HP Compaq tc4400, Reference Manual

Page 1: ...Reference Guide ProtectTools Security Manager Document Part Number 389171 003 February 2006 ...

Page 2: ...ountries The information contained herein is subject to change without notice The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services Nothing herein should be construed as constituting an additional warranty HP shall not be liable for technical or editorial errors or omissions contained herein Reference Guide Protect...

Page 3: ...Initializing the smart card 2 2 Smart card BIOS security mode 2 3 Enabling smart card BIOS security mode and setting the smart card administrator password 2 4 Changing the smart card administrator password 2 6 Setting and changing the smart card user password 2 7 Storing the administrator or user card password 2 8 General tasks 2 10 Updating BIOS smart card settings 2 10 Selecting the smart card r...

Page 4: ...Security for ProtectTools Basic concepts 4 1 Setup procedures 4 2 Enabling the embedded security chip 4 2 Initializing the embedded security chip 4 3 Setting up the basic user account 4 4 General tasks 4 6 Using the Personal Secure Drive 4 6 Encrypting files and folders 4 6 Sending and receiving encrypted e mail 4 7 Changing the Basic User Key password 4 7 Advanced tasks 4 8 Backing up and restori...

Page 5: ...ures 6 2 Logging on to Credential Manger 6 2 Registering credentials 6 5 General tasks 6 9 Creating a virtual token 6 9 Changing the Windows logon password 6 10 Changing a token PIN 6 10 Managing identity 6 11 Locking the computer 6 13 Using Microsoft Network logon 6 14 Using Single Sign On 6 17 Advanced tasks administrator only 6 22 Specifying how users and administrators log on 6 22 Configuring ...

Page 6: ...tial Manager for ProtectTools The software modules available for your computer may vary depending on your model For example Embedded Security for ProtectTools requires that the Trusted Platform Module TPM embedded security chip select models only be installed on your computer and Smart Card Security for ProtectTools requires an optional smart card and reader ProtectTools software modules may be pr...

Page 7: ...ol Panel Select Start All Programs HP ProtectTools Security Manager After you have configured the Credential Manager module you can also open ProtectTools by logging on to Credential Manager directly from the Windows logon screen For more information refer to Logging on to Windows with Credential Manager in Chapter 6 Credential Manager for ProtectTools ...

Page 8: ...etermines the security features to deploy such as smart cards biometric readers or USB tokens Many of the features in ProtectTools can be customized by the security officer in cooperation with HP For more information visit http www hp com IT administrator Applies and manages the security features defined by the security officer Can also enable and disable some features For example if the security ...

Page 9: ...rators only are indicated in this table as well All other passwords may be set by regular users or administrators ProtectTools Password Set in this ProtectTools Module Function Computer Setup setup password Also known as BIOS administrator f10 Setup or Security Setup password BIOS Configuration by IT administrator Protects access to the Computer Setup utility Power on password BIOS Configuration P...

Page 10: ...n as BIOS user card password Smart Card Security Used for smart card power on BIOS authentication Allows access to the computer contents when the computer is turned on restarted or restored from hibernation Smart card PIN Smart Card Security Protects access to the smart card contents and authenticates users of the smart card When used for power on authentication the smart card PIN also protects ac...

Page 11: ...le and folder encryption When used for power on authentication also protects access to the computer contents when the computer is turned on restarted or restored from hibernation Emergency Recovery Token password Also known as Emergency Recovery Token Key password Embedded Security by IT administrator Protects access to the Emergency Recovery Token which is a backup file for the embedded security ...

Page 12: ...s It can be used in place of the Windows logon process allowing access to Windows and Credential Manager simultaneously Credential Manager recovery file password Credential Manager by IT administrator Protects access to the Credential Manager recovery file Windows logon password Windows Control Panel Can be used in manual logon or saved on the smart card ProtectTools Password Set in this ProtectTo...

Page 13: ...numbers for letters in a key word For example you can use the number 1 for letters I or L Combine words from 2 or more languages Split a word or phrase with numbers or special characters in the middle for example Mary2 2Cat45 Do not use a password that would appear in a dictionary Do not use your name for the password or any other personal information such as birth date pet names or mother s maide...

