Managing Authentication Agent accounts
Authentication Agent is needed for working with drives that are protected using Kaspersky Disk Encryption (FDE) technology. Before the operating system is loaded, the user needs to complete authentication with the Agent. The Manage Authentication Agent accounts task is designed for configuring user authentication settings. You can use local tasks for individual computers as well as group tasks for computers from separate administration groups or a selection of computers.
You cannot configure a schedule for starting the Manage Authentication Agent accounts task. It is also impossible to forcibly stop a task.
How to create the Manage Authentication Agent accounts task in the Administration Console (MMC)
- Open the Kaspersky Security Center Administration Console.
- In the console tree, select Tasks.
The list of tasks opens.
- Click New task.
The Task Wizard starts. Follow the instructions of the Wizard.
Step 1. Selecting task type
Select Kaspersky Endpoint Security for Windows (12.7) → Manage Authentication Agent accounts.
Step 2. Selecting an Authentication Agent account management command
Generate a list of Authentication Agent account management commands. Management commands allow you to add, modify, and delete Authentication Agent accounts (see instructions below). Only users who have an Authentication Agent account can complete the authentication procedure, load the operating system, and gain access to the encrypted drive.
Step 3. Selecting the devices to which the task will be assigned
Select the computers on which the task will be performed. The following options are available:
- Assign the task to an administration group. In this case, the task is assigned to computers included in a previously created administration group.
- Select computers detected by the Administration Server in the network: unassigned devices. The specific devices can include devices in administration groups as well as unassigned devices.
- Specify device addresses manually, or import addresses from a list. You can specify NetBIOS names, IP addresses, and IP subnets of devices to which you want to assign the task.
Step 4. Defining the task name
Enter a name for the task, for example, Administrator Accounts.
Step 5. Completing task creation
Exit the Wizard. If necessary, select the Run the task after the wizard finishes check box. You can monitor the progress of the task in the task properties.
As a result, after the task is completed at the next computer startup, the new user can complete the authentication procedure, load the operating system, and gain access to the encrypted drive.
How to create the Manage Authentication Agent accounts task in the Web Console
- In the main window of the Web Console, select Devices → Tasks.
The list of tasks opens.
- Click Add.
The Task Wizard starts. Follow the instructions of the Wizard.
Step 1. Configuring general task settings
Configure the general task settings:
- In the Application drop-down list, select Kaspersky Endpoint Security for Windows (12.7).
- In the Task type drop-down list, select Manage Authentication Agent accounts.
- In the Task name field, enter a brief description, such as Administrator accounts.
- In the Select devices to which the task will be assigned block, select the task scope.
Step 2. Managing Authentication Agent accounts
Generate a list of Authentication Agent account management commands. Management commands allow you to add, modify, and delete Authentication Agent accounts (see instructions below). Only users who have an Authentication Agent account can complete the authentication procedure, load the operating system, and gain access to the encrypted drive.
Step 3. Completing task creation
Exit the Wizard. A new task will be displayed in the list of tasks.
To run a task, select the check box opposite the task and click the Start button.
As a result, after the task is completed at the next computer startup, the new user can complete the authentication procedure, load the operating system, and gain access to the encrypted drive.
To add an Authentication Agent account, you need to add a special command to the Manage Authentication Agent accounts task. It is convenient to use a group task, for example, to add an administrator account to all computers.
Kaspersky Endpoint Security allows you to automatically create Authentication Agent accounts before encrypting a drive. You can enable automatic creation of Authentication Agent accounts in the Full Disk Encryption policy settings. You can also use Single Sign-On (SSO) technology.
How to add an Authentication Agent account through the Administration Console (MMC)
- Open the properties of the Manage Authentication Agent accounts task.
- In the task properties, select the Settings section.
- Click Add → Account adding command.
- In the window that opens, in the Windows account field, specify the name of the Microsoft Windows account that will be used to create the Authentication Agent account.
- If you manually entered the Windows account name, click the Allow button to define the account security identifier (SID).
If you choose not to determine the security identifier (SID) by clicking the Allow button, it will be determined when the task is performed on the computer.
Defining a Windows account security identifier is necessary to verify that the Windows account name was entered correctly. If the Windows account does not exist on the computer or in the trusted domain, the Manage Authentication Agent accounts task will end with an error.
- Select the Replace existing account check box if you want the existing account previously created for the Authentication Agent to be replaced with the account being created.
This step is available when you are adding an Authentication Agent account creation command in the properties of a group task for managing Authentication Agent accounts. This step is not available when you are adding an Authentication Agent account creation command in the properties of the Manage Authentication Agent accounts local task.
- In the User name field, type the name of the Authentication Agent account that must be entered during authentication for access to encrypted hard drives.
