Copyright: RSA ACE/Agent 5.5 for Windows. Copyright © 2001, RSA Security Inc. All Rights Reserved.


Contents

Introduction

RSA ACE/Agent Overview

Configuring Local Access Authentication

Configuring Remote Access Authentication


Introduction

Audience

Additional Documentation

Getting Support and Service


RSA ACE/Agent Overview

Protecting Windows Resources

The RSA ACE/Agent Control Panel

Testing Authentication Overview


Configuring Local Access Authentication

Enabling Local Access Authentication

Using the Reserve Password


Configuring Remote Access Authentication

Enabling Remote Access Authentication


Introduction to Dialogs


The RSA ACE/Agent control panel lets you configure Local and Remote access authentication options.

Marked checkboxes on a properties page indicate that an option is enabled. Any changes you make in the settings do not take effect until you restart Windows. When you close a panel after making changes, you are given the choice of restarting immediately or waiting.


Check this option if you do not want your remote users to see the DOMAIN: prompt during logon. If you check this option, the Default Domain will be used.

At logon, the user will see only the USERNAME and PASSCODE prompts. After the user enters a valid PASSCODE, the user is authenticated to the default domain.


Enter the name of the domain to which the remote users belong.


Closes the open dialog and saves any changes you have made.


Closes the open dialog without saving any changes you have made.


Click to verify that the RSA ACE/Agent software has been correctly implemented. You do not need to restart Windows to test authentication.


Indicates if RSA ACE/Server PASSCODE authentication is available to be activated on local access accounts. The default status is Local: Security features installed. To change this option, you must re-install the RSA ACE/Agent 5.5 for Windows. If RSA ACE/Server authentication is not available, the Local tab does not appear in the RSA ACE/Agent control panel.


Indicates if RSA ACE/Server PASSCODE authentication can be activated on remote access accounts. The default status is Remote: Security features installed. To change this option, you must re-install the RSA ACE/Agent 5.5 for Windows. If RSA ACE/Server authentication is not available, the Remote tab does not appear in the RSA ACE/Agent control panel.


Check this option if you want your remote users to see a custom logon greeting when prompted for their usernames and PASSCODEs. Type your custom greeting in the scrollable box below the Enable Logon Greeting checkbox.


This option is available only if you have enabled the Challenge All Users option.

Check this option if you do not want the Windows Application Log to resolve usernames when users log in.

In large Windows Domains, checking this option helps to reduce the size of the Event Log files. However, the RSA ACE/Agent records the username as N/A in the Windows Application Event Log, which will prevent you from filtering events by user.


Type your custom logon greeting in this space. The greeting can be up to 1000 characters.


Check this option to require local users to re-authenticate with their RSA SecurID token every time their desktop screen saver activates. This option only takes effect if

•	screen saver password protection is available on the Windows machine

•	password protection has been enabled through the Display control panel

1.


In the Password field, type a domain secret password that has at least six characters.

2.	Re-type the new password in the Confirm field.

3.	Click OK.


Type the new domain secret password to unlock the file.


Enter the correct name for this computer in the DNS Configuration dialog box.

1.	In the Windows control panel, double-click the Network icon.

2.	In the Network dialog box, click the Protocol tab. In the Network Protocols box, select TCP/IP protocol and click Properties.

3.	In the Microsoft TCP/IP Properties dialog box, click the DNS tab. In the Domain box, enter the name of the computer's domain. For example, rsasecurity.com.

4.	Click OK, then click OK to exit to the control panel.


Click to create a new domain secret. The domain secret is valid on multiple servers in a domain.


Click to copy a domain secret to a diskette.

Store the diskette in a secure place or destroy it to ensure that the domain secret is never compromised.

RSA Security recommends that you do NOT store the domain secret file in a network directory where an unauthorized user might gain access to it.


Click to open the Manage Domain Secret dialog box, where you can generate, export, or import a domain secret.


When this option is selected, users who enter their usernames incorrectly during authentication see an Invalid Username screen message. If this option is not selected, the users see an Access Denied message with no further explanation.


Select the number of hours for expiration by clicking the up and down arrows.


Enter the reserve password. The password is case sensitive and must include

•	At least one number.

•	At least one letter.

•	At least 6 but no more than 12 characters.


Enter the reserve password again to confirm it.


Click this button to select the RSA SecurID challenge mode for this service. The following challenge modes are available:

OFF. No users are challenged for their RSA SecurID PASSSCODEs.

Users in. Users who are members of the selected group are challenged for their PASSCODEs.

Note:	This option is not available if you are using RSA Security EAP.

All users. Every user who attempts to log in is challenged for a PASSCODE.

All users except. Users who are members of the selected group are not challenged for PASSCODEs.


Click Select to specify which group should or should not be challenged for their RSA SecurID PASSCODEs. You cannot type directly into this field.


Opens the Select User Group dialog box.


Select the Domain or computer that hosts the group you want to select.


Lists the groups of the selected Domain or computer.


To select the number of hours that must elapse before expiration, click the up and down arrows.


Restarting Windows

To enforce the changes you have made, you must restart Windows.


Sdconf.rec File is Missing

To use the RSA ACE/Agent Remote features, you must have a valid copy of the sdconf.rec file installed on the Agent Host computer. Your RSA ACE/Server administrator must make this file available to you.

You must copy the sdconf.rec file to the %SYSTEMROOT%\system32 directory on the Agent Host.

For more information about system requirements, see the RSA ACE/Agent 5.5 for Windows Installation and Administration Guide.


Using the Select Group Dialog Box

To designate a group for RSA SecurID authentication:

1.	Select the workgroup or domain name from the List groups in box.

2.	Click the name of the group whose users should be challenged for their RSA SecurID PASSCODEs when they attempt to access the protected service.

3.	Click Select.


If you check this box, trace messages are recorded directly into a console window, where you can scroll through the messages.


Checking this box enables the tracing of flow control statements. Do not enable tracing unless you must do so to help your RSA Security Technical Support representative to detect and resolve a problem.


If you check this box, trace messages are logged in the system debugger.


Lists the URLs of domains that are participating in authentication across multiple domains.


Click to open the Manipulate Domain URL dialog box, where you can edit the URL of a domain that is participating in authentication across multiple domains.


Check this box to enable the tracing of entry points. Do not enable tracing unless you must do so to help your RSA Security Technical Support representative to detect and resolve a problem.


If you check this box, trace messages are logged in the Windows Event Viewer log.


Select a setting that represents how much filtering of event messages will occur in the Windows Event Viewer's Application log:

Default. Allows all event messages to be logged.

Low. Prevents event messages from being logged that pertain to successful PASSCODE authentications, required or disabled PASSCODE challenging, and Web access authentication cookie rejections.

Medium. In addition to preventing the logging of all event messages in the Low category, this setting prevents the logging of event messages pertaining to New PIN mode and the Next Tokencode prompt.

High. In addition to preventing the logging of all event messages in the Low and Medium categories, this setting prevents the logging of Service thread terminated, exiting messages.

You cannot use this setting to prevent error messages from being logged. In addition, this setting has no effect on the logging of trace messages in the Windows Event Viewer log.


Check this box to enable the tracing of exit points. Do not enable tracing unless you must do so to help your RSA Security Technical Support representative to detect and resolve a problem.


Enter or select a number representing the number of seconds that must elapse before the initial Remote prompt times out.

The minimum Initial Timeout value is 1 second and the maximum is 180 seconds. The default value is 10 seconds.


Enter or select a number representing the number of seconds that must elapse before the initial Remote prompt times out.

The minimum Initial Timeout value is 1 second and the maximum is 180 seconds. The default value is 10 seconds.


Enter or select a number representing the number of seconds that must elapse before the initial Remote prompt times out.

The minimum Initial Timeout value is 1 second and the maximum is 180 seconds. The default value is 10 seconds.


The IP address you enter in this box becomes the primary IP address used by the Agent for encrypted communication with the RSA ACE/Server. Use this setting only if the Agent is installed on a computer that is configured with multiple IP addresses.


If you check this box, trace messages are logged in the %SYSTEMROOT%\aceclient.log file.


Enter or select a number representing the number of seconds that must elapse before all subsequent Remote prompts time out.

The minimum Regular Timeout value is 5 seconds and the maximum is 180 seconds. The default value is 180 seconds.


Enter or select a number representing the number of seconds that must elapse before all subsequent Remote prompts time out.

The minimum Regular Timeout value is 5 seconds and the maximum is 180 seconds. The default value is 180 seconds.


Check this box to enable the tracing of regular messages. Do not enable tracing unless you must do so to help your RSA Security Technical Support representative to detect and resolve a problem.


Enter or select a number representing the number of seconds that must elapse before all subsequent Remote prompts time out.

The minimum Regular Timeout value is 5 seconds and the maximum is 180 seconds. The default value is 180 seconds.


Enter or select a number representing the number of seconds that must elapse before all subsequent Remote prompts time out.

