AnsweredAssumed Answered

Windows authentication prompting passcode but accepts password

Question asked by Nicholas Schumacher on May 15, 2018
Latest reply on May 16, 2018 by Jay Guillette

Like • Show 0 Likes0
Comment • 2

I am trying to troubleshoot an issue where the user enters the password/passcode. Currently the user will enter their passcode and then are prompted to enter their windows credentials. If the user locks their computer, within 90 minutes they are able to enter their windows credentials. If it is after 90 minutes then the user will need to enter their Pin + RSA token. The problem happens when within the 90 minutes the authentication screen on windows 7 displays "Passcode" in the text box. The user will then enter the pin and the RSA token and get authentication failed. That user will usually lock themselves out. The solution to this is entering the user's windows password instead of the passcode. This does not happen for everybody in our system. Does anyone know what is causing this issue and what the solution could be?

Thanks!!!

Piers Bowness

May 16, 2018 11:03 AM

Correct Answer

My guess is there may be an issue with how your "Challenge Groups" are configured and the user's memberships therein.

I would recommend contacting Customer Support for more detailed assistance.

See the reply in context

No one else had this question

Outcomes

Piers Bowness

May 16, 2018 11:03 AM

My guess is there may be an issue with how your "Challenge Groups" are configured and the user's memberships therein.

I would recommend contacting Customer Support for more detailed assistance.

Actions

Jay Guillette

@ Piers Bowness on May 16, 2018 11:59 AM

Piers is right that Challenge group plays into this, but so does Quick PIN unlock, which can be set to Password instead of PIN, then set to work for a specific amount of time until a PassCode is required to unlock

What you describe, user sees PassCode prompt to Unlock Screen but PassCode does not work, Password does, could happen for at least two reasons;

1. This user is not challenged, or the challenge lookup failed but the fall-back configuration is to Fail with Not Challenged

2. This user is challenged, but Quick PIN unlock is configured to accept Password, at least until the 'timeout' in minutes is reached, after which a Passcode would be required to unlock the screen

Further complicating this situation is that agents have two settings to trigger the timeout, since the user logged into Windows which is pretty reliable and since the Screen locked which is problematic due to relying on older Microsoft SENS Events to trigger timer based on screen locking.

You could enable verbose agent logging in the RSA Control Center to try to troubleshoot, but it might be a whole lot more productive just to avoid timers based on when the screen locked.

Actions

2 Replies

Piers Bowness May 16, 2018 11:03 AM
Unmark Correct
Correct Answer
My guess is there may be an issue with how your "Challenge Groups" are configured and the user's memberships therein.
I would recommend contacting Customer Support for more detailed assistance.
Like • Show 1 Like1
Actions
- Jay Guillette @ Piers Bowness on May 16, 2018 11:59 AM
  Mark Correct
  Correct Answer
  Piers is right that Challenge group plays into this, but so does Quick PIN unlock, which can be set to Password instead of PIN, then set to work for a specific amount of time until a PassCode is required to unlock
  What you describe, user sees PassCode prompt to Unlock Screen but PassCode does not work, Password does, could happen for at least two reasons;
  1. This user is not challenged, or the challenge lookup failed but the fall-back configuration is to Fail with Not Challenged
  2. This user is challenged, but Quick PIN unlock is configured to accept Password, at least until the 'timeout' in minutes is reached, after which a Passcode would be required to unlock the screen
  Further complicating this situation is that agents have two settings to trigger the timeout, since the user logged into Windows which is pretty reliable and since the Screen locked which is problematic due to relying on older Microsoft SENS Events to trigger timer based on screen locking.
  
  You could enable verbose agent logging in the RSA Control Center to try to troubleshoot, but it might be a whole lot more productive just to avoid timers based on when the screen locked.
  Like • Show 1 Like1
  Actions

Windows authentication prompting passcode but accepts password

Outcomes

Related Content

Recommended Content