- Select the Allow password-based authentication check box if you want the application to prompt the user to enter the Authentication Agent account password during authentication for accessing encrypted hard drives. Set a password for the Authentication Agent account. If necessary, you can request a new password from the user after the first authentication.
- Select the Allow certificate-based authentication check box if you want the application to prompt the user to connect a token or smart card to the computer during authentication for accessing encrypted hard drives. Select a certificate file for authentication with a smart card or token.
- If required, in the Command description field, enter the Authentication Agent account details that you need for managing the command.
- In the Access to authentication in Authentication Agent block, configure access to authentication in Authentication Agent for the user that uses the account specified in the command.
- Save your changes.
How to add an Authentication Agent account through the Web Console
- In the main window of the Web Console, select Devices → Tasks.
The list of tasks opens.
- Click the Manage Authentication Agent accounts task of Kaspersky Endpoint Security.
The task properties window opens.
- Select the Application settings tab.
- In the list of Authentication Agent accounts, click the Add button.
This starts the Authentication Agent Account Management Wizard.
- Select the Add command type.
- Select a user account. You can select an account from the list of domain accounts or manually enter the account name. Go to the next step.
Kaspersky Endpoint Security determines the account security identifier (SID). This is necessary to verify the account. If you entered the user name incorrectly, Kaspersky Endpoint Security will end the task with an error.
- Configure the Authentication Agent account settings.
- Create a new Authentication Agent account to replace the existing account. Kaspersky Endpoint Security scans existing accounts on the computer. If the user security ID on the computer and in the task match, Kaspersky Endpoint Security will change the user account settings in accordance with the task.
- User name. The default user name of the Authentication Agent account corresponds to the domain name of the user.
- Allow password-based authentication. Set a password for the Authentication Agent account. If necessary, you can request a new password from the user after the first authentication. This way, each user will have their own unique password. You can also set password strength requirements for the Authentication Agent account in the policy.
- Allow certificate-based authentication. Select a certificate file for authentication with a smart card or token. This way, the user will need to enter the password for the smart card or token.
- Account access to encrypted data. Configure user access to the encrypted drive. You can, for example, temporarily disable user authentication instead of deleting the Authentication Agent account.
- Comment. Enter an account description, if necessary.
- Save your changes.
- Select the check box next to the task and click the Start button.
As a result, after the task is completed at the next computer startup, the new user can complete the authentication procedure, load the operating system, and gain access to the encrypted drive.
To change the password and other settings of the Authentication Agent account, you need to add a special command to the Manage Authentication Agent accounts task. It is convenient to use a group task, for example, to replace the administrator token certificate on all computers.
How to change the Authentication Agent account through the Administration Console (MMC)
- Open the properties of the Manage Authentication Agent accounts task.
- In the task properties, select the Settings section.
- Click Add → Account editing command.
- In the window that opens, in the Windows account field, specify the name of the Microsoft Windows user account that you want to change.
- If you manually entered the Windows account name, click the Allow button to define the account security identifier (SID).
If you choose not to determine the security identifier (SID) by clicking the Allow button, it will be determined when the task is performed on the computer.
Defining a Windows account security identifier is necessary to verify that the Windows account name was entered correctly. If the Windows account does not exist on the computer or in the trusted domain, the Manage Authentication Agent accounts task will end with an error.
- Select the Change user name check box and enter a new name for the Authentication Agent account if you want Kaspersky Endpoint Security to change the user name for all Authentication Agent accounts created using the Microsoft Windows account with the name indicated in the Windows account field to the name typed in the field below.
- Select the Modify password-based authentication settings check box to make password-based authentication settings editable.
- Select the Allow password-based authentication check box if you want the application to prompt the user to enter the Authentication Agent account password during authentication for accessing encrypted hard drives. Set a password for the Authentication Agent account.
- Select the Edit the password change rule upon authentication in Authentication Agent check box if you want Kaspersky Endpoint Security to change the value of the password change setting for all Authentication Agent accounts created using the Microsoft Windows account with the name indicated in the Windows account field to the setting value specified below.
- Specify the value of the password change setting upon authentication in Authentication Agent.
- Select the Modify certificate-based authentication settings check box to make settings of authentication based on the electronic certificate of a token or smart card editable.
- Select the Allow certificate-based authentication check box if you want the application to prompt the user to enter the password to the token or smart card connected to the computer during the authentication process in order to access encrypted hard drives. Select a certificate file for authentication with a smart card or token.
- Select the Edit command description check box and edit the command description if you want Kaspersky Endpoint Security to change the command description for all Authentication Agent accounts created using the Microsoft Windows account with the name indicated in the Windows account field.