Page 14: ... can be used with other ProtectTools modules such as Credential Manager for ProtectTools Work with the Computer Setup utility to enable smart card authentication in a power on environment and to configure separate smart cards for an administrator and a user This requires a user to insert the smart card and optionally enter a PIN prior to allowing the operating system to load Set and change the pas...

Page 15: ...ze 5 Type your name in the first box in the Initialize the smart card dialog box 6 Set and confirm the smart card PIN in the appropriate boxes The PIN code must be between 4 and 8 numeric characters ÄTo avoid losing access to the computer do not forget the smart card PIN If you forget your smart card PIN it may be impossible to operate the computer The smart card will be locked and made unusable u...

Page 16: ...ailable until you enable smart card power on authentication support 2 Enable smart card BIOS security mode in Smart Card Security Refer to Enabling smart card BIOS security mode and setting the smart card administrator password later in this chapter 3 Set the smart card administrator password The smart card administrator password is set as part of the process of enabling smart card BIOS security m...

Page 17: ...ght pane under BIOS Security Mode click Enable 4 Click Next 5 Enter the Computer Setup setup password at the prompt and click Next 6 Insert the new administrator smart card and follow the on screen instructions The instructions vary and may include the following tasks Initializing the smart card Refer to Initializing the smart card for detailed instructions Setting the smart card administrator pas...

Page 18: ...ard BIOS security mode has previously been enabled the button on the Smart Card Security BIOS page changes to Disable To disable smart card security 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Smart Card Security and then select BIOS 3 In the right pane under BIOS Security Mode click Disable 4 Insert the card containing the current smart card administrato...

Page 19: ...ormation about the smart card administrator password The following procedure updates the smart card administrator password stored on the card and in Computer Setup To change the smart card administrator password 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Smart Card Security and then select BIOS 3 In the right pane under BIOS Security Mode next to BIOS ad...

Page 20: ...er Setup click the Change button 4 Enter the smart card PIN and click Next 5 Insert the new user card and click Next If there is already a user password on the card the Finish dialog box is displayed Omit steps 6 through 8 and go to step 9 If there is no user password on the card the BIOS Password Wizard opens 6 In the BIOS Password Wizard you can either Enter a password manually Generate a random...

Page 21: ...ery file later in this chapter 9 Enter the smart card PIN in the Finish dialog box and then click Finish Storing the administrator or user card password If you want to create a backup card and have already set the administrator password you can store the password on the new card ÄCAUTION This procedure updates only the password on the card and not in Computer Setup You will not be able to access t...

Page 22: ...to make backup cards 6 Under Access Privilege click either Administrator or User for the type of card 7 Under Boot Requirements select the check box if you require that the smart card PIN be entered at startup If you do not require the smart card PIN to be entered at startup clear this check box 8 Enter the smart card PIN and click OK 9 Enter the smart card PIN again in the Finish dialog box and t...

Page 23: ...nt clear the check box 5 Enter the smart card PIN and click OK Selecting the smart card reader Ensure that the correct smart card reader is selected in Smart Card Security before using the smart card If the correct reader is not selected in Smart Card Security some of the features may be unavailable or incorrectly displayed To select the smart card reader 1 Select Start All Programs HP ProtectTool...

Page 24: ...tialized a smart card and the card is ready for use it is highly recommended that you create a smart card recovery file The recovery file can be used to transfer the smart card data from one smart card to another smart card This file can also be used to back up the original smart card or to restore the data when a smart card is lost or stolen ÄCAUTION To avoid having a recovery file that does not ...

Page 25: ...le path and file name in the Filename box ÄTo avoid loss of access to the computer do not save the recovery file on the computer hard drive you will not be able to access the file without the smart card Also a recovery file saved on the hard drive may be accessible to others posing a security risk 6 Set and confirm a recovery file password and then click OK ÄCAUTION To prevent the loss of the smar...

Page 26: ...restore a smart card 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Smart Card Security and then select Smart Card 3 Insert the diskette or other media containing the smart card recovery file 4 Insert a smart card into the reader If the card is not initialized you will be prompted to initialize it For detailed instructions on initializing the smart card refe...

