Knowledge Base

When you see this message, you can check a few things within your environment to ensure your gatekeeper is operating properly. Go to the Specops Authentication Gatekeeper and check your Gatekeeper tab to see the overall connectivity. This article will go over several common scenarios in which this may happen The service is stopped If...

Please note these instructions apply only to AAD-only machines and are not applicable to hybrid-joined machines. Below we will review the steps required for enabling Azure Active Directory joined Windows clients with the Specops Authentication Client to use uReset from the Windows login screen. Where do I go to download the Microsoft ADMX templates? This...

By default, when a user is enrolled in the mobile code (SMS) identity service, the mobile number entered by the user is stored in the mobile attribute on the user’s account in AD.  In some organizations this may not be ideal, as the phone number becomes visible to users in the other applications (e.g. Exchange/Office...

In certain environments, external users or contractors may be configured with a non-corporate email address in the ‘mail’ attribute (for example, a company email for the contractor organization or a personal/private email address). These users cannot use the Email Identity Service in Specops Authentication (uReset, Secure Service Desk Quick verification) as the Email Identity Service...

This article will review how Specops uReset licenses are consumed and assumes you are on the latest version of uReset. The count is based on the number of enabled Active Directory user objects that have a uReset GPO applied to them in Active Directory. License usage will be displayed in the subscription tab of the...

In certain configurations, the Specops Client requires additional configuration to determine the location of the Specops configuration in Active Directory: If you have a single-domain setup with the default settings container location (under domain/System/Specops) the steps in this article should not be necessary. Identify the Settings Container Location We can get the configuration root from...

This article applies to uReset when used in a multi-domain environment. When using uReset and Password Policy in multiple trusted domains/forests, you may find that users accessing uReset from domains other than the Gatekeeper domain do not see the Password Policy rules when setting their new password. When this occurs, you will find event ID...

The cause of this error varies, It often shows up when trying to sign in during an enrollment or password reset attempt. Here below is a list of some of the most common causes. In the Specops Authentication Gatekeeper Admin tool, check the scope settings at the Active Directory Settings tab and make sure in...

If you are an administrator using Specops Authentication, and you want test a reset as the managed service account, this article will walk you through how to use PsExec.exe to impersonate that account. By using PsExec.exe you will open the new Command Prompt in the System Context and the account doing all the operations will...

Enrollment data in AD is locked down with a default permission set that should be sufficient for all Specops Authentication products to function. Use the instructions provided here only on guidance from Specops Support staff. The following PowerShell commands can be used to grant a group full access to all SpecopsAuthentication leaf objects in Active...