Configure Windows GPO

Introduction

From version 5.1 of vSEC:CMS it is possible to use Windows GPO to configure specific settings that can be used by client-side components. Currently the following client components can be configured through Windows GPO:

vSEC:CMS User Application
vSEC:CMS Remote Security Device Management (RSDM)

Important
It is expected that anyone using Windows GPOs is experienced in this area as this article is not a manual for issuing Windows GPOs.

Important
If Windows GPOs are used then any registry keys that may have been configured on the client side previously would not be used, i.e. GPO configuration will take precedence.

Note
The GPO ADMX files will be available on the vSEC:CMS server. If you installed the vSEC:CMS into the default location then for vSEC:CMS User Application the ADMX file will be found here C:\Program Files\Versasec\vSEC_CMS S-Series\Group Policies\en-US for 64-bit version and for 32-bit version here C:\Program Files (x86)\Versasec\vSEC_CMS S-Series\Group Policies\en-US. For RSDM the ADMX file will be found here C:\Program Files\Versasec\vSEC_CMS S-Series\Group Policies for 64-bit version and for 32-bit version here C:\Program Files (x86)\Versasec\vSEC_CMS S-Series\Group Policies.

Note
For information purposes if the GPO settings are applied, they will be stored in the registry of the client in [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Versatile Security] and [HKEY_CURRENT_USER\SOFTWARE\Policies\Versatile Security].

Note
The very latest Windows version / patches should be installed on the domain controller where the GPOs will be configured from.

Configure GPO for vSEC:CMS User Application

From Windows Group Policy Management Editor you can see what settings that can be configured through GPO. Under Computer Configuration you will see options:

And under User Configuration you will see options:

Configure GPO for vSEC:CMS User Application under Computer Configuration

From here a number of configuration options are available. We will describe each one in this section.

Ask for change PIN before operation is performed

From version 6.10 this policy is available. This policy will force the user to change their PIN before they are allowed to perform an operation such as certificate reissuance or card update. The credential PIN needs to be configured to be managed by vSEC:CMS in this case.

Force USS be online when doing PIN operations

From version 6.10 this policy is available. This policy will make sure that the vSEC:CMS User application is online, i.e. the application is able to communicate to the back-end vSEC:CMS server, before allowing a user to change or unblock their PIN. This will ensure proper trace reporting to the backend when these type of operations are performed from clients. The options are:

Force USS online when change PIN: Change PIN will only be allowed when the vSEC:CMS User application is online.
Force USS online when unblock PIN: Unblock PIN will only be allowed when the vSEC:CMS User application is online.

Card Template Tag Filtering

This policy is a list of tags that can be used to filter card templates shown for selection at credential issuances. If there are one or more tags matching the tags configured in the vSEC:CMS card template, the template is available for issuance.

Enter the tag(s) line by line into the field Card Template Tag Filtering and Apply. Then the card template(s) matching this will be presented to the users which this GPO is applicable to.

Note
Regular expressions can be used, for example if you wanted to not include all templates associated with tags Test & Demo then enter the regular expression ^((?!Test|Demo).)*$

Check for Card Update on Insert

With this policy it is possible to configure the behaviour of the vSEC:CMS User Application application when a credential is connected to the client machine. The vSEC:CMS User Application needs to be running in system tray mode for this.

For PIN change the options are:

No check: No check will be performed when the credential is attached to the client machine.
Notify balloon: When a credential is attached to the client the vSEC:CMS User Application will check if the credential PIN requires its PIN to be changed. If so a balloon type dialog will appear for 10 seconds informing the user that they need to change the PIN.
Note
vSEC:CMS uses the Windows balloon mechanism for balloon notifications. If this is disabled in Windows (maybe via GPO) then you would not get any balloon notifications. You can check this from your GPO configuration if Turn off all balloon notifications is enabled.
Notify popup: When a credential is attached to the client the vSEC:CMS User Application will check if the credential PIN requires its PIN to be changed. If so a popup type dialog will appear informing the user that they need to change the PIN. The dialog will remain open until the user acknowledges the dialog.
Notify popup (always on top): When a credential is attached to the client the vSEC:CMS User Application will check if the credential PIN requires its PIN to be changed. If so a popup type dialog will appear which will be always on-top informing the user that they need to change the PIN. The dialog will remain open until the user acknowledges the dialog.