Page 27: ...enerated smart card password Insert a smart card into the reader and then load the appropriate recovery file onto it For more information refer to Restoring smart card data earlier in this chapter To create a replacement smart card with a manually generated smart card password 1 Initialize a new smart card For instructions refer to Initializing the smart card earlier in this chapter 2 Store the ad...

Page 28: ...ou can Access Java Card security features Work with the Computer Setup utility to enable Java Card authentication in a power on environment and to configure separate Java Cards for an administrator and a user This requires a user to insert the Java Card and enter a PIN to allow the operating system to load Set and change the PIN used to authenticate users of the Java Card Back up and restore power...

Page 29: ...r Changing a Java Card PIN To change a Java Card PIN The Java Card PIN must be between 4 and 8 numeric characters 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Java Card Security and then select General 3 Insert a Java Card with an existing PIN into the smart card reader 4 In the right pane click Change 5 In the Change PIN dialog box enter the current PIN i...

Page 30: ...correct reader is not selected in Java Card Security some of the features may be unavailable or incorrectly displayed To select the smart card reader 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Java Card Security and then select General 3 Insert the Java Card into the smart card reader 4 In the right pane under Smart Card Reader select the correct reader ...

Page 31: ...vanced page Assigning a Java Card PIN You must assign a PIN to a Java Card before it can be used for power on authentication To assign a Java Card PIN The Java Card PIN must be between 4 and 8 numeric characters 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Java Card Security and then select General 3 Insert a new Java Card into the smart card reader 4 When...

Page 32: ...t pane select Java Card Security and then select Advanced 3 When the Setup Password dialog box displays enter your Computer Setup setup password and then click OK 4 Insert the Java Card into the smart card reader If you have not assigned a PIN to this card the Change PIN dialog box opens allowing you to enter a new PIN 5 In the right pane under Java Card name click Change 6 Enter a name for the Ja...

Page 33: ... steps 1 Enable Java Card power on authentication support in BIOS Configuration or Computer Setup Refer to Enabling and disabling Smart card or Java Card power on authentication support in Chapter 5 BIOS Configuration for ProtectTools 2 Enable Java Card power on authentication in Java Card Security Refer to Enabling Java Card power on authentication and creating an administrator Java Card later in...

Page 34: ...rt card reader If you have not assigned a PIN to this card the Change PIN dialog box opens allowing you to enter a new PIN 5 In the right pane under Power on authentication click the Enable check box 6 If you do not have DriveLock enabled enter the Java Card PIN and then click OK or If you do have DriveLock enabled a Select Make Java card identity unique or Select Make the Java card identity the s...

Page 35: ...ing a user Java Card Power on authentication and an administrator card must be set up in order to create a user Java Card To create a user Java Card 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Java Card Security and then select Advanced 3 When the Setup Password dialog box displays enter your Computer Setup setup password and then click OK 4 Insert a Java...

Page 36: ...ter To disable Java Card power on authentication 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Java Card Security and then select Advanced 3 When the Setup Password dialog box displays enter your Computer Setup setup password and then click OK 4 Insert the Java Card enter the PIN and then click OK 5 In the right pane under Power on authentication clear the ...

Page 37: ...olen ÄCAUTION To avoid having a recovery file that does not match a Java Card containing updated information immediately create a new recovery file on removable media and put it in a safe place If you keep a backup Java Card you must also update the information on the backup Java Card by restoring the new recovery file onto the backup Java Card Creating a recovery file To create a recovery file 1 ...

Page 38: ...rget the recovery file password You cannot re create your card from the recovery file if you forget the password Restoring Java Card data You can restore the Java Card data from the recovery file This is especially useful if a card was lost or stolen or if you want to create a backup Java Card If you use a card with previous data saved on it the data will be overwritten Before you begin you will n...

Page 39: ...hapter 6 In the right pane under Recovery click Restore 7 Ensure that the correct recovery file name is selected and enter the recovery file password 8 Enter the Java Card PIN 9 Click OK The original Java Card contents are restored to the new Java Card Creating a backup Java Card It is highly recommended that you create duplicate Java Cards for backup purposes To create a replacement Java Card Ins...

Page 40: ...ccess to user data or credentials This software module provides the following security features Enhanced Microsoft Encryption File System EFS file and folder encryption Creation of a personal secure drive PSD for protecting user data Data management functions such as backing up and restoring the key hierarchy Support for third party applications such as Microsoft Outlook and Internet Explorer for ...

