You will need to complete the following configuration settings once you have installed
Specops Password Reset.
Import your license key
Enter your license key in the
Password Reset Configuration Tool.
-
Open the
Specops Password Reset Configuration Tool.
- In the navigation pane, select License.
- Click Import License.
-
Browse to the location of the TXT file, and click
Open.
Verify that your domain is configured for use with Specops Password Reset
-
Open the
Specops Password Reset Configuration Tool.
- In the navigation pane, select Domains.
- Verify that your domain is listed under Configured Domains.
Install additional web servers you might want to use for external access
Refer to Install the Web Component in DMZ (if applicable)
If using Secret Question Authentication, ensure that users enroll in the systems
For information about the different enrollment options and best practices, see
Specops Password ResetEnrollment Options and Best Practices.
Verify that the Specops Client is installed on your client machines
Perform the following steps on the client to determine that the Client has been successfully installed.
-
View installed programs from the Control Panel:
- Open Programs and Features.
- In the list of installed programs, find
Specops Client.
NOTE
You can also view the version of the Client.
-
View installed programs from the Registry.
- Open the registry editor.
- Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Specopssoft\uReset\Client
NOTE
The above key will only exist after the Client has been installed.
Verify security settings for administrative accounts
Windows contains many built-in security features designed to enhance the security around administrative accounts. One of these features is the adminSDHolder functionality, which automatically reconfigures the ACL on objects which are members of built-in
privileged Active Directory groups. This process runs every 60 minutes on the PDC Emulator and will remove the inherited permissions of your
Specops Password Reset service account from the protected user objects. If you want your administrative accounts to be able to use
Specops Password Reset, you must manually add permissions for the service account to the AdminSDHolder container.
-
Log in with an account with Domain Admin permissions and run the following command:
Copydsacls "CN=AdminSDHolder, CN=System, <Domain DN>" /G "<ServiceAccount>:CCDC;classStore;" "<ServiceAccount>:LC;;" "<ServiceAccount>:CA;Reset Password;" "<ServiceAccount>:RP;userAccountControl;" "<ServiceAccount>:RPWP;mobile;"
"<ServiceAccount>:RPWP;pwdLastSet;" "<ServiceAccount>:RPWP;lockoutTime;"Example:dsacls "CN=AdminSDHolder, CN=System, DC=example, DC=com" /G "EXAMPLEsprsvc:CCDC;classStore;" "EXAMPLEsprsvc:LC;;" "EXAMPLEsprsvc:CA;Reset
Password;" "EXAMPLEsprsvc:RP;userAccountControl;" "EXAMPLEsprsvc:RPWP;mobile;" "EXAMPLEsprsvc:RPWP;pwdLastSet;" "EXAMPLEsprsvc:RPWP;lockoutTime;"
-
Replace <domainDN> and <serviceAccount> with the domain components of your domain and the name of the SPR service account.
NOTE
Allowing
Specops Password Reset to work with account with administrative permissions is not best practice for security reasons. Enable these settings only if it is required by the practical reality of your organization.
Configure access to Active Directory Fine-Grained Password Policies
If
Specops Password Reset is installed in a domain where fine-grained password policies are used, the
Specops Password Reset Service Account must be granted permissions to read the configured password policies.
-
Log in with an account with Domain Admin permissions and run the following command:
-
Copy
dsacls “CN=Password Settings Container,CN=System,<domainDN>” /I:T /G <serviceAccount>:GR;; Example: dsacls “CN=Password Settings Container,CN=System,DC=example,DC=com” /I:T /G EXAMPLEsprsvc:GR;;
-
Replace <domainDN> and <serviceAccount> with the domain components of your domain and the name of the SPR service account.
Configure your environment for use with the Mobile Access Web Service
If you installed the Mobile Access Web Service as part of the
Specops Password Reset Web installation, you will need to complete the below steps before the service is ready for use within your organization.
Make the mobile Access Web Service reachable from the internet: Your firewall must allow communication on tcp port 443 so mobile device can connect to the service through https.
Enable service discovery: For the device to find the Mobile Access service, the application will require the user to enter their email address. The domain part of the email address will be used to make a DNS query to find a service
record for the Mobile Access Web Service in the email zone. This requires each DNS zone to be updated with a new service record point to the
Password Reset Mobile Access Service.
Create the Specops Password SRV record: The service record should be created in your mail enabled external DNS zone by you or your ISP depending on who manages the zone data.
The following settings should be used when creating the service record:
| DNS record part |
Value |
Explanation |
| _service |
_tcp |
The “_specopspassword” service is accessed over tcp. |
| Zone Name |
[zone] |
This part is the name of your internet zone.
The full name of the service record for the “example.com” domain would be:
_specopspassword._tcp.example.com.
|
| TTL |
[TTL] |
The time (in seconds) the record may be cached before it is considered obsolete.
Every zone has a default TTL value, but it is also possible to create separate TTLs for each record.
|
| Class |
IN |
The standard DNS class field, This is always “IN”. |
| Priority |
0 |
If more than one target host exists for the service record the priority determines the preference between targets.
Lower values mean higher preference.
|
| Port |
443 |
The “_specopspassword” service is accessed over SSL on port tcp/443.
If this configuration in changed on the web server the port data in the SRV record needs to reflect this as well.
|
| Target |
[target FQDN] |
The target is the FQDN of the host running the Specops Password Reset Web Service.
For a host called “spr” in the example.com domain, the target would be:
spr.example.com
|
The complete record to connect clients to the host “spr.example.com” might look like this:
_specopspassword._tcp.example.com 86400 IN 0 0 443
spr.example.com
Test the service record: The service record can be tested by running the following command:
nslookup -type=SRV _specopspassword._tcp.[your_domain_name]
8.8.8.8
Expected response:
nslookup -type=SRV _specopspassword._tcp.example.com 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
_specopspassword._tcp.example.com SRV service location:
priority = 0
weight = 0
port = 443
svr hostname = spr.example.com
If you are using a proxy internally, you will need to add an exception to bypass authentication, and let the system browse to the
Specops Password Reset web page without authentication.