For PIN unblock the options are:

No check: No check will be performed when the credential is attached to the client machine.
Notify balloon: When a credential is attached to the client the vSEC:CMS User Application will check if the credential PIN is blocked. If so a balloon type dialog will appear for 10 seconds informing the user that they need to unblock the PIN.
Note
vSEC:CMS uses the Windows balloon mechanism for balloon notifications. If this is disabled in Windows (maybe via GPO) then you would not get any balloon notifications. You can check this from your GPO configuration if Turn off all balloon notifications is enabled.
Notify popup: When a credential is attached to the client the vSEC:CMS User Application will check if the credential PIN is blocked. If so a popup type dialog will appear informing the user that they need to unblock the PIN. The dialog will remain open until the user acknowledges the dialog.
Notify popup (always on top): When a credential is attached to the client the vSEC:CMS User Application will check if the credential PIN is blocked. If so a popup type dialog will appear which will be always on-top informing the user that they need to unblock the PIN. The dialog will remain open until the user acknowledges the dialog.

For Card update the options are:

No check: No check will be performed when the credential is attached to the client machine.
Notify balloon: When a credential is attached to the client the vSEC:CMS User Application will check if the credential needs to be updated. If so a balloon type dialog will appear for 10 seconds informing the user that they need to update their credential.
Notify popup: When a credential is attached to the client the vSEC:CMS User Application will check if the credential needs to be updated. If so a popup type dialog will appear informing the user that they need to update their credential. The dialog will remain open until the user acknowledges the dialog.
Notify popup (always on top): When a credential is attached to the client the vSEC:CMS User Application will check if the credential needs to be updated. If so a popup type dialog will appear which will be always on-top informing the user that they need to update their credential. The dialog will remain open until the user acknowledges the dialog.

Credential Provider - Change PIN Label

This policy setting configures the title for the credential provider when you hit Ctrl + Alt + Del from a logged on Windows session and select the Change a password option and select your attached credential. The label highlighted below will be changed in this case.

It is possible to set a title in english, french or german and then depending on your local regional settings different titles can be shown.

Credential Provider Issue - Configure Icon

This policy setting configures the icon for the credential provider issuance option when you hit Ctrl + Alt + Del from a Windows session. Enter the icon path that you want to use. The icon needs to be available on the client host for the path provided.

The icon should be 192x192 pixels and scalable.

Credential Provider Logon - Configure Icon

This policy setting configures the icon for the credential provider logon option when you hit Ctrl + Alt + Del from a Windows session. Enter the icon path that you want to use. The icon needs to be available on the client host for the path provided. There are 2 options here, one icon that can be used to show physical smart cards connected to the host and one icon that can be used to show virtual smart cards connected to the host.

The icons should be 192x192 pixels and scalable.

Credential Provider - Credential Issuance Title

This policy setting configures the title for the credential provider issuance as seen at the Windows logon screen.

It is possible to set a title in english, french or german and then depending on your local regional settings different titles can be shown.

Credential Provider - Unblock PIN Label

This policy setting configures the title for the credential provider when you hit Ctrl + Alt + Del to log into your Windows session. Select the reader that your credential is attached to and you will see an unblock PIN label.

It is possible to set a title in english, french or german and then depending on your local regional settings different titles can be shown.

Disable Credential Provider

With this policy it is possible to disable the vSEC:CMS Credential Provider (CP). Three options are available if this is enabled:

Both: If this is selected then the issuance and logon options will not be available from the CP;
Issuance: If this is enabled then only the logon options will not be available from the CP;
Logon: If this is enabled then only the issuance option will not be available from the CP.

PIN change notification message

With this policy it is possible to configure the notification message content that is shown in the vSEC:CMS User Application dialog when a credential, that supports PIN change flag, is attached to a client where this flag is set. Depending on what was configured for the GPO Check for card update on insert the user will be presented with options to change the PIN. The settings configured here will only be applicable when the vSEC:CMS User Application is offline and is running in system tray mode.

From the Message option you can select either HTML, Predefined or Text. If Predefined is selected then the hard coded content in the vSEC:CMS User Application will be used. Otherwise you can configure specific content if HTML or Text is selected. Supported languages are English, German and French.

Additionally, vSEC:CMS variables can be used in message content if required. For example, if you used text then you could have below content configured in the Information message:

Your smart card needs your attention. The PIN needs to be changed.

Card Serial Number: ${Csn}

If HTML is used a strict structure needs to be followed as described below. The structure defined here is applicable to all HTML content defined below.