Page 41: ...the computer and gaining control over the owner tasks such as handling the emergency recovery archive and configuring user access settings Follow the steps in the following 2 sections to enable and initialize the embedded security chip Enabling the embedded security chip The embedded security chip must be enabled in the Computer Setup utility This procedure cannot be performed in BIOS Configuratio...

Page 42: ...s to all owner functions on the embedded security chip Set up the emergency recovery archive which is a protected storage area that allows reencryption of the Basic User Keys for all users To initialize the embedded security chip 1 Right click the ProtectTools Security Manager icon in the notification area at the far right of the taskbar and then select Embedded Security Initialization The Protect...

Page 43: ... click Finish The Embedded Security User Initialization Wizard opens Refer to the instructions in the next section for more details Setting up the basic user account Setting up a basic user account in Embedded Security Produces a Basic User Key that protects encrypted data and sets a Basic User Key password to protect the Basic User Key Sets up a personal secure drive PSD for storing encrypted fil...

Page 44: ... first configure the e mail client to use a digital certificate that is created with Embedded Security If a digital certificate is not available you must obtain one from a certification authority For instructions on configuring your e mail and obtaining a digital certificate refer to the e mail client online Help 9 If more than one encryption certificate exists select the appropriate certificate a...

Page 45: ...pting files and folders When working with encrypted files in Windows XP Professional consider the following rules Only files and folders on NTFS partitions can be encrypted Files and folders on FAT partitions cannot be encrypted System files and compressed files cannot be encrypted and encrypted files cannot be compressed Temporary folders should be encrypted because they are potentially of intere...

Page 46: ...send and receive encrypted e mail but the procedures vary depending upon the program you use to access your e mail For more information refer to the Embedded Security online Help and the online Help for your e mail Changing the Basic User Key password To change the Basic User Key password 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Embedded Security and t...

Page 47: ...d in case of emergency Creating a backup file To create a backup file 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Embedded Security and then select Backup 3 In the right pane click Backup 4 Click Browse to choose the location where the backup file will be saved 5 Select whether to add the emergency recovery archive to the backup data 6 Click Next 7 Click ...

Page 48: ...n the right pane click Restore 4 Click Browse to select the backup file from the stored location 5 Click Next 6 Select whether to start the Embedded Security User Initialization Wizard If you choose to start the initialization wizard click Finish and then follow the on screen instructions to complete the initialization For more information refer to Setting up the basic user account earlier in this...

Page 49: ...strator can help a user to reset a forgotten password For more information refer to the online Help Enabling and disabling Embedded Security It is possible to disable the Embedded Security features if you want to work without the security function The Embedded Security features can be enabled or disabled at 2 different levels Temporary disabling With this option embedded security is automatically ...

Page 50: ...Enabling Embedded Security after permanent disable To enable Embedded Security after permanently disabling it 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Embedded Security and then select Advanced 3 In the right pane under Embedded Security click Enable 4 Enter your owner password at the prompt and then click OK Migrating keys with the Migration Wizard Mi...

Page 51: ...With BIOS Configuration you can Manage power on passwords and setup passwords Configure other power on authentication features such as enabling smart card passwords and embedded security authentication support Enable and disable hardware features such as CD ROM boot or different hardware ports Configure boot options which includes enabling MultiBoot and changing the boot order Many of the features...

Page 52: ...up setup password at the BIOS administrator password prompt and click OK The BIOS administrator password prompt is displayed only if you have already set the Computer Setup setup password For more information about setting the Computer Setup setup password refer to Setting the setup password later in this chapter 4 In the left pane select System Configuration 5 In the right pane select the delays ...

Page 53: ...e select BIOS Configuration 3 Enter your Computer Setup setup password at the BIOS administrator password prompt and then click OK 4 In the left pane select System Configuration and then enable or disable a system configuration option or configure a system configuration option in the right pane Port Options Serial Port Infrared Port Parallel Port SD Slot USB Port 1394 Port Cardbus Slot ExpressCard...

