000038056 - How to prevent a local administrator from setting a reserve password in the RSA Authentication Agent for Windows Control Center

Document created by RSA Customer Support Employee on Oct 16, 2019
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000038056
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Windows
RSA Version/Condition: 7.4
IssueA Windows user with administrative rights can enable the Reserve Password in the RSA Control Center.
 
Reserve PW


This ability raises two questions:
  1. Is there a way to prevent this, either via GPO that disables Reserve Passwords or with a Windows Security Policy?
  2. Would the administrator still have the ability to enable and set a Reserve Password in the registry or through Windows Local Security Policy, so that the local administrator cannot be prevented from bypassing the passcode challenge with a Reserve Password they created?
TasksConfigure the GPO one of two ways:  either disable or override.
ResolutionDomain policies take precedence over settings made in the RSA Control Center. Thus, a domain policy can be pushed with a Reserve Password to prevent a privileged user from setting a Reserve Password through either the RSA Control Center or the locally installed GPO templates.
 

The domain policy can set a totally bogus Reserve Password if all you want to do is to block users from setting their own.
 



GPO Reserve PW



Alternatively, you could set a reserve password in the domain policy that only certain Authentication Manager administrators know. This password can be changed periodically to ensure its' security.
Notes

If users have administrative privileges, pushing out domain policies is probably a generally good practice for maintaining control, even for policies for which the default agent behavior is the behavior that you want.

For example, the agent disables the Microsoft Password Provider by default, but provides a filter GPO that allows an administrator to change that. Customers should probably push out a domain policy that also prevents an administrative user from changing that.

Attachments

    Outcomes