Authentication Client- Specops uReset 8

NOTE
The Authentication Client requires installation/silent deployment. You can download the installation files here. There are no configs or msi parameters required for roll-out.

Specops Authentication Client can be configured using the administrative template in the Group Policy Management Console.

Specops Authentication Client uses ADMX files to change the Windows Registry settings to alter the way the software interacts with the system software. ADMX templates are Windows Group Policy Settings XML-based files that specify which registry keys in the Windows Registry are changed when a certain Group Policy setting is changed (ADML files are the localized XML files containing the text strings associated with the ADMX files).

ADMX templates can be used to change numerous registry keys, but this document focuses on two settings in particular connected to Specops Authentication Client: creating the Start menu shortcut; and showing/hiding the reset password link on the logon page.

Accessing the Specops ADMX templates

To access the ADMX templates associated with Specops Authentication Client:

  1. Open the Group Policy Management tool (GPMC).
  2. Right-click the Group Policy Object (GPO) you want to change, and select Edit.
  3. In the tree navigation, navigate to Computer Configuration > Policies > Administrative templates: Policy definitions (ADMX files) > Specops Authentication Client. There you will find all the ADMX templates associated with Specops Authentication Client.

Hiding the reset password link on the logon page

Location: Enhance Windows logon and password change > Show the Password Reset Link

At Windows logon, under the username/password fields, a “Reset password…” link allows users in organizations running Specops uReset or Specops Password Reset to reset their passwords. This setting allows you to show or hide the reset password link shown on the Windows logon page.

  1. Open the Show the Password Reset Link file.
  2. Select the Disabled radio button.
  3. Click OK.
    NOTE
    to enable the setting again, you can set the radio button to either Not configured or Enabled.
    Alt text for this image

Start menu shortcut creation

Location:General Client settings > Create start menu shortcuts to enroll/change/reset

With Specops Authentication Client installed, when a user logs in to Windows, start menu shortcuts to enroll, reset and change password are created. These are convenience shortcuts for users to easily use Specops uReset or Specops Password Reset. This setting allows you to hide those shortcuts, in case these should not be shown. If those shortcuts have already been created on a computer, they will be removed at next logon if this setting has been set to disabled.

  1. Open the Create start menu shortcuts to enroll/change/reset file.
  2. Select the Disabled radio button.
  3. Click OK.
    NOTE
    to enable the setting again, you can set the radio button to either Not configured or Enabled.
    Alt text for this image

Creating a Central Store for Group Policy Administrative Templates

The Central Store for Administrative Templates allows you to store all template files in a single location on SYSVOL where they can be accessed and presented on any server from your domain. To create a Central Store for Group Policy Administrative Templates, copy the Specops uReset Client ADMX/ADML files from %windir%\PolicyDefinitions.

The ADMX should be copied to:

[your domain]\sysvol\[your domain]\Policies\PolicyDefinitions

The ADML should be copied to:

[your domain]\sysvol\[your domain]\Policies\PolicyDefinitions\en-us

For more information about the Central Store and best practices, visit: www.support.microsoft.com/kb/929841

For help in installing the product and the Client, please refer to the Installation section.

For downloads, please refer to the Downloads section.

Dynamic Feedback UI

NOTE
The dynamic feedback UI requires Windows 10 or later, or Windows Server 2016
NOTE
The dynamic feedback at password change is not supported if the Group Policy setting "Interactive Logon: Do not display last username" is set to Enabled.

Specops Secured Browser (Cefsharp)

The Specops Secured Browser is used to reset passwords for a user from the Windows logon screen. It comes in two flavors, based on CefSharp and Internet Explorer browser engines, respectively. It is recommended to use the CefSharp-based Secured Browser for better security and user experience.

To use the CefSharp-based Secured Browser, the Specops Authentication Client CefSharp runtime must be deployed. The runtime has been tested by Specops to be compatible with the Secured Browser, and is a separate MSI from the Specops Authentication Client.

NOTE
If the CefSharp runtime isn't installed, an error message will be displayed if attempting to reset a password from the Windows logon screen by pressing the 'Reset Password...' link. It is possible to enforce using the Internet Explorer based browser, but strongly not recommended.

Usage

The CefSharp-based browser supports Specops uReset 8 and Specops Password Reset. Organizations that have not yet migrated to Specops uReset 8 must use the Internet Explorer-based Secured Browser, and should therefore not deploy the MSI for Specops the CefSharp runtime.

Organizations using Specops uReset 8 or Specops Password Reset

It is recommended to deploy the Specops Authentication Client CefSharp runtime on x64 Windows 10 or newer client computers.

Organizations using Specops uReset 7

It is recommended to migrate to Specops uReset 8. If that currently isn't viable, the IE-based browser must be enforced in ADMX settings ("Enforce IE based secured browser"). There is no need to deploy the Specops Authentication Client CefSharp runtime (not supported).

Organizations using Specops Password Policy only

If no reset solution is used, there is no need deploy the Specops Authentication Client CefSharp runtime (not applicable).