Page 54: ...standard bidirectional EPP or ECP Data Execution Prevention SATA Native Mode Dual Core CPU Automatic Intel SpeedStep Functionality Support Fan Always on While on AC Power BIOS DMA Data Transfers Intel or AMD PSAE Execution Disable Built In Device Options Embedded WLAN Device Radio Embedded WWAN Device Radio Embedded Bluetooth Device Radio LAN WLAN Switching Wake on LAN from Off 5 Click Apply and t...

Page 55: ...hentication feature you must also configure the smart card using the Smart Card Security for ProtectTools or Java Card Security for ProtectTools module To enable smart card power on authentication support 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select BIOS Configuration 3 Enter your Computer Setup setup password at the BIOS administrator password prompt and ...

Page 56: ...ng the Embedded Security for ProtectTools module To enable power on authentication support for embedded security 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select BIOS Configuration 3 Enter your Computer Setup setup password at the BIOS administrator password prompt and then click OK 4 In the left pane select Security 5 Under Embedded Security select Enable nex...

Page 57: ... computer has a TPM security chip installed and initialized For instructions on how to enable and initialize the TPM security chip refer to Enabling the embedded security chip and Initializing the embedded security chip in Chapter 4 Embedded Security for ProtectTools No DriveLock passwords have already been enabled If you have already manually set DriveLock passwords on your computer you must firs...

Page 58: ...licking the Apply or OK button in the ProtectTools window Make sure you remember what password you have set because you will not be able to undo a password setting without supplying the previous password The power on password can protect your notebook from unauthorized use After you have set a power on password the Set button on the Passwords page is replaced by a Change button The Computer Setup ...

Page 59: ...n the Passwords dialog box 6 Click Apply and then click OK in the ProtectTools window to save your changes Changing the power on password To change the power on password 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select BIOS Configuration and then select Security 3 In the right pane next to Power On Password click Change 4 Type the current password in the Old P...

Page 60: ...ds dialog box 6 Click Apply and then click OK in the ProtectTools window to save your changes Changing the setup password To change the Computer Setup setup password 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select BIOS Configuration and then select Security 3 In the right pane next to Setup Password click Change 4 Type the current password in the Old Password...

Page 61: ...in a safe place away from your computer Without these passwords or PIN the computer cannot be unlocked Enabling stringent security provides enhanced protection for the power on and administrator passwords and other forms of power on authentication To enable or disable stringent security 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select BIOS Configuration and th...

Page 62: ... or smart card password when Windows restarts To enable or disable power on authentication on Windows restart 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select BIOS Configuration and then select Security 3 In the right pane under Password Options enable or disable Require password on restart 4 Click Apply and then click OK in the ProtectTools window to save you...

Page 63: ...t Windows such as using a smart card or biometric reader to log on to Windows For additional information refer to Registering credentials later in this chapter Single Sign On feature that automatically remembers credentials for Web sites applications and protected network resources Support for optional security devices such as smart cards and biometric readers Support for additional security setti...

Page 64: ...en to log in to Credential Manager you are logged in to Windows at the same time Logging on for the first time The first time you open Credential Manager log on with your regular Windows Logon password A Credential Manager account is then automatically created with your Windows logon credentials After logging on to Credential Manager you can register additional credentials such as a fingerprint or...

Page 65: ...ndows logon screen From the notification area by double clicking the ProtectTools icon From the Credential Manager page of Protect Tools Security Manager by clicking the Log On link on the upper right side of the window 2 Click Next 3 Enter your user name in the User name box and then click Next 4 Enter a password in the Password box and then Next 5 Follow the on screen instructions for logging on...

Page 66: ...the notification area The Credential Manager Logon Wizard opens 2 On the Introduce Yourself page click the More button and then click Sign Up for a New Account 3 Click Next 4 On the Registration page type the user name first and last name of the user and the account description Then click Next 5 On the Authentication Methods page select the authentication methods you want to register and clear the...

Page 67: ...eader or if you are using an optional fingerprint reader 2 steps are required for logon to Windows using a fingerprint reader Set up the fingerprint reader Use your registered fingerprint to log on to Windows Set up the fingerprint reader If you are using an optional fingerprint reader connect the reader to the computer before performing the steps below To set up the fingerprint reader 1 In Window...

