further information, refer to Activating your Defender Desktop Token. select the required Defender Desktop Token then select Default to set the token as your default token. select the required Defender Desktop Token then select Rename to change the name of the token. select the required Defender Desktop Token, then select Delete to remove the token. Delete Note: If you use this option to delete a Defender Desktop Token, you must also ensure that the corresponding Defender Desktop Token definition is deleted in Active Directory. Contact your Defender administrator for assistance. select the required Defender Desktop Token, then select Move to move the token to a different location. Move Change passphrase Reset passphrase Properties Note: If you use this option to move a token to a different folder, the folder is automatically included in the list of folders for searching. select the required Defender Desktop Token, then select Change passphrase to change the current passphrase. select the required Defender Desktop Token, then select Reset passphrase to reset a locked passphrase. select the required Defender Desktop Token then select Properties to display the token information page. View Icons Details select to display tokens as icons. select to display tokens as details. Options Prompt for username to unlock token Centre Window at Startup select the required Defender Desktop Token, then select Options, Prompt for username to unlock token to display the username at the passphrase prompt. The passphrase is also required. select this option to ensure that the login dialog is always positioned centrally on the user s display. Help About Defender Desktop Token click Help, About to display version information for the Defender Desktop Token program. 11
Changing the Passphrase To change the passphrase for a Defender Desktop Token: 1. From the Start menu, select Programs, Defender Desktop Token, Defender Desktop Token. The Enter Passphrase page is displayed. 2. Select Tokens to display the console and ensure that the required token is selected. 3. On the menu bar, select Token, Change Passphrase. The Change Passphrase Wizard starts. 4. Select Next. You are prompted to enter your current passphrase for this token. Enter the passphrase. 5. Select Next. Enter your new passphrase for this token. 6. Confirm the new passphrase. 7. Select Next. The Change Passphrase Wizard confirms that the passphrase was changed successfully. If you forget your Passphrase If you forget your passphrase or your token is locked because you have exceeded the permitted number of incorrect passphrase attempts, the following message is displayed: Your passphrase is locked. You must reset your passphrase. To begin the unlock procedure, which requires a dialog with the Defender Administrator: 1. Select Start, Programs, Defender Desktop Token, Defender Desktop Token. 12
2. Select Tokens. The Defender Desktop Tokens dialog is displayed: Right-click the token that you want to reset, then select Reset Passphrase from the list or use the Reset Passphrase option from the Token menu. The Defender Desktop Token Wizard starts: 4. Select Next. 13
5. Tell your Administrator the number displayed in the Challenge field. Your Administrator will then reply with an unlock code. 6. Enter the unlock code into the Unlock Code field. 7. In the New Passphrase field, type your new passphrase. In the Confirm Passphrase field, type your new passphrase again to confirm. 9. Click Next. The Defender Desktop Token Passphrase Reset Complete dialog is displayed: 14
Authenticating with a Quest Soft Token for Windows Desktop This section describes how to authenticate to a Defender protected network using the Quest Soft Token for Windows Desktop (Defender Desktop Token). Synchronous Mode If you are authenticating to a network that uses a response only method: 1. Connect to your network using your usual communications software. When the connection is made, a Defender Security Server intercepts the call. 2. When prompted by the Defender Security Server, enter your user ID in your communications software. From the Start menu, select Programs, Defender Desktop Token, Defender Desktop Token. If you have more than one Defender Desktop Token installed and have specified one token as your default token, the Enter Passphrase dialog box is displayed: 3. In the Passphrase field, type your passphrase. 4. Select OK. The Defender Desktop Token Response dialog box is displayed: 5. Select Get Response. The token response is displayed in the Response field. To automatically copy the token response to the clipboard and leave the Defender Desktop Token Response window open, check the Automatically copy response to the clipboard checkbox. To automatically close the Defender Desktop Token Response window after the response has been copied to the clipboard, check the Automatically close this window checkbox. If you chose not to automatically copy the token response to the clipboard, select Copy to copy the response to the clipboard. Select Cancel to close the Defender Desktop Token Response window. 15
6. Paste the Defender Desktop Token response into your communications software. Place the cursor in the communication software window and press Control-V to paste the response into the communication software window. 7. Press Enter on your computer keyboard. 8. Defender verifies the response. If the response the Defender Security Server receives matches the one it expects, you are connected and granted access to the protected network. Asynchronous Mode If you are authenticating to a network that uses a challenge/response method: 1. Connect to your network using your usual communications software. When the connection is made, a Defender Security Server intercepts the call. 2. When prompted by the Defender Security Server, enter your user ID in your communications software.the Defender Security Server displays a challenge value in your communications software. 3. From the Start menu, select Programs, Defender Desktop Token, Defender Desktop Token. If you: have more than one Defender Desktop Token assigned to you, the Defender Desktop Tokens dialog box is displayed. Select the required token. Go to Step 4. specified a default token during the activation procedure, the Enter Passphrase dialog for the default token will be displayed when you select the Defender Desktop Token program group from the Start menu. To display the token management options, or select an alternative token for authentication, click Tokens. Select the required token. Go to Step 4. 4. The Enter Passphrase dialog box is displayed: 5. In the Passphrase field, type your passphrase. Click OK. The Defender Desktop Token Response page is displayed: 16
7. In the Challenge field, type the challenge displayed by the Defender Security Server. 8. To automatically copy the token response to the clipboard and close the Defender Desktop Token Response window, check the box, then select Get Response. If you chose not to automatically copy the token response to the clipboard, select Get Response, then use the copy function to copy the response to the clipboard. Select Cancel to close the Defender Desktop Token Response window. 9. Place the cursor in the communication software window and press Control-V to paste the response into the window. 10. Press Enter on your computer keyboard. 11. Defender verifies the response. If the response the Defender Security Server receives matches the one it expects, you are connected and granted access to the protected network. 2012 Quest Software, Inc. ALL RIGHTS RESERVED. Quest, Quest Software, the Quest Software logo are trademarks and registered trademarks of Quest Software, Inc. in the United States of America and other countries. Other trademarks and registered trademarks are property of their respective owners. 17