The minimum Regular Timeout value is 5 seconds and the maximum is 180 seconds. The default value is 180 seconds.


Click to immediately remove the selected domain URL from the Enable Multiple Domain Support list. You will not be prompted to confirm the removal of the URL.


Enter or select a number representing the number of seconds that must elapse before the initial Remote prompt times out.

The minimum Initial Timeout value is 1 second and the maximum is 180 seconds. The default value is 10 seconds.


Enter or select a number representing the number of seconds that must elapse before all subsequent Remote prompts time out.

The minimum Regular Timeout value is 5 seconds and the maximum is 180 seconds. The default value is 180 seconds.


Enter the name of the domain to which the remote users belong.


Enter the reserve password again to confirm it.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


No additional help available for this topic.


sdconf.rec file is missing:

To use the RSA ACE/Agent Local features, you must have a valid copy of the sdconf.rec file installed on the Agent Host computer. Your RSA ACE/Server administrator must make this file available to you.

You must copy the sdconf.rec file to the %SYSTEMROOT%\system32 directory on the Agent Host.


SD Test

 Before performing a test authentication, make sure that the RSA ACE/Agent 5.5 for Windows has been properly registered as an Agent Host in the RSA ACE/Server database, and that a network connection between the Server and the Agent has been established. You can use the RSA SecurID Authentication Information window to view information about the Server that is processing authentication requests.

To view RSA ACE/Server authentication and status information:

1.	In the RSA ACE/Agent control panel, click the Main tab, then click Test Authentication with RSA ACE/Server.

The RSA SecurID Authentication Information dialog box opens, and the following information is displayed:

Configuration Version: The version of the sdconf.rec file that is in use. For RSA ACE/Server 5.0 or later, this number is 12.

DES Enabled: If your configuration environment supports legacy protocols, "YES" is displayed.

Client Retries: The number of times the Agent sends authentication data to the Server before a time out occurs.

Client Timeout: The amount of time (in seconds) that the Agent waits before re-sending authentication data to the Server.

Server Release: The version number of the Server.

Communication: The version of protocol being used for communication between the Server and the Agent.

If you have questions about any of the information that is displayed, consult your RSA ACE/Server administrator.

2.	Click RSA ACE/Server Status.

The Server Status window opens.

The Select Server panel allows you to choose the RSA ACE/Server with which to perform a test authentication. If an alias IP address has been assigned to the Server you select, it is shown in the Server Alias Addresses panel. nay

The Server information panel indicates the type of Server that you have selected from the list in the Select Server panel. The IP address shown is the IP address that will be used to communicate with the Agent. This address could be the actual IP address of the Server you have selected, or it could also be an alias IP address assigned to the Server.

The Server Usage panel indicates any of the following conditions.

•	Available for Authentications: the selected Server will be used for authentications.

•	Unused: the selected Server will not be used for authentications.

•	For Failover only: the selected Server has been reserved for failover use only.

•	Default Server During initial requests: the selected server will be used, since no other server is available.


Check this box if you want the Agent to prompt for the user name first, and then prompt for the PASSCODE only after the user enters the user name.


Check this option if you have selected Challenge All Users. Creating a reserve password enables users to log in to their machines if there is an interruption in network service.

The reserve password should be changed after each use. If you enable the Reserve Password option and give the reserve password to a user, RSA Security recommends that you change it as soon as the user logs in to the system.


Enter the reserve password. The password is case sensitive and must include

•	at least one number

•	at least one letter

•	at least 6 but no more than 12 characters


Check this option to enable post-dial terminal based authentication.


Check this option if you do not want your remote users to see the DOMAIN: prompt during logon. If you check this option, the Default Domain will be used.

At logon, the user will see only the USERNAME and PASSCODE prompts. After the user enters a valid PASSCODE, the user is authenticated to the default domain.


Clears the node secret from the Agent Host. Use this feature if the node secret on the Agent Host computer does not match the node secret in the RSA ACE/Server database. If you clear the node secret, you must inform the RSA ACE/Server administrator to disable the Sent Node Secret setting specified for the Agent Host in the RSA ACE/Server database.


Check this option to enable RSA Security EAP. In order to use this option, you must properly configure your remote access server, or your Microsoft Internet Authentication Server.


Check this option to send a user’s Windows domain name as part of the username. You should verify that the RSA ACE/Server database records include the user’s Windows domain name as part of the username (for example, DOMAIN\jsmith instead of simply jsmith).


A

access token

A Windows access token is created when a user logs in to the system. The token contains information such as the Windows security ID for the user account and all groups of which the user is a member, as well as privileges, token type (primary or impersonation), and other information. An access token is used in all attempts by the user to access the securable objects in the system.

B

No entries.

C

clntchk

Obsolete utility. See sdtest.


D

dial in

To connect to a computer over a telephone line only, not by using ISDN or X.25 lines.

domain

A domain is a name (for example, rsasecurity.com) with which name server records are associated that describe subdomains or hosts. In this context, "domain" does not refer to a Windows domain.

E

Event Viewer logs

The Event Viewer is the tool you can use to monitor events in your Windows system. Use the Event Viewer to view, manage, and archive the system, security, and application event records (logs). The event-logging service starts automatically when you run Windows.

F

No entries.


G

GINA

The local Graphical Identification and Authentication interface on a Windows machine.

H

No entries.

I

No entries.


L
J

No entries.

K

No entries.

L

login process

The component that receives the login request from a user and invokes other security services to authenticate and log the user in to the system. These include both the local login process and the remote login process.

LSA

Local Security Authority, a Windows component responsible for enforcing the system security policy. LSA provides high-level services for user authentication. It dynamically selects and invokes a low-level authentication package as requested by the login process. After the user is successfully authenticated by this package, LSA generates an access token. LSA is also responsible for execution of the audit policy and logging of audit messages.


M

No entries.

N

Next Tokencode mode

A series of incorrect tokencodes during authentication puts a token into this mode. While in this mode, after a correct code is finally entered, the user is prompted for another tokencode before being allowed access.

New PIN mode

When a user's token is in this mode, the user is required to have a new PIN in order to gain access.

node secret

A string of pseudorandom data known only to the Agent Host and the RSA ACE/Server. The node secret is combined with other data to encrypt Agent Host/Server communications.

O

No entries.


P

PASSCODE

The user's PIN plus the current tokencode displayed on the RSA SecurID token. With a PINPAD card, the user enters his or her PIN directly into the token, and the token itself generates the PASSCODE.

PIN

The user's Personal Identification Number.

protocol

An agreed upon convention for inter-computer communications across a network.

R

RAS

Remote Access Service. A Windows service that provides remote networking for telecommuters and mobile workers. Users can dial in to a RAS host to access their networks for services such as file and printer sharing and electronic mail.

RAS service is available to remote computers running Windows 2000, Windows XP, and Windows 98.

registry

The Windows registry is a database repository for information about a computer's configuration. It is organized in a hierarchical structure, and is comprised of subtrees and their keys, hives, and value entries.

RSA ACE/Agent for Windows

The RSA Security product that protects a Windows host and specific services running on that host. Although the Windows host may be a server with its own clients, to the RSA ACE/Server it is an Agent Host that is requesting authentication service.

RSA ACE/Agent Host

A computer that is protected by the RSA ACE/Agent software to prevent unauthorized access. Designated users of this computer must provide a valid RSA SecurID PASSCODE in order to log in or access services.

RSA ACE/Server

The RSA Security authentication management software running on a TCP/IP-networked host, providing authentication, administration, and audit-trail services.

You must have the RSA ACE/Server software running on your network to use the Agent for RSA SecurID authentication.

RSA SecurID token

A hardware device or software application that generates an RSA SecurID tokencode. A time-based token can be an RSA SecurID PINPAD Card, an RSA SecurID Standard Card, an RSA SecurID Key Fob, or an RSA SecurID Software Token.


S

%SYSTEMROOT%

The root directory of a Windows machine. This directory contains critical data used by the operating system. This directory is usually named windows or winnt.

sdtest

The utility that displays the contents of the sdconf.rec file on an RSA ACE/Agent Host and lets you test authentication between the RSA ACE/Agent and the RSA ACE/Server.

Security Accounts Manager (SAM)

The database on a Windows computer where user information (usernames, encrypted passwords, file permissions) is stored.

sdconf.rec

The configuration file that must be copied from the RSA ACE/Server Primary server to its clients (RSA ACE/Agent Hosts).

sdlog

The encrypted audit trail database for RSA ACE/Server v 2.X or later. It is more detailed than the Windows Event Details log.

security host

The Microsoft term for a third-party authentication program like RSA ACE/Agent 5.5 for Windows.

SDGINA

The RSA Security implementation of the local Graphical Identification and Authentication (GINA) interface on a Windows computer. Also referred to as Local access authentication.

