How to prevent a local administrator from setting a reserve password in the RSA Authentication Agent for Windows Control Center
Originally Published: 2019-10-14
Article Number
Applies To
RSA Product/Service Type: Authentication Agent for Windows
RSA Version/Condition: 7.4
Issue
This ability raises two questions:
- Is there a way to prevent this, either via GPO that disables Reserve Passwords or with a Windows Security Policy?
- Would the administrator still have the ability to enable and set a Reserve Password in the registry or through Windows Local Security Policy, so that the local administrator cannot be prevented from bypassing the passcode challenge with a Reserve Password they created?
Tasks
Resolution
The domain policy can set a totally bogus Reserve Password if all you want to do is to block users from setting their own.
Alternatively, you could set a reserve password in the domain policy that only certain Authentication Manager administrators know. This password can be changed periodically to ensure its' security.
Notes
If users have administrative privileges, pushing out domain policies is probably a generally good practice for maintaining control, even for policies for which the default agent behavior is the behavior that you want.
For example, the agent disables the Microsoft Password Provider by default, but provides a filter GPO that allows an administrator to change that. Customers should probably push out a domain policy that also prevents an administrative user from changing that.
