How to prevent a local administrator from setting a reserve password in the RSA Authentication Agent for Windows Control Center

[#1]

Article Number

000038056

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Windows
RSA Version/Condition: 7.4

Issue

A Windows user with administrative rights can enable the Reserve Password in the RSA Control Center.
 

Image description

This ability raises two questions:

1. Is there a way to prevent this, either via GPO that disables Reserve Passwords or with a Windows Security Policy?
2. Would the administrator still have the ability to enable and set a Reserve Password in the registry or through Windows Local Security Policy, so that the local administrator cannot be prevented from bypassing the passcode challenge with a Reserve Password they created?

Task

Configure the GPO one of two ways:  either disable or override.

Resolution

Domain policies take precedence over settings made in the RSA Control Center. Thus, a domain policy can be pushed with a Reserve Password to prevent a privileged user from setting a Reserve Password through either the RSA Control Center or the locally installed GPO templates.
 

The domain policy can set a totally bogus Reserve Password if all you want to do is to block users from setting their own.
 

Image description

Alternatively, you could set a reserve password in the domain policy that only certain Authentication Manager administrators know. This password can be changed periodically to ensure its' security.

Notes

If users have administrative privileges, pushing out domain policies is probably a generally good practice for maintaining control, even for policies for which the default agent behavior is the behavior that you want.

For example, the agent disables the Microsoft Password Provider by default, but provides a filter GPO that allows an administrator to change that. Customers should probably push out a domain policy that also prevents an administrative user from changing that.