Page 68: ...s 6 When the Credential Manager Registration Wizard opens slowly swipe your finger downward over the fingerprint sensor The right index finger is the default finger for enrolling the first fingerprint You can change the default by clicking the finger you want to register first on either the left hand or the right hand When you click a finger it will be outlined to show it has been selected 7 Conti...

Page 69: ...t to log on to Windows To log on to Windows using your fingerprint 1 Immediately after you have registered your fingerprints restart Windows 2 In the upper left corner of the screen click Log on to Credential Manager 3 At the Credential Manager Logon Wizard dialog box instead of clicking a user name swipe any of your registered fingers to log on to Windows 4 Enter your Windows password to associat...

Page 70: ...k the authentication method you want to register and then click Next 6 Follow the on screen instructions to complete the registration Registering other credentials To register other credentials 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right pane under I Want To click More and then click Register C...

Page 71: ... in the Windows registry When you log on with a virtual token you are asked for a user PIN to complete the authentication To create a new virtual token 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right pane under I Want To click More and then click Register Credentials 4 Click Next 5 Click Virtual To...

Page 72: ...d in the Old password box 5 Set and confirm your new password in the New password and Confirm password boxes 6 Click Finish Changing a token PIN You can change the PIN for a smart card or virtual token from the My Identity page in Credential Manager 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right p...

Page 73: ...he left pane select Credential Manager and then select My Identity 3 In the right pane under I Want To click More and then click Backup Identity 4 Click Next 5 Select the elements you want to back up and then click Next 6 On the Device Type page select the device type you want to use to store the backup and then click Next You will need to know the password or PIN code for the device you select fo...

Page 74: ... the on screen instructions for the device you selected and then click Finish 7 Click Yes at the confirmation dialog box Removing an identity from the system You can delete your identity entirely from Credential Manager This does not affect the Windows user account To remove your identity from the system 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credent...

Page 75: ...he Lock Workstation feature to require a smart card biometric reader or token to unlock the computer For more information refer to Configuring Credential Manager settings later in this chapter To lock the computer 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right pane under I Want To click More and t...

Page 76: ...ger to log on to a Windows network or local account 1 From the Windows logon screen select Log on to Credential Manager 2 Click Next on the Welcome page if it is displayed 3 Type your user name in the User name box If you want this to be the default user name select Use this name next time you log on 4 Select Credential Manager from the Log on to list 5 Click Next On the Logon Policy page select t...

Page 77: ...ount 4 Set the user name for the new account in the User name box 5 Click the domain from the list of available domains 6 Type and confirm the password If you want this to be your default user account select Use these credentials by default 7 Click Finish Removing accounts You can remove local or domain accounts after logging on to Credential Manager To remove an account 1 Select Start All Program...

Page 78: ...r To set a default user 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right pane under Microsoft Network Logon click Manage Network Accounts 4 Click the account you want to be the default and then click Properties 5 On the Set Up Account tab of the Account Properties dialog box select the Use these cre...

Page 79: ...o validate your authentication credentials with a smart card biometric reader or token before logging on to a secure site or application This is particularly useful when logging on to applications or Web sites that contain personal information such as bank account numbers For more information refer to Configuring Credential Manager settings later in this chapter Registering a new application Crede...

Page 80: ...le Sign On click Register New Application 4 Run the application you want to register until you reach the page that displays the password box 5 On the Drag and Drop Registration page of the SSO Registration Wizard select the type of activity you want to automate In most cases the activity you want to automate will be the Logon dialog 6 Click and drag the icon from the wizard page over the area of t...

Page 81: ...and then select My Identity 3 In the right pane under Single Sign On click Manage Applications and Credentials 4 Click the application entry you want to modify and then click Properties a Click the General tab to modify the application name and description Change the settings by selecting or clearing the check boxes next to the appropriate settings b Click the Script tab to view and edit the SSO a...

Page 82: ...ript This file can then be used to recover the Single Sign On data This acts as a supplement to the identity backup file which contains only the credential information To export an application 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right pane under Single Sign On click Manage Applications and Cr...

Page 83: ... Import Application 5 Follow the on screen instructions to complete the import 6 Click OK Modifying credentials To modify credentials 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select My Identity 3 In the right pane under Single Sign On click Manage Applications and Credentials 4 Click the application entry you want to modify ...