SDRAS

The RSA Security implementation of the Remote Access Service (RAS) on Windows. Also referred to as Remote access authentication.

station

A dial-in client of a Windows workstation. A station can be a remote PC running Windows 2000, Windows XP, or Windows 98 RSA SecurID prompts are displayed if the workstation is protected by RSA SecurID.

T

tokencode

The code displayed by an RSA SecurID token. Together, the tokencode and the PIN comprise the RSA SecurID two-factor authentication.

two-factor authentication

The authentication method used by the RSA ACE/Server system. The user must enter a secret, memorized personal identification number (PIN) plus the current tokencode generated by the user's assigned RSA SecurID token. With a PINPAD token, the user enters his or her PIN directly into the token, and then the token generates the PASSCODE.

U

UNC

Universal Naming Convention name. A full Windows name of a resource on a network. It conforms to the \\server\sharename syntax, where server is the server computer's DNS name and sharename is the name of the shared resource.


W

No entries.

X

No entries.

Y

No entries.

Z

No entries.


Enabling Local Access Authentication

The Local properties sheet in the RSA ACE/Agent control panel controls local access security. If Local access authentication is enabled in the RSA ACE/Agent control panel on the Windows machine, the message in the Component Status area of the Main properties sheet displays Local: Security Features Installed.

Local access authentication is available for both Windows 2000 and Windows XP. You can configure Local access authentication to challenge the following users for their RSA SecurID PASSCODEs:

•	All users

•	Users who are members of an administrator-designated group

•	Users who are not members of an administrator-designated group

To enable Local access authentication:

1.	In the RSA ACE/Agent control panel, click the Local tab.

The Local properties sheet is displayed.

2.	Under Challenge, select which users you want to challenge for their RSA SecurID PASSCODEs.

Users to challenge	Steps to complete
No users	Click Off on the Challenge list.
All users who log in locally	Click All users on the Challenge list.
A group of users who log in  locally	Click Users in on the Challenge list, and then select the local or domain group that you want to challenge.
All users who log in locally,  except users in a certain group	Click All users except on the Challenge list, and then select the local or domain group that you do not want to challenge.
3.	If your RSA ACE/Server database records include the user's Windows domain name as part of the username (for example, DOMAIN\jsmith instead of simply jsmith), check Send Domain Name and User Name to RSA ACE/Server.

4.	To force local users to re-authenticate every time their desktop screen savers activate, check Enable Screen Saver Security. This option takes effect only if screen saver password authentication is available on the Windows machine and if password authentication has been enabled for the user account through the Desktop control panel.

5.	If you selected All Users on the Challenge list, the Reserve Password feature is automatically selected to prevent you from enabling the challenge All Users feature without setting a reserve password.

6.	If you enable the challenge All Users feature without setting a reserve password and an interruption occurs in your RSA ACE/Server authentication service, all users will be locked out of the protected machine. For this reason, always set a reserve password when enabling the challenge All Users feature. See Using the Reserve Password, for more information.

7.	Click OK.

8.	Restart the computer for the changes to take effect.


Using the Reserve Password

The reserve password feature is supported only with Local access authentication. Remote-access users must successfully use PASSCODE authentication if their accounts are configured to require it. However, administrators of RAS accounts that are protected by RSA SecurID should read this section to understand the security issues.

If there is a network failure or some other problem that prevents the Windows machine from communicating with the RSA ACE/Server, RSA SecurID users will not get access to the Windows machine. This could present a problem if you plan to challenge all users for their PASSCODEs. You can configure your system to avoid this problem in any of the following ways:

•	Set up one user account with administrator privileges that is not protected by a PASSCODE. Doing so is not a good idea because it creates a security hole: you now have an account with full access but which has less protection than accounts with fewer privileges.

•	Physically secure the machine running as the Domain Controller (that is, put it in a locked office for which only the network administrator has the key) and disable network logins to this machine. In the event of a problem, this machine could be used to disable the requirement for PASSCODE authentication.

•	Use the Reserve Password feature of RSA ACE/Agent 5.5 for Windows. If you have enabled the reserve password and the Windows system is unable to communicate with the RSA ACE/Server at the time of authentication, instead of displaying a message that the Server is unreachable, the system displays a prompt to enter a reserve password.

The reserve password is the same for all users. If you enable the Reserve Password option and reveal the password to a user, change the reserve password as soon as the user has logged on to the protected machine. RSA Security recommends changing the reserve password after each use.

The reserve password is encrypted and stored in the registry, but you can set or clear it through the RSA ACE/Agent control panel. No one can modify the reserve password using Windows system tools for manipulating user passwords.

Related Topics

Enabling the Reserve Password

Clearing the Reserve Password


Enabling the Reserve Password

To enable the reserve password:

1.	In the RSA ACE/Agent control panel, click the Local tab.

2.	If it is not already checked, check Enable Screen Saver Security.

3.	Click Enable Reserve Password.

4.	Enter the reserve password you want to use in the Password field.

The password must be between 6 and 12 characters and must contain at least one digit and one letter. Reserve passwords are case-sensitive.

5.	Press TAB, and enter the password again in the Confirm field.

6.	Click Apply.

7.	To test that the Reserve Password option is enabled, disconnect the network connection to the RSA ACE/Agent computer, log out, and log back in. You will be prompted to enter the reserve password.


Clearing the Reserve Password

To clear the reserve password:

1.	In the RSA ACE/Agent control panel, click the Local tab.

2.	Clear Enable Reserve Password.

3.	Click Apply.


Protecting Windows Resources

An Agent Host runs RSA ACE/Agent software and connects over a TCP/IP network to a computer running RSA ACE/Server software. The RSA ACE/Server software provides RSA Agent Hosts with authentication services. The RSA ACE/Agent 5.5 for Windows, when used with the RSA ACE/Server authentication management software and time-based RSA SecurID tokens, provides two-factor authentication to protect Windows computers and services.

The RSA ACE/Agent 5.5 for Windows software sets RSA SecurID protection for the following Windows services:

•	Local log in to the desktop. This feature set is called Local access authentication and is described in Local Access Authentication Overview.

•	Remote dial-up login to the machine through the Remote Access Service (RAS). This feature set is called Remote access authentication and is described in
Remote Access Authentication Overview.


Remote Access Authentication Overview

The Remote access authentication component of RSA ACE/Agent 5.5 for Windows authenticates RSA SecurID users who dial in to the Remote Access Service (RAS). After users enter dial-up account credentials at the dial-up terminal window, the Agent prompts users to enter a valid RSA SecurID PASSCODE. Authorized RSA SecurID users gain access easily, but unauthorized persons are denied access to the RAS gateway.

You can choose to challenge all users who dial in to the computer remotely, or you can designate a specific user group to challenge.

ISDN Connections

At this time, RSA ACE/Agent 5.5 for Windows does not directly support ISDN connections. There are vendor-specific solutions, however, that might apply to your ISDN environment. These solutions are described in an RSA Security white paper entitled RSA SecurID Ready ISDN Solutions. You can download the paper from RSA Security SecurCare Online.
(www.rsasecurity.com/support/securecare)


Local Access Authentication Overview

The Local access authentication component of RSA ACE/Agent 5.5 for Windows authenticates RSA SecurID users at the local login prompt. After the user enters Windows account credentials, the user is prompted to enter a valid RSA SecurID PASSCODE. Authorized RSA SecurID users gain access easily, but unauthorized persons are denied access to the machine.

You can choose to challenge all the local users of the computer, or you can designate a specific user group to challenge.


The RSA ACE/Agent Control Panel

The RSA ACE/Agent 5.5 for Windows control panel contains all the tools you need to configure Local access or Remote access authentication options. Click the labeled tabs in the RSA ACE/Agent control panel to view the properties sheet for each available feature set.

Note: 	If you modify security settings, you will be prompted to restart Windows for the new settings to take effect.

To use the RSA ACE/Agent control panel:

1.	Log on to the computer as an administrator.

2.	Click Start > Settings > Control Panel.

3.	Double-click the RSA ACE/Agent icon.

The RSA ACE/Agent control panel opens.

4.	Click the Main tab.

The Component Status box displays the available feature sets.

If you expect Local access or Remote access authentication features to be available but the corresponding tab is missing, make sure you have the correct services installed and enabled on the computer.

5.	Click the appropriate tab to view settings.

6.	Specify which users must be challenged.

7.	Configure the other options for each feature set.

8.	To test that RSA ACE/Agent authentication has been correctly implemented without restarting Windows, see Testing Authentication Overview


Selecting Which Users and Groups Will Be Challenged by RSA SecurID

The RSA ACE/Agent software can use Windows groups to control access to a computer or to resources on the computer. These groups can be the default Windows groups (for example, Domain Users or Dial-in Users), or groups that you create yourself in the Windows Computer Management Interface.

For maximum security, the product can be configured to challenge all users who access resources that are protected by RSA ACE/Agent software.

For example, if you want maximum local login security, open the Local properties sheet of the RSA ACE/Agent control panel and select All users from the Challenge list. However, if you want to challenge all users except local administrators, select All users except from the Challenge list, and then select the Administrators group.

