Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 5 subscribers
  • Views 5952 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to enable LocalSelfHelp Recovery for none Windows Accounts?

arneHAC

Hi,

I am working for a large Company, an ISP for many customers, and one of our customers have requested to get Sophos SafeGuard Easy 6.0.

The customer requests that I find a solution to get his end users to log on to their notebooks with a device account, which is not a windows domain AD user and not a local user account as well. Second the direct and automated login at windows is disabled, so the user has to enter his credentials within the Windows AD Login window. (login on with the windows in a domain)

So we give the end users of each notebook the password for the device account logon with Sophos SGE, having to create 40 POA user accounts and 40 user notebook device groups.

Now, that is doable, but not fun at all. Well, customer is king!

Now, the issue starts with the need of the LocalSelfHelp function to recover when the end user has misstyped his password gtoo many times and the device is logged. Using only device bound accounts to access sophos before hand of the windows logon, prevents the use of the LocalSelfHelp function, right? That's what I found. As long as this POA account is not a windows AD account, no LocalSelfHelp recovery with questions/answere process can be used, so the workload of the HelpDesk hotline can be decreased.

Second issue is that the end user still can enter his windows AD credentials in the first step, using his username and password for the domain in both logon steps, sophos and windows. I cannot find any settings with the policy sets that would prevent that.

So, how can I nail the needs of our customer to have two separate logon steps and have it realy easy for the end user without any possibilities to play around like trying to login with his domain credentials?

Cu, Arne

:28777


This thread was automatically locked due to age.
  • 0

    Hi arneHAC,

    this will be a tough scenario, when using SGE 6.0. The reason for this is the following:


    You have to create all POA Groups and Accounts manually + as there is no Local Self Help available for <POA> Accounts, if the users would forget the password, they would need to call the helpdesk, asking for a Challenge/Response to login to the Operating System.

    In addition to that, as the user has forgotten the password for the <POA> account, the <POA> account must be replaced: In SafeGuard Enterprise, you would need to change the account information in the Management Center and sync up the client, in SafeGuard Easy, you have to change the account information and - as there is no client server connection in Safeguard Easy - put the new account into a Client Configuration package and update the client with the new configuration package.

    In this case, I would recommend to use SafeGuard Enterprise. In SafeGuard Enterprise, you also have the possibility to create "Service Accounts" and prevent users from becoming SGN Users. You could for example exclude all users from a certain domain to activate the POA and prevent the users to write their Windows accounts into the POA.

    side note: POA Groups and Accounts can be also be semi-automatically created using the API.

    Regards,

    ChrisD

    :28839
  • 0

    You might also want to check the latest post in /search?q= 24283

    Cheers,

    Chris

    :28843
Unfiltered HTML