- Select the Edit the authentication access rule in Authentication Agent check box if you want Kaspersky Endpoint Security to change the rule for user access to the authentication dialog in Authentication Agent to the value specified below for all Authentication Agent accounts created using the Microsoft Windows account with the name indicated in the Windows account field.
- Specify the rule for accessing the authentication dialog in Authentication Agent.
- Save your changes.
How to change the Authentication Agent account through the Web Console
- In the main window of the Web Console, select Devices → Tasks.
The list of tasks opens.
- Click the Manage Authentication Agent accounts task of Kaspersky Endpoint Security.
The task properties window opens.
- Select the Application settings tab.
- In the list of Authentication Agent accounts, click the Add button.
This starts the Authentication Agent Account Management Wizard.
- Select the Change command type.
- Select a user account. You can select an account from the list of domain accounts or manually enter the account name. Go to the next step.
Kaspersky Endpoint Security determines the account security identifier (SID). This is necessary to verify the account. If you entered the user name incorrectly, Kaspersky Endpoint Security will end the task with an error.
- Select the check boxes next to the settings that you want to edit.
- Configure the Authentication Agent account settings.
- Create a new Authentication Agent account to replace the existing account. Kaspersky Endpoint Security scans existing accounts on the computer. If the user security ID on the computer and in the task match, Kaspersky Endpoint Security will change the user account settings in accordance with the task.
- User name. The default user name of the Authentication Agent account corresponds to the domain name of the user.
- Allow password-based authentication. Set a password for the Authentication Agent account. If necessary, you can request a new password from the user after the first authentication. This way, each user will have their own unique password. You can also set password strength requirements for the Authentication Agent account in the policy.
- Allow certificate-based authentication. Select a certificate file for authentication with a smart card or token. This way, the user will need to enter the password for the smart card or token.
- Account access to encrypted data. Configure user access to the encrypted drive. You can, for example, temporarily disable user authentication instead of deleting the Authentication Agent account.
- Comment. Enter an account description, if necessary.
- Save your changes.
- Select the check box next to the task and click the Start button.
To delete an Authentication Agent account, you need to add a special command to the Manage Authentication Agent accounts task. It is convenient to use a group task, for example, to delete the account of a dismissed employee.
How to delete an Authentication Agent account through the Administration Console (MMC)
- Open the properties of the Manage Authentication Agent accounts task.
- In the task properties, select the Settings section.
- Click Add → Account deletion command.
- In the window that opens, in the Windows account field, specify the name of the Windows user account that was used to create the Authentication Agent account that you want to delete.
- If you manually entered the Windows account name, click the Allow button to define the account security identifier (SID).
If you choose not to determine the security identifier (SID) by clicking the Allow button, it will be determined when the task is performed on the computer.
Defining a Windows account security identifier is necessary to verify that the Windows account name was entered correctly. If the Windows account does not exist on the computer or in the trusted domain, the Manage Authentication Agent accounts task will end with an error.
- Save your changes.
How to delete an Authentication Agent account through the Web Console
- In the main window of the Web Console, select Devices → Tasks.
The list of tasks opens.
- Click the Manage Authentication Agent accounts task of Kaspersky Endpoint Security.
The task properties window opens.
- Select the Application settings tab.
- In the list of Authentication Agent accounts, click the Add button.
This starts the Authentication Agent Account Management Wizard.
- Select the Delete command type.
- Select a user account. You can select an account from the list of domain accounts or manually enter the account name.
- Save your changes.
- Select the check box next to the task and click the Start button.
As a result, after the task is completed at the next computer startup, the user will not be able to complete the authentication procedure and load the operating system. Kaspersky Endpoint Security will deny access to encrypted data.
To view the list of users who can complete authentication with the Agent and load the operating system, you need to go to the properties of the managed computer.
How to view the list of Authentication Agent accounts through the Administration Console (MMC)
- Open the Kaspersky Security Center Administration Console.
- In the console tree, select Devices.
- Double-click to open the computer properties window.
- In the computer properties window, select the Tasks section.
- In the task list, select Manage Authentication Agent accounts and open the task properties by double-clicking.
- In the task properties, select the Settings section.
As a result, you will be able to access a list of Authentication Agent accounts on this computer. Only users from the list can complete authentication with the Agent and load the operating system.
How to view a list of Authentication Agent accounts through the Web Console
- In the main window of the Web Console, select Devices → Managed devices.
- Click the name of the computer on which you want to view the list of Authentication Agent accounts.
- In computer properties, select the Tasks tab.
- In the task list, select Manage Authentication Agent accounts.
- In the task properties, select the Application settings tab.
As a result, you will be able to access a list of Authentication Agent accounts on this computer. Only users from the list can complete authentication with the Agent and load the operating system.