The following table explains how to enable the RSA ACE/Agent authentication using groups:

Users to challenge	Steps to complete
All users who log on locally	Open the Local properties sheet, and click All users from the Challenge list.
A group of users who log on locally	Open the Local properties sheet, click Users in from the Challenge list, and then select the local or domain group that you want to be RSA SecurID-challenged.
All users who log on locally, except users in a certain group	Open the Local properties sheet, click All users except from the Challenge list, and then select the local or domain group that you do not want to be RSA SecurID-challenged.
All users who dial in to the computer	Open the Remote properties sheet, and click All users from the Challenge list.
A group of users who dial in to the computer	Open the Remote properties sheet, click Users in from the Challenge list, and then select the local or domain group that you want to be RSA SecurID-challenged.
All users who dial in to the computer, except users in a certain group	Open the Remote properties sheet, click All users except from the Challenge list, and then select the local or domain group that you do not want to be RSA SecurID-challenged.


Testing Authentication Overview

You can test that RSA ACE/Agent authentication has been correctly implemented before you deploy tokens to users. The test described in this section will help you to verify that the sdconf.rec file you installed on the Agent Host points to the appropriate RSA ACE/Server database, that the host has a valid node secret file, and that your system is configured properly for authentication.

Important:	If you have installed prior versions of the RSA ACE/Agent software on the host machine, you must remove all previous versions of the node secret file before attempting to authenticate for the first time.

Testing will go more smoothly if you use a token with a PIN that is already registered in the RSA ACE/Server database. If you test authentication with a token in New PIN mode however, you will go through the actual New PIN procedure, and the PIN will be registered in the RSA ACE/Server database.

If you are new to RSA SecurID authentication and need assistance with New PIN mode, there are specific instructions for each token type that are provided as part of the RSA ACE/Server documentation. Contact your RSA ACE/Server administrator to get a copy of the instruction that corresponds to your token type. If you are using RSA SecurID Software Token 2.0 tokens, refer to the authentication instructions in the RSA SecurID Software Token  2.0 User's Guide.

If the token you are testing has a PIN, you must know the PIN.

Note:	Because authentication is being tested, not confirmed, it is not necessary for the owner of the token to be a member of an RSA SecurID local group.

Related Topics:

Testing Authentication if the Token Already Has a PIN

Testing Authentication if the Token Does Not Have a PIN


Testing Authentication if the Token Already Has a PIN

To test authentication:

1.	Click Start > Run.

The Run dialog box opens.

2.	In the Open field, enter sdtest, then click OK.

The RSA SecurID Authentication Information dialog box opens.

3.	Click RSA ACE/Server Test Directly.

The RSA SecurID Authentication dialog box opens.

4.	On the Choose Token list, select SecurID Card.

5.	In the Enter Username field, enter the username of the registered RSA SecurID user who is assigned to the RSA SecurID token you are using.

6.	In the Enter PASSCODE field, enter the current PASSCODE that is generated by the RSA SecurID token:

•	If you have an RSA SecurID standard card or an RSA SecurID key fob, enter the PIN followed by the tokencode that is displayed on the token.

•	If you have an RSA SecurID PINPad, enter the PIN into the card, press the diamond (♦) near the bottom of the card, and then enter the PASSCODE that displays on the token.

7.	Click OK.

If everything is properly implemented and configured, the system displays a message that the user was authenticated successfully.

If the system displays an Access Denied message, repeat this procedure.

If you repeat the process and are still denied access, follow the instructions for testing authentication using an RSA SecurID token that does not have a PIN. If the system displays an ACE/Server not responding message or you are still unable to authenticate, confer with your RSA ACE/Server administrator.

Related Topics:

Authentication Error Messages


Testing Authentication if the Token Does Not Have a PIN

Before you attempt to test authentication, make sure you read and/or print the authentication instructions for your token type. The instructions are in Microsoft Word format and were copied into the %SYSTEMROOT%\system32\aceclnt directory during installation.

To test authentication on a token that does not have a PIN:

1.	Click Start > Run.

The Run dialog box opens.

2.	In the Open field, enter sdtest, then click OK.

The RSA SecurID Authentication Information dialog box opens.

3.	Click RSA ACE/Server Test Directly.

The RSA SecurID Authentication dialog box opens.

4.	On the Choose Token list, select SecurID Card.

5.	In the Enter Username field, enter the username of a registered SecurID user who is assigned to the RSA SecurID token you are using to test authentication.

6.	In the Enter PASSCODE field, enter the current PASSCODE that is generated by your RSA SecurID token, then click OK.

The New PIN dialog box opens.

7.	In the New PIN dialog box, select the option to create your own PIN. Enter and confirm your new PIN in the provided fields, and click OK.

The RSA SecurID Authentication dialog box opens.

8.	In the Enter Username box, enter the username of the registered RSA SecurID user who has been assigned to the RSA SecurID token you are using.

9.	In the Enter PASSCODE box, enter the current PASSCODE that is generated by your RSA SecurID token:

•	If you have an RSA SecurID standard card or an RSA SecurID key fob, enter the tokencode that currently displays on the token.

•	If you have an RSA SecurID PINPad, enter the PIN into the card, press the diamond (♦) near the bottom of the card, and then enter the PASSCODE that displays on the token.

10.	Click OK.

If everything is properly implemented and configured, the system displays a message that the user must create or be assigned a new PIN.

If the system displays an Access denied message, repeat the process. If you see other messages, refer to the RSA ACE/Server documentation for more information. If you are still unable to authenticate, confer with your RSA ACE/Server administrator.

Related Topics:

Authentication Error Messages


Audience

This online Help is intended for administrators of Microsoft Windows computers that are set up as security host clients (RSA ACE/Agents) within the RSA ACE/Server authentication system.

The guide explains how to configure, use, and troubleshoot the RSA ACE/Agent 5.5 for Windows software to protect local logons, and remote access. Administrators who read this guide should have working knowledge of Microsoft Windows 2000, Windows XP, Windows 98, and Microsoft Internet Authentication Server.


Additional Documentation

Adobe Acrobat versions of the RSA ACE/Agent 5.5 for Windows Installation and Administration Guide, and the RSA ACE/Agent 5.5 for Windows ReadMe are included in the RSA ACE/Agent 5.5 for Windows zip file from the RSA Security website. These PDF files (WinAgentAdmin.pdf and readme.pdf) are copied to %SYSTEMROOT%\system32\aceclnt\ directory when you install the Agent software.

You must have Acrobat Reader 3.0 or later installed to view and print the PDF files. Acrobat Reader software is available free-of-charge at www.adobe.com.


Getting Support and Service

RSA SecurCare® Online	www.rsasecurity.com/support/securcare

Technical Support Information	www.rsasecurity.com/support

Related Topics

Before You Call for Technical Support


Before You Call for Technical Support

Important: There is no provision for technical support during the warranty period unless a valid Software Service Contract is in force.

Make sure that you have direct access to the computer running the RSA ACE/Server Primary software.

Please have the following information available when you call:

•	Your RSA Security Customer/License ID. You can find this number on the license distribution medium or by running the Configuration Management application on the Windows platform.

•	Your RSA ACE/Server and RSA ACE/Agent version numbers.

•	The name and version of the operating system under which the problem occurs.


Enabling Remote Access Authentication

Remote access authentication protects access to corporate network resources through the Windows Remote Access Service (RAS). The Remote properties sheet of the RSA ACE/Agent control panel controls the security of RAS accounts. If the Remote access component of the RSA ACE/Agent 5.5 for Windows is installed, the message Remote: Security Features Installed displays in the Components area of the control panel’s Main properties sheet.

You can configure Remote access authentication control to challenge the following RSA SecurID users for their PASSCODEs:

•	All users

•	Users who are members of an administrator-designated group

•	Users who are not members of an administrator-designated group

To configure Remote access authentication:

1.	In the RSA ACE/Agent control panel, click the Remote tab.

The Remote properties sheet opens.

2.	Choose one of the following authentication methods.

•	Use Post-dial terminal based Authentication if any of your remote client machines are unable to authenticate using RSA Security EAP.

•	Routing and Remote Access Service will use RSA EAP if you plan to implement Remote access authentication using RSA Security EAP. In order to use this option, you must properly configure your remote access server. You must also install the EAP client component of the RSA ACE/Agent 5.5 for Windows on each remote client computer.  For information on configuring remote servers that use RSA Security EAP, see the section "Configuring RSA Security EAP" in the RSA ACE/Agent 5.5 for Windows Installation and Administration Guide. To install the RSA Security EAP client component on a remote client machine, see "Installing RSA Security EAP on Client Computers" in the RSA ACE/Agent 5.5 for Windows Installation and Administration Guide.

Note:	When you select Routing and Remote Access Service will use RSA EAP, ALL users are automatically RSA SecurID challenged.

3.	Under Challenge, select the users that you want to challenge for their RSA SecurID PASSCODEs:

Users to challenge	Steps to complete
No users	Click Off from the Challenge drop-down list.
All users who dial in to the computer	Click All users from the Challenge drop-down list.
A group of users who dial in to  the computer	Click Users in from the Challenge drop-down list. Click Select to display, and then select the local or domain group that you want to challenge.
All users who dial in to the computer, except users in a  certain group	Click All users except on the Challenge list, and then select the local or domain group that you do not want to challenge.
4.	If you do not want the Windows Application log to resolve usernames when users log in, check Do Not Resolve Username in Event Log Messages.

For large Windows Domains, selecting this option helps to decrease the time it takes to log in. However, the Agent records the username as "N/A" in the User column of the Windows System log, which prevents you from filtering events in the log by user. The username is recorded for each login, but you can view it only if you select an event and display full details about the event in the Event Detail window. The username appears in the Description text box of the Event Detail window.

Note:	This option is available only if you have enabled the All users option in the Challenge area.

5.	To display a message if users enter their usernames incorrectly during authentication, check Enable "Invalid Username" Prompt During Authentication.

Note:	This option is not available if you have chosen Routing and Remote Access will use RSA EAP. Selecting this option automatically disables the Do Not Resolve Username in Event Log Messages option.

6.	If your RSA ACE/Server database records include the user's Windows domain name as part of the username (for example, DOMAIN\jsmith instead of simply jsmith), check Send Domain Name and User Name to RSA ACE/Server.

7.	To hide the DOMAIN: prompt from users during a remote login, check Disable Domain Prompt, and type the domain name to which remote users belong in the Default Domain field.

At login, users will see only the USERNAME and PASSCODE prompts. After users enter valid PASSCODEs, they will be authenticated to the default domain.

8.	To display a custom greeting message to users when they are prompted for their usernames and PASSCODEs, check Enable Logon Greeting, and type your custom greeting in the scrollable box.

9.	Click Apply.

Related Topics:

Changing the Timeout Values of the Remote Access Prompts


Configuring RSA Security EAP

The RSA ACE/Agent 5.5 for Windows can only use the RSA Security Extensible Authentication Protocol. A dynamic link library file containing this version of EAP is loaded onto the remote access server when you install the Agent software on that machine. If you have checked Routing and Remote Access Service will use RSA EAP on the Remote properties sheet, make sure that your remote access server or your Microsoft Internet Authentication Server is properly configured to use RSA Security EAP.

To configure a remote access server to use RSA Security EAP:

1.	Click Start > Programs > Administrative Tools > Routing and Remote Access.

The Routing and Remote Access (RRAS) window is displayed. The console tree appears in the left frame.

2.	Right-click the server in the console tree, and click Properties.

The Properties dialog box opens.

3.	Click the Security tab.

4.	On the Authentication Provider drop-down menu, select Windows Authentication.

5.	Click Authentication Methods.

6.	Check the Extensible Authentication Protocol checkbox, and clear all the other methods.

7.	Click OK, and return to the console tree.

8.	In the console tree, click Remote Access Policies.

The policies for this server appear in the right frame of the console.

9.	Double-click the Allow access if dial-in permission is enabled policy.

The Settings dialog box opens.

10.	Click Edit Profile.

11.	The Edit Profile dialog box opens.

12.	Click the Authentication tab.

13.	Check the Extensible Authentication Protocol checkbox, and clear all the other methods.

14.	On the EAP type drop-down menu, select RSA Security EAP.

15.	Click the Encryption tab.

16.	Check the Strong checkbox and clear the No Encryption and Basic checkboxes.

17.	Click the Advanced tab.

18.	Remove all connection attributes from the Parameters box.

19.	Click OK.

The remote access server is now ready to use RSA Security EAP.


Authentication Messages

A user might get the following messages during authentication:

Cannot load RSA ACE/Agent DLL

Unexpected error from RSA ACE/Agent

For a list and descriptions of all error messages and Event Viewer log messages, see RSA ACE/Agent Error and Event View Log Messages


Viewing sdconf.rec

If the RSA ACE/Agent 5.5 for Windows computer and the RSA ACE/Server machine do not have identical copies of the sdconf.rec file, communications between the two will be impossible.

To make sure you have the correct sdconf.rec file, open the RSA SecurID Authentication Information dialog box, or run the sdtest utility.

To view sdconf.rec file settings:

1.	Click Start > Settings > Control Panel.

2.	Double-click the RSA ACE/Agent icon.

3.	On the Main tab, click Test Authentication with RSA ACE/Server.

The RSA SecurID Authentication Information dialog box opens.

If the dialog box fields contain illegible characters, the sdconf.rec file has been corrupted. Ask the RSA ACE/Server administrator for a new copy of sdconf.rec.


Running the sdtest Utility

You can run the sdtest utility to test authentication between the Agent and the RSA ACE/Server.

To run sdtest:

1.	Click Start > Run.

The Run dialog box opens.

2.	In the Open field, enter sdtest, and click OK.

The RSA SecurID Authentication Information dialog box opens.

3.	Click RSA ACE/Server Test Directly.

The RSA SecurID Authentication dialog box opens.

4.	Choose an RSA SecurID token type.

5.	Enter the username and PASSCODE for the token you are using.

6.	Click OK.

If your token is registered correctly in the RSA ACE/Server database, the system displays an Authentication successful message.


Configuring Advanced Settings

To display the advanced configuration settings for the Agent, open the RSA ACE/Agent control panel, and click the Advanced tab.

The configuration settings on the Advanced properties sheet of the RSA ACE/Agent control panel are set to work well in most installations of the Agent. You should not reset them unless doing so will improve performance or help you or your RSA Security Technical Support representative to resolve a problem. The areas of advanced settings are

•	Clearing the node secret from the Agent Host. See Clearing and Replacing the Node Secret.

•	Setting an IP address override for the Agent Host primary network interface. See Setting an IP Address Override.

•	Filtering event messages out of the Windows Event Viewer Application log. See Filtering Event Messages Out of the Windows Event Viewer Log

•	Setting tracing levels to debug Agent problems and control where the tracing information is recorded. See Tracing and Logging Agent Code Activity

•	Changing the timeout values for the remote access authentication prompts. See Changing the Timeout Values of the Remote Access Prompts


Clearing and Replacing the Node Secret

The node secret is a symmetric encryption key known only to the RSA ACE/Agent and the RSA ACE/Server. The Server uses the secret to authenticate the Agent Host, and both machines use the secret to encrypt and decrypt packets of data as they are sent across the network.

The first time a user successfully authenticates or tests authentication from an Agent, the Server creates a node secret for that Agent and stores it in the Server database. A copy of the secret is encrypted and sent to the Agent, where the node secret is stored in the Windows registry.

If the node secret on the Agent Host computer is corrupted or does not match the node secret in the RSA ACE/Server database, encrypted communications between the Agent and the Server cannot work. If you see that the Access Denied, Node Verification Failed error is logged in the RSA ACE/Server Activity monitor, you must clear the node secret from the Agent Host. At the same time, your RSA ACE/Server administrator must disable the Sent node secret client setting specified for the Agent Host in the Server database. Finally, you must run the sdtest utility on the Agent Host to authenticate to the Server. (Go to Running the sdtest Utility for instructions.) When you authenticate successfully, the Server sends a new node secret to the Agent. Refer to the following instructions for clearing and replacing the node secret on the RSA ACE/Server and the RSA ACE/Agent host machines.

On the RSA ACE/Server host machine:

1.	Run the RSA ACE/Server Administration program.

2.	Click Agent Host > Edit Agent Host, and select the Agent Host with the corrupted secret.

The Agent Host record opens.

3.	Clear Sent Node Secret.

4.	Click OK.

On the RSA ACE/Agent Host machine:

1.	Log in as a local Windows administrator.

2.	Click Start > Settings > Control Panel.

3.	Double-click the RSA ACE/Agent icon.

4.	On the Advanced tab, click Clear Node Secret.

5.	Click Apply.

6.	On the Main tab, click Test Authentication with RSA ACE/Server.

The RSA SecurID Authentication Information dialog box opens.

7.	Choose an RSA SecurID token type.

8.	Enter the username and PASSCODE for the token you are using.

9.	Click OK.

If your token is registered correctly in the RSA ACE/Server database, the system displays an Authentication successful message. The Agent and the Server established a new node secret when you authenticated.


Setting an IP Address Override

When an RSA ACE/Agent runs on an Agent Host that has multiple network interface cards and therefore multiple IP addresses, the Agent administrator must specify a primary Agent Host IP address for encrypted communications between the Agent Host and the RSA ACE/Server.

Agent Hosts typically attempt to discover their own IP addresses. Left to itself, an Agent Host with multiple addresses might select one that is unknown to the Server, making communication between Agent and Server impossible.

To specify the primary IP address of the Agent:

1.	Click Start > Settings > Control Panel.

2.	Double-click the RSA ACE/Agent icon.

3.	On the Advanced tab, in the IP Address Override box, enter the IP address of the primary network interface of the Agent.

4.	Click Apply.


Filtering Event Messages Out of the Windows Event Viewer Log

You can prevent certain RSA ACE/Agent event messages from being logged in the Windows Event Viewer Application log. You might want to prevent certain event messages from being logged if your site has a large number of RSA SecurID users, and the logging of all events makes it difficult for you to search the log for messages related to a specific incident.

Default. Allows all event messages to be recorded in the log.

Low. Prevents event messages from being logged that pertain to successful PASSCODE authentication events, required or disabled PASSCODE challenging, and Web access authentication cookie rejections.

Medium. In addition to preventing the logging of all event messages in the Low category, this setting prevents the logging of event messages pertaining to New PIN Mode and the Next Tokencode prompt.

High. In addition to preventing the logging of all event messages in the Low and Medium categories, this setting prevents the logging of Service thread terminated, exiting messages.

Note:	You cannot use this setting to prevent RSA ACE/Agent error messages from being recorded in the Windows Event Viewer's Application log. In addition, this setting has no effect on the logging of trace messages in the Event Viewer log.

To set the event message filtering level in the Windows Event Viewer
Application log:

1.	Click Start > Settings > Control Panel.

2.	Double-click the RSA ACE/Agent icon.

3.	On the Advanced tab, in the Event Log Filtering box, click the level of filtering that you want to apply to event messages in the log.

4.	Click Apply.


Tracing and Logging Agent Code Activity

On the Advanced properties sheet of the RSA ACE/Agent control panel, you can enable tracing of Agent code activity and specify where tracing messages are to be logged. Trace logging is a useful debugging aid for you and your RSA Security Technical Support representatives.

Because tracing has an impact on Agent performance, do not enable tracing unless you must do so to detect and resolve a problem.

Note:	Setting the Event Log Level on the Advanced properties sheet has no effect on the logging of tracing messages in the Windows Event Viewer logs.

To turn on tracing and specify where tracing messages will be logged:

1.	Click Start > Settings > Control Panel.

2.	Double-click the RSA ACE/Agent icon.

3.	On the Advanced tab, under Tracing Level, check the checkbox of every type of tracing you want the system to perform.

4.	Under Tracing Destination, check the checkbox of every location you want the tracing messages to be logged:

•	Event Log. Tracing messages are recorded in the Windows Event Viewer logs.

•	Console. The system opens a console window and records tracing messages directly to the window. You can scroll through the messages in the window.

•	Log File. Tracing messages are recorded in the %SYSTEMROOT%\aceclient.log file.

•	Debugger. Tracing messages are recorded in the system debugger.

5.	Click Apply to turn on tracing.


Changing the Timeout Values of the Remote Access Prompts

If you display RSA SecurID username and PASSCODE prompts for remote users through the use of automated scripts, you might need to set different timeout values for the Remote access prompts. RSA SecurID users have to wait, sometimes as long as 60 seconds, before they can enter their latest PASSCODEs. (RSA SecurID Software Token users never need to wait for new tokencodes to display because their next tokencodes are generated automatically.) By changing the timeout values, you can prevent the Remote access prompts from timing out before users can send their PASSCODEs to the Agent.

Do not change the default timeout values unless your users experience problems with remote access.

You can change two remote access prompt timeout values on the Advanced properties sheet of the RSA ACE/Agent control panel:

•	The Initial Timeout value is important for scripts. You can use it to decrease the initial wait time before a script begins to execute.

•	The Regular Timeout value is set for all prompts that appear after the initial remote access prompt is displayed.

To change timeout values of the remote access prompts:

1.	In the RSA ACE/Agent control panel, click the Advanced tab.

The Advanced properties sheet opens.

2.	In the Remote Access Prompt Timeouts area, in the Initial Timeout box, enter or select a number representing the number of seconds that must elapse before the initial Remote prompt times out.

The minimum Initial Timeout value is one second and the maximum is 180 seconds. The default value is 10 seconds.

3.	In the Regular Timeout box, enter or select a number representing the number of seconds that must elapse before all subsequent Remote prompts time out.

4.	The minimum Regular Timeout value is 5 seconds and the maximum is 180 seconds. The default value is 180 seconds.

5.	Click Apply.


RSA ACE/Agent Error and Event Viewer Log Messages

This topic lists all error and event messages alphabetically.

RSA ACE/Agent logs events in the Windows Event Viewer Application log under the source ACECLIENT. The messages are sorted into the following categories:

ACE/Agent. General RSA ACE/Agent events, such as sdconf.rec status, RSA ACE/Server communication errors, and memory allocation errors.

Local. Events generated by the Local access authentication module (SDGINA).

Remote. Events generated by the Remote access authentication module (SDRAS).

For a detailed explanation of an error, click the underlined text below. The explanation will open in a separate Help window.

Related Topics

Access Denied. Workstation name not specified.

ACECheck processing error for userid username

ACEClose processing error errornumber

ACENext processing error for userid username

ACEPin processing error for userid username

All users challenged. PASSCODE required.

An error occurred when accessing the Metabase.

Authentication failure.

Authentication Manager: Access Denied.

Authentication Manager: RSA ACE/Agent Library Failure.

Authentication Manager: Failed Authentication Attempt. User username.

Authentication Manager: Invalid RSA ACE/Server configuration. User username.

Authentication Manager: New PIN Accepted. User username.

Authentication Manager: New PIN Rejected. User username.

Authentication Manager: Next Tokencode Accepted. User username.

Authentication Manager: Next Tokencode Failed. User username.

Authentication Manager: Unsupported protocol.

Authentication Manager: User Canceled New PIN Mode. User username.

Authentication Manager: User Canceled Transaction. User username.

Authentication Manager: User I/O Timeout. User username.

Authentication Manager: User Interface Library Failure.

Cannot create socket during initialization in RSA SecurID Authentication

Cannot create socket during initialization.

Cannot load RSA ACE/Agent DLL

Could not initialize RSA ACE/Agent

Could not open registry key keyname

Credential Management error allocating memory.

Credential Management error creating BSAFE algorithm object.

Credential Management error during initialization of Desktop data.

Credential Management error generating random number.

Credential Management error initializing random number generator.

Credential Management error retrieving information from the registry.

Data Manager: Not Enough Memory.

Failed authentication for userid username.

Failed to create event.

Failed to create service thread, aborting.

Failed to find required service WINSOCK.

File incorrect size: sdconf.rec.

File not found: aceclnt.dll.

File not found: sdconf.rec.

Local: Security Features Available.

New PIN accepted for userid username.

New PIN rejected for userid username.

New PIN requested from userid username.

Next code accepted for userid username.

Next code rejected for userid username.

Next code requested from userid username.

Out of memory in functionname.

Remote: RAS not available.

RSA ACE/Agent initialization failed

RSA ACE/Server is not responding

RSA ACE/Server is not responding. Run CLNTCHK to verify port and IP address of RSA ACE/Server

RSA SecurID challenge off. PASSCODE not required.

Service thread terminated, exiting.

Session Manager: Failed Socket Accept Call.

Session Manager: Failed Socket Connect Call.

Session Manager: Failed to Create Server Thread.

Session Manager: Failed to Create Socket.

Session Manager: Failed to Resolve Hostname.

Session Manager: Not Enough Memory.

Session Manager: Winsock startup error.

Successful authentication.

The access control entry for filename was not found.

The discretionary Access Control List for filename was not found.

The user connected to port COM# has been disconnected because an internal authentication error. . .

The user connected to port portname has been disconnected. . .

The user server/username disconnected from port portnumber.

The user server/username connected on port portnumber on date at time and disconnected on date at time. . .

The user username has connected and been authenticated on port portnumber.

The user was authenticated as username1 by the third-party security host module but was. . .

Unable to determine if user in challenge group. Checking cached group SID. User in challenge group. PASSCODE required.

Unable to determine if user in challenge group. Checking cached group SID. User not in group. PASSCODE not required.

Unable to determine if user in challenge group. Checking cached group SID. User in exception group. PASSCODE not required.

Unable to determine if user in challenge group. Checking cached group SID. User not in exception group. PASSCODE required.

Unexpected error from RSA ACE/Agent.

User <blank> canceled out of RSA SecurID Authentication routine.

User I/O Timeout-User took too long to respond.

User in challenge group. PASSCODE required.

User in exception group. PASSCODE not required.

User not in challenge group. PASSCODE not required.

User not in exception group. PASSCODE required.

User username canceled out of New PIN routine.

User username not in groupname group. PASSCODE is not required.

User username not in groupname group. PASSCODE not required.

User username: ACCESS DENIED. ATTEMPT 1.

User username: Access denied. Attempt to use invalid handle. Closing connection.

User username: ACCESS DENIED. Next Tokencode failed.

User username: ACCESS DENIED. Server signature invalid.

User username: ACE Check Error: Invalid group SID. PASSCODE required.

User username: canceled out of Next Tokencode routine.

User username: canceled out of RSA SecurID Authentication routine.

User username: Domain not found. User challenged for PASSCODE.

User username: New PIN accepted.

User username: New PIN rejected.

User username: Not found. User challenged for PASSCODE.

User username: PASSCODE accepted.

User username: PASSCODE required. All users challenged.

User username: Reserve password accepted.

User username: Successfully logged on with Next Tokencode.


Access Denied. Workstation name not specified.

The RSA ACE/Agent could not find a computer name in the certificate. This message usually appears when a Network authentication user dials in to a RAS server and is being authenticated by the Domain Controller. Because the remote computer is not part of the network, the Domain Controller does not read its workstation name. Do not install the RSA ACE/Agent Network authentication service on a RAS server.

Note:	The value in the Workstation field of the Event Detail is N/A.


ACECheck processing error for userid username

If the ACECheck function returns an error, an RSA ACE/Server timeout or some other communications error has occurred.


ACEClose processing error errornumber

If the ACEClose function returns an error, an RSA ACE/Server timeout or some other communications error has occurred.


ACENext processing error for userid username

If the ACENext function returns an error, an RSA ACE/Server timeout or some other communications error has occurred.


ACEPin processing error for userid username

If the ACEPin function returns an error, an RSA ACE/Server timeout or some other communications error has occurred.


All users challenged. PASSCODE required.

The specified service is configured to RSA SecurID-challenge all users of the service. The Challenge control on the RSA ACE/Agent control panel is set to All Users.  The user was challenged to enter a PASSCODE.


An error occurred when accessing the Metabase.

The Agent failed while reading from or writing to the Metabase. If this message is displayed, first make sure you have the correct administrative privileges, and then reboot the Agent Host. If the error persists, re-install the Agent to override the existing settings. If that does not resolve the situation, you will have to uninstall, and then re-install the Agent.


Authentication failure.

The subject described in the Event Detail did not RSA SecurID authenticate successfully and was therefore refused access.


Authentication Manager: Access Denied.

The user did not enter a valid RSA SecurID PASSCODE.


Authentication Manager: RSA ACE/Agent Library Failure.

The RSA ACE/Agent could not load the aceclnt.dll library file. The file is either corrupted, has been moved to another directory, or has been deleted from the system.

If the aceclnt.dll file is no longer on the system, you must re-install the RSA ACE/Agent.


Authentication Manager: Failed Authentication Attempt. User username.

The user entered an invalid PASSCODE, causing the "bad PASSCODE" counter to be incremented by 1 in the Windows registry. If this counter exceeds the configured number of bad PASSCODEs, the user's token will be deactivated until an administrator intervenes.

The number of allowed bad PASSCODEs is stored in the sdconf.rec file and can be viewed by running the sdtest program.


Authentication Manager: Invalid RSA ACE/Server configuration. User username.

The sdconf.rec file is not valid. The file is either corrupted, has been moved to another directory, or has been deleted from the system.

To correct the problem, get a new copy of sdconf.rec from your RSA ACE/Server administrator.


Authentication Manager: New PIN Accepted. User username.

The user successfully associated a new PIN with his or her token.


Authentication Manager: New PIN Rejected. User username.

The user did not successfully associate a new PIN with his or her token. If the user is attempting to create his or her own PIN, make sure the user understands the PIN length and syntax parameter settings for your RSA ACE/Server.


Authentication Manager: Next Tokencode Accepted. User username.

After entering a series of bad PASSCODEs, the user was prompted to enter the next tokencode from his or her token. The tokencode was valid and the user was authenticated successfully.


Authentication Manager: Next Tokencode Failed. User username.

After entering a series of bad PASSCODEs, the user was prompted to enter the next tokencode from his or her token. The tokencode was not valid and the user was denied access to the system.


Authentication Manager: Unsupported protocol.

The client attempted to access an unsupported version of RSA ACE/Server or ACE/Manager.


Authentication Manager: User Canceled New PIN Mode. User username.

The user was prompted to associate a new PIN with his or her token, but the user did not complete the new PIN procedure. Make sure the user understands how to use his or her token in New PIN mode.


Authentication Manager: User Canceled Transaction. User username.

The user was prompted to authenticate, but then canceled out of the Enter PASSCODE dialog box. This is a purely informational message.


Authentication Manager: User I/O Timeout. User username.

The user waited too long at the Enter PASSCODE prompt, so the RSA ACE/Agent canceled the transaction.


Authentication Manager: User Interface Library Failure.

The RSA ACE/Agent could not load the sdui.dll library file. The file is either corrupted, has been moved to another directory, or has been deleted from the system.

If the sdui.dll file is no longer on the system, you must re-install RSA ACE/Agent.


Cannot create socket during initialization in RSA SecurID Authentication

Socket services may not have started. Check the Event Log to find out if there is a problem with the network card or the TCP/IP services.

Also, make sure echo services are running on your RSA ACE/Server. Do one of the following:

•	If the RSA ACE/Server is running on a Windows machine, open the RSA ACE/Server machine Network control panel, click the Services tab, and make sure Simple TCP/IP Services are installed. If they are not, add the Simple TCP/IP Services.

•	If the RSA ACE/Server is running on a UNIX machine, make sure the echo service is running on the RSA ACE/Server machine. See your UNIX operating system documentation for information about starting the echo service.


Cannot create socket during initialization.

Make sure echo services are running on your RSA ACE/Server. Do one of the following:

•	If the RSA ACE/Server is running on a Windows machine, open the RSA ACE/Server machine Network control panel, click the Services tab, and make sure Simple TCP/IP Services are installed. If they are not, add the Simple TCP/IP Services.

•	If the RSA ACE/Server is running on a UNIX machine, make sure the echo service is running on the RSA ACE/Server machine. See your UNIX operating system documentation for information about starting the echo service.


Cannot load RSA ACE/Agent DLL

Test cannot find aceclnt.dll in the \system32 directory. You must re-install RSA ACE/Agent software from the RSA ACE/Agent 5.5 for Windows zip file.


Could not initialize RSA ACE/Agent

Will be preceded by a number of RSA ACE/Agent error messages, such as Cannot find sdconf.rec. Try re-installing the sdconf.rec file in the %SYSTEMROOT%\system32 directory.


Could not open registry key keyname

A serious registry corruption has occurred. You must re-install the RSA ACE/Agent software.


Credential Management error allocating memory.

The system does not have enough physical RAM, or there were too many other processes running in memory. If you receive this message often, add more physical memory to the computer.


Credential Management error creating BSAFE algorithm object.

The system probably does not have enough physical RAM, or there were too many other processes running in memory. If you receive this message often, add more physical memory to the computer.


Credential Management error during initialization of Desktop data.

The RSA ACE/Agent Network authentication service attempted to initialize but failed.


Credential Management error generating random number.

The system probably does not have enough physical RAM, or there were too many other processes running in memory. If you receive this message often, add more physical memory to the computer.


Credential Management error initializing random number generator.

The system probably does not have enough physical RAM, or there were too many other processes running in memory. If you receive this message often, add more physical memory to the computer.


Credential Management error retrieving information from the registry.

Most likely a configuration error. Make sure you have imported the server certificate and keys to the machine and that the registry is not corrupted.


Data Manager: Not Enough Memory.

The system does not have enough physical RAM, or there were too many other processes running in memory. If you receive this message often, add more physical memory to the computer.


Failed authentication for userid username.

The RSA ACE/Server did not grant the user access. The most common causes for this are wrong username or an invalid PASSCODE.


Failed to create event.

These are internal errors. The machine may not have enough free resources to add RSA SecurID authentication. Consider moving service(s) from this machine to another one.


Failed to create service thread, aborting.

There were too many other processes running, so the service did not start.


Failed to find required service WINSOCK.

The Windows socket interface was not found. Check the event log to find out if there is a problem with WINSOCK. Ensure that TCP/IP has been enabled on the machine.


File incorrect size: sdconf.rec.

It is likely that the sdconf.rec file was not copied in binary mode. Ask the RSA ACE/Server administrator for a new copy of sdconf.rec.


File not found: aceclnt.dll.

Software may have been installed incorrectly or aceclnt.dll may have been deleted. Re-install the RSA ACE/Agent 5.5 for Windows software to correct the problem.


File not found: sdconf.rec.

The sdconf.rec file is not in the %SYSTEMROOT\system32 directory. It was either removed or never copied from the RSA ACE/Server. Ask the RSA ACE/Server administrator for a new copy of sdconf.rec.


Local: Security Features Available.

The machine meets the system and software requirements for the named security features.


Network Timeout-RSA ACE/Server was responding but has now stopped.

Make sure the RSA ACE/Server process is running on the server. Check for a network problem such as a router malfunction or unplugged network cable.


New PIN accepted for userid username.