The HTML should be constructed as below:

<html>
<head><meta><style type="text/css">
body {border:0;margin-top: 0px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px;padding: 0;background-color:#ffffff;font-family: Microsoft, sans-serif;font-size: 8px;text-align: left;}
pre {border:0;margin-top: 0px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px;padding: 0;background-color:#ffffff;font-family: Microsoft, sans-serif;font-size: 8px;text-align: left;}
table {border: 0;padding: 1px;}
td {padding: 0 0 0 0;font-family: Microsoft, sans-serif;font-size: 12px;}
</style></meta></head>
<body>
<table>
<tbody>
<tr><td>

</td></tr>
<tr><td><div id="docEnd"/></td></tr>
</tbody>
</table>
</body>
</html>

You should enter the content you wish to set in the section ADD MY CONTENT HERE. For example, if the content should say: My PIN should be changed then the HTML would look like below:

<html>
<head><meta><style type="text/css">
body {border:0;margin-top: 0px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px;padding: 0;background-color:#ffffff;font-family: Microsoft, sans-serif;font-size: 8px;text-align: left;}
pre {border:0;margin-top: 0px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px;padding: 0;background-color:#ffffff;font-family: Microsoft, sans-serif;font-size: 8px;text-align: left;}
table {border: 0;padding: 1px;}
td {padding: 0 0 0 0;font-family: Microsoft, sans-serif;font-size: 12px;}
</style></meta></head>
<body>
<table>
<tbody>
<tr><td>
My PIN should be changed
</td></tr>
<tr><td><div id="docEnd"/></td></tr>
</tbody>
</table>
</body>
</html>

Information message

In this section it is possible to configure the actual message content presented in the dialog, depending on what was configured for the GPO Check for card update on insert.

Fail message

In this section it is possible to configure the actual message content presented in the dialog when an error occurs during the PIN change.

Message for Credential Provider

In this section it is possible to configure the content that will be shown in the dialogs when attempting to perform a PIN change via the CP.

PIN unblock notification message

With this policy it is possible to configure the content that is displayed in the vSEC:CMS User Application dialogs when performing PIN unblock.

From Message option select from the available list. This is a global setting. It is possible to select Predefined, which is hard coded content in the application, or HTML or plain Text format. If HTML or Text are selected then you can configure specific content that will then be shown in the dialogs. The supported languages are English, German or French.

If HTML is used a strict structure needs to be followed as described below. The structure defined here is applicable to all HTML content defined below.

The HTML should be constructed as below:

You should enter the content you wish to set in the section ADD MY CONTENT HERE. For example, if the content should say: My PIN should be unblocked then the HTML would look like below:

<html>
<head><meta><style type="text/css">
body {border:0;margin-top: 0px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px;padding: 0;background-color:#ffffff;font-family: Microsoft, sans-serif;font-size: 8px;text-align: left;}
pre {border:0;margin-top: 0px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px;padding: 0;background-color:#ffffff;font-family: Microsoft, sans-serif;font-size: 8px;text-align: left;}
table {border: 0;padding: 1px;}
td {padding: 0 0 0 0;font-family: Microsoft, sans-serif;font-size: 12px;}
</style></meta></head>
<body>
<table>
<tbody>
<tr><td>
My PIN should be unblocked
</td></tr>
<tr><td><div id="docEnd"/></td></tr>
</tbody>
</table>
</body>
</html>

Information message

In this section it is possible to configure the actual message content presented in the dialog, depending on what was configured for the GPO Check for card update on insert.

Fail message

In this section it is possible to configure the actual message content presented in the dialog when an error occurs during the PIN unblock.

Message for Credential Provider

From here it is possible to configure content that will be shown in the dialogs when used via the Windows Credential Provider (CP).

Online Mode:

This is the dialog shown when attempting a PIN unblock via the CP and the client machine is online.

Offline Mode, Challenge Response supported:

This is the dialog shown when attempting a PIN unblock via the CP and the client machine is offline.

Offline Mode, Challenge Response supported, Qr-code enabled and URL is shown:

This is the dialog shown when attempting a PIN unblock via the CP and the client machine is offline and the QR code functionality is enabled and URL is shown.

Offline Mode, Challenge Response supported, Qr-code enabled and Qr-code is shown (URL is hidden):

This is the dialog shown when attempting a PIN unblock via the CP and the client machine is offline and the QR code functionality is enabled and URL is not shown.

PIN unblock with QR-Code

With this policy it is possible to configure the message content that is displayed beside the Show URL button when QR code is enabled in the vSEC:CMS User Application when performing a PIN unblock via the CP and the client is offline.

From QR-Code Type select one of the available supported code types.