Page 84: ...ministrators log on From the Authentication and Credentials page you can specify which type or combination of credentials are required of either users or administrators To specify how users or administrators log on 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select Authentication and Credentials 3 In the right pane click the Au...

Page 85: ...Credentials 3 In the right pane click the Authentication tab 4 Click the category Users or Administrators from the category list 5 Click Custom from the list of authentication methods 6 Click Configure 7 Select the authentication methods you want to use 8 Choose the combination of methods by clicking one of the following Use AND to combine the authentication methods Users will have to authenticate...

Page 86: ...otectTools Security Manager 2 In the left pane select Credential Manager and then select Authentication and Credentials 3 In the right pane click the Credentials tab 4 Click the credential type you want to modify To register the credential click Register and then follow the on screen instructions To delete the credential click Clear and then click Yes in the confirmation dialog box To modify the c...

Page 87: ...ions Allows you to view the available services and modify the settings for those services Biometric Settings Allows you to select the fingerprint reader software and adjust the security level of the fingerprint reader Smart Cards and Tokens Allows you to view and modify properties for all available smart cards and tokens To modify Credential Manager settings 1 Select Start All Programs HP ProtectT...

Page 88: ...Apply and then click OK to save your changes 6 Restart the computer Example 2 Using the Advanced Settings page to require user verification before Single Sign On To require Single Sign On to verify your credentials before logging on to a registered dialog box or Web page 1 Select Start All Programs HP ProtectTools Security Manager 2 In the left pane select Credential Manager and then select Advanc...

Page 89: ...the BIOS unlocks the hard drive for the user Biometric Category of authentication credentials that use a physical feature such as a fingerprint to identify a user BIOS profile Group of BIOS configuration settings that can be saved and applied to other accounts BIOS security mode Setting in Smart Card Security that when enabled requires the use of a smart card and a valid PIN for user authenticatio...

Page 90: ...nd share a common directory database Domains are uniquely named and each has a set of common rules and procedures Emergency recovery archive Protected storage area that allows the re encryption of basic user keys from one platform owner key to another Encryption Procedure such as use of an algorithm employed in cryptography to convert plain text into cipher text in order to prevent unauthorized re...

Page 91: ... allows you to use the Credential Manager to access Internet and Windows applications that require password authentication Smart card Small piece of hardware similar in size and shape to a credit card which stores identifying information about the owner Used to authenticate the owner to a computer Smart card administrator password Password that links an administrator smart card with the computer i...

Page 92: ...CG specifications USB token Security device that stores identifying information about a user Like a smart card or biometric reader it is used to authenticate the owner to a computer Virtual token Security feature that works very much like a smart card and reader The token is saved either on the computer hard drive or in the Windows registry When you log on with a virtual token you are asked for a ...

Page 93: ... 6 definition 1 5 setting 2 4 BIOS administrator password changing 5 10 definition 1 4 setting 5 10 BIOS Configuration for ProtectTools 5 1 BIOS smart card security 2 3 BIOS user card password definition 1 5 setting and changing 2 7 boot options 5 2 C Computer Setup administrator password changing 5 10 definition 1 4 setting 5 10 Credential Manager account 6 4 logon password 1 7 logon wizard 6 3 r...

Page 94: ... BIOS security 2 3 stringent security 5 11 system configuration options 5 3 TPM chip 4 2 encrypting files and folders 4 6 F F10 Setup password 1 4 fingerprints 6 5 I identity 6 11 initializing embedded security chip 4 3 smart card 2 2 J Java Card assigning a name 3 5 changing a PIN 3 2 3 4 PIN definition 1 6 power on authentication 3 6 setting a PIN 3 2 3 4 Java Card Security for ProtectTools 3 1 ...

Page 95: ...ting applications 6 20 manual registration 6 18 modifying application properties 6 19 removing applications 6 19 smart card administrator password changing 2 6 definition 1 5 setting 2 3 smart card BIOS security 2 3 smart card PIN changing 2 11 definition 1 5 smart card reader selecting 3 3 smart card recovery file password definition 1 5 setting 2 12 Smart Card Security for ProtectTools 2 1 smart...