The RSA ACE/Server verified the RSA SecurID user's new PIN.


New PIN rejected for userid username.

The PIN was rejected by the RSA ACE/Server. The user must re-authenticate to set the PIN. Check the Activity Log on the RSA ACE/Server.


New PIN requested from userid username.

The RSA ACE/Server has prompted the RSA SecurID user to create his or her own PIN or receive a system-generated PIN.


Next code accepted for userid username.

The Next Tokencode was accepted by the RSA ACE/Server and access was granted.


Next code rejected for userid username.

The user must attempt to authenticate again.


Next code requested from userid username.

The user's token was in Next Tokencode mode and the RSA ACE/Server asked for the second tokencode.


Out of memory in functionname.

A memory error has occurred within an internal function.  You may need more physical memory.


Remote: RAS not available.

The machine does not meet one or more of the system or software requirements needed to enable authentication of RAS connections. See the "System Requirements" section in the RSA ACE/Agent 5.5 for Windows Installation and Administration Guide and make sure the machine meets all the requirements.


RSA ACE/Agent initialization failed

The Agent cannot make the connection to the RSA ACE/Server. Make sure the RSA ACE/Server and network are operational and that all network interface cards and cables are properly installed and in good condition.


RSA ACE/Server is not responding

There is a network communications problem between the RSA ACE/Server and the RSA ACE/Agent, the server cannot be found (because the IP address is wrong, for example), or the RSA ACE/Server daemon is not running.


RSA ACE/Server is not responding. Run CLNTCHK to verify port and IP address of RSA ACE/Server

There is a network communications problem between the RSA ACE/Server and the RSA ACE/Agent, the RSA ACE/Server cannot be found (because the IP address is wrong, for example), or the RSA ACE/Server daemon is not running.


RSA SecurID challenge off. PASSCODE not required.

RSA SecurID authentication is not enabled on the specified service. The Challenge control on the RSA ACE/Agent control panel is set to OFF. The user was not challenged to enter a PASSCODE.


Service thread terminated, exiting.

The RSA ACE/Agent Proxy authentication service or RSA ACE/Agent Network authentication service was stopped. This is a purely informational message.


Session Manager: Failed Socket Accept Call.

There are too many sockets open.


Session Manager: Failed Socket Connect Call.

This message appears if the RSA ACE/Agent Proxy authentication service has not been started, or if a user tries to perform RSA SecurID network authentication and the RSA ACE/Agent Network authentication service has died or failed to start.

To correct the problem, make sure both services are running.


Session Manager: Failed to Create Server Thread.

There are too many server threads running (too many users connecting at once). Try widening the intervals at which users attempt to log in.


Session Manager: Failed to Create Socket.

This message results from a memory shortage or WINSOCK error. The cause might be too many users connecting to the server at the same time.


Session Manager: Failed to Resolve Hostname.

Most likely a configuration error. The machine that is connecting has no DNS or NetBIOS name, or has an invalid IP address. Make sure your network is configured properly and that your host file entries are correct.


Session Manager: Not Enough Memory.

The system does not have enough physical RAM, or there were too many other processes running in memory. If you receive this message often, add more physical memory to the computer.


Session Manager: Winsock startup error.

The Microsoft Windows Sockets failed to initialize. To troubleshoot WINSOCK problems, consult your Microsoft networking documentation.


Successful authentication.

The subject described in the Event Detail RSA SecurID-authenticated successfully and was granted access to the system.


The access control entry for filename was not found.

The Windows security entry for this file is corrupted. If you suspect that the ACL has become corrupted, see the Microsoft Windows online Help, or contact Microsoft technical support.


The discretionary Access Control List for filename was not found.

The Windows security entry for this file is corrupted. If you suspect that the ACL has become corrupted, see the Microsoft Windows online Help, or contact Microsoft technical support.


The local group groupname does not exist.

Indicates an incorrect implementation of the Web access authentication Group Security feature.

The RSA ACE/Agent could not locate one of the groups listed in the user's Shell field on the local machine. Make sure you created and named the group properly in the Windows User Manager.


The user connected to port COM# has been disconnected because an internal authentication error. . .

The connection to the port has been lost due to an I/O flow error. Make sure that the Hardware Flow Control option is enabled in the Modem Configure Settings page of the RAS Control Panel.

Also make sure that the port speed setting in the RAS Control Panel is the same as the setting in the Port Control Panel.


The user connected to port portname has been disconnected. . .

There is a problem with RSA SecurID authentication. See the Event Detail topic for more specific information.


The user server/username disconnected from port portnumber.

The user closed the connection on the specified port.


The user server/username connected on port portnumber on date at time and disconnected on date at time. . .

A normal RSA ACE/Agent disconnection has occurred.


The user username has connected and been authenticated on port portnumber.

A normal (authenticated) RSA ACE/Agent-Server connection occurred.


The user was authenticated as username1 by the third-party security host module but was. . .

The user has been disconnected because his or her login name and the RSA Security authentication name are not the same.


Unable to determine if user in challenge group. Checking cached group SID. User in challenge group. PASSCODE required.

The Domain Controller could not be contacted to verify the user's group membership, so the user's cached login information was used to determine the user's group membership. The cached information revealed that the user was in an RSA SecurID-challenged group.


Unable to determine if user in challenge group. Checking cached group SID. User not in group. PASSCODE not required.

The Domain Controller could not be contacted to verify the user's group membership, so the user's cached login information was used to determine the user's group membership. The cached information revealed that the user was not in a challenged group.


Unable to determine if user in challenge group. Checking cached group SID. User in exception group. PASSCODE not required.

The Domain Controller could not be contacted to verify the user's group membership, so the user's cached login information was used to determine the user's group membership. The cached information revealed that the user was not required to authenticate.


Unable to determine if user in challenge group. Checking cached group SID. User not in exception group. PASSCODE required.

The Domain Controller could not be contacted to verify the user's group membership, so the user's cached login information was used to determine the user's group membership. The cached information revealed that the user was required to authenticate.


Unexpected error from RSA ACE/Agent.

The value returned by the RSA ACE/Server is not valid. Re-install RSA ACE/Agent 5.5 for Windows. If the problem persists, check your hardware.


User <blank> canceled out of RSA SecurID Authentication routine.

The user canceled without entering a username.


User I/O Timeout-User took too long to respond.

The Windows system timed out after waiting for a response from the user.


User in challenge group. PASSCODE required.

The specified user is a member of the group designated for RSA SecurID authentication on the RSA ACE/Agent control panel. The user was challenged to enter a PASSCODE.


User in exception group. PASSCODE not required.

The specified user is a member of the group that is designated on the RSA ACE/Agent control panel to be exempt from RSA SecurID authentication. The user was not challenged to enter a PASSCODE.


User not in challenge group. PASSCODE not required.

The specified user is not a member of the group designated for RSA SecurID authentication on the RSA ACE/Agent control panel. The user was not challenged to enter a PASSCODE.


User not in exception group. PASSCODE required.

The specified user is not a member of the group that is designated on the RSA ACE/Agent control panel to be exempt from RSA SecurID authentication. The user was challenged to enter a PASSCODE.


User username canceled out of New PIN routine.

The user canceled the authentication attempt.


User username not in groupname group. PASSCODE is not required.

The user was not prompted for a PASSCODE. To challenge every local user who attempts to access the machine, enable the Challenge All Users option on the Local properties sheet of the RSA ACE/Agent control panel.


User username not in groupname group. PASSCODE not required.

The Challenge All switch is not on, and the user is not in the designated group.


User username: ACCESS DENIED. ATTEMPT 1.

The user was denied access. Check the RSA ACE/Server Activity Log for the specific reason.


User username: Access denied. Attempt to use invalid handle. Closing connection.

An internal error occurred. If the message re-occurs, call the RSA Security Technical Support Center.


User username: ACCESS DENIED. Next Tokencode failed.

The user must attempt to authenticate again.


User username: ACCESS DENIED. Server signature invalid.

This message indicates that the identity of the RSA ACE/Server could not be verified by the Agent Host. If you see this message, call the RSA Security Technical Support Center.


User username: ACE Check Error: Invalid group SID. PASSCODE required.

The user's group SID did not contain a valid group name. The user was challenged for an RSA SecurID PASSCODE.


User username: canceled out of Next Tokencode routine.

The user canceled out of the Next Tokencode process.


User username: canceled out of RSA SecurID Authentication routine.

The user canceled after entering a username.


User username: Domain not found. User challenged for PASSCODE.

The user may have entered the domain name incorrectly and will be challenged for a PASSCODE.


User username: New PIN accepted.

The user's New PIN was verified.


User username: New PIN rejected.

The PIN was rejected by the RSA ACE/Server. The user needs to re-authenticate to set the PIN. Check the RSA ACE/Server Activity Log.


User username: Not found. User challenged for PASSCODE.

The user is unknown to the system, but the user will be challenged for PASSCODE anyway.


User username: PASSCODE accepted.

The