In Unblock PIN URL field you configure the URL which will be shown to the user that needs to be entered manually into a browser to connect to a PIN unblock portal. It is possible to pass in vSEC:CMS variables in the URL. Currently, 2 variables are supported. These are {csn} and {challenge}. For example, you could have a URL like this:

https://unblock.portal.com/unblock?csn={csn}&challenge={challenge}

In QR-Code Data field you configure the data which will be encoded into QR-Code. It is possible to pass in vSEC:CMS variables that can be encoded into the QR code. Currently, 2 variables are supported. These are {csn} and {challenge}. For example:

otpauth://unblock.portal.com/unblock?csn={csn}&challenge={challenge}

PIN unblock QR-Code size

With this policy it is possible to configure the size in pixels of the QR code that is displayed. If this is not enabled the default size is 100 pixels. Select the Enabled option and adjust the size in pixels that is appropriate for your environment.

Help URL's

This policy setting configures URLs which will be opened when clicking the Help menu. URL could be any protocol supported by Windows systems where the vSEC:CMS User Application console is running on.
For example: http://xxx.yyy or file:// </>

Configure background image

With this policy setting it is possible to configure customizable background and home tab images. The images can be of .png or .svg format.

The following options are available:

Background image position: You can configure the background image position from here.
Home image position: You can configure an additional image file position that is only available, by default, from the Home tab. This might typically be a company logo.
Background image path: Here you configure the actual file location on the client for the background image file.
Home image path: Here you configure the actual file location on the client for the home image file.
Enable the Show home image in another view (beside home view) if it is required to show the Home image on each tab of the application.

Note
The pixels for the size of the background image need to be at minimum the same as the display resolution of the client host. For example, if your clients run with a display resolution of 2560x1440, then the background image should have at minimum this size set for the pixel size of the PNG image used.

Also, if the Home image is too large it will override other fields and labels in some tabs.

Enable challenge-response for offline PIN unblock for PIV token

If this policy is enabled it will be possible to use challenge-response mechanism to perform PIN unblock for supported PIV credentials.

CMS Server Protocol

This policy setting configures which protocol should be used when communicating with vSEC:CMS server. The options are:

Prefer Soap: vSEC:CMS User Application will check if the server is available via SOAP protocol. If not, it will try gRPC.
Prefer gRPC: vSEC:CMS User Application will check if the server is available via gRPC protocol. If not, it will try SOAP.
Force Soap: vSEC:CMS User Application will check if the server is available via SOAP protocol. If not, it will fail.
Force gRPC: vSEC:CMS User Application will check if the server is available via gRPC protocol. If not, it will fail.

Server URL (gRPC)

This policy setting configures the URL of the gRPC vSEC:CMS User Application server-side. Enter the full URL in the Server URL field.

For example: http://my-server:port

Server URL (SOAP)

This policy setting configures the URL of the SOAP vSEC:CMS User Application server-side. Enter the full URL in the Server URL field.

For example: http://my-server:port/uss

Configure Smart Card Access

This policy setting configures the credential access type that will be used globally for the vSEC:CMS User Application. The settings are:

Force minidriver usage: The vSEC:CMS User Application will only use the credential minidriver installed on the user's computer if this option is configured. If there is no minidriver available then no operations will be possible with the credential.
Force native access: The vSEC:CMS User Application will only use the native access to the credential if this option is configured. If native access to the credential is not supported then no operations will be possible with the credential.
Use minidriver if possible: The vSEC:CMS User Application will attempt to use the credential minidriver installed on the user's computer if this option is configured. If there is no minidriver installed then the vSEC:CMS User Application will attempt to use native access. If native access is not supported for the credential then no operations will be possible with the credential.
Use native access if possible: The vSEC:CMS User Application will attempt to use the native access to the credential if this option is configured. If native access to the credential is not supported then the vSEC:CMS User Application will attempt to use the minidriver interface. If there is no minidriver available then no operations will be possible with the credential.

Configure Connection Behavior in System Tray Mode

This policy allows you to configure the behavior around how the clients will connect when running in system tray mode. In large deployments, when users log on at the same time, a lot of traffic will be sent to the server-side which can impact system performance. From 6.10 version this policy can be used to randomize when the clients will connect to the backend to check if any updates are awaiting for them on the server. The following options are available:

Connect at application start (no delay): If this is set then the vSEC:CMS User application will connect to the backend immediately once the user logs on.
Connect when the user is starting to use the application: If this is set then the vSEC:CMS User application will connect only when the vSEC:CMS User application is opened from the system tray icon Show User Application.
Connect at any (random) time within 30 minutes: If this is set then the vSEC:CMS User application will connect to the backend randomly within 30 minutes from when the user logs onto their workstation.
Connect at any (random) time within 1h: If this is set then the vSEC:CMS User application will connect to the backend randomly within 1 hour from when the user logs onto their workstation.
Connect at any (random) time within 2h: If this is set then the vSEC:CMS User application will connect to the backend randomly within 2 hours from when the user logs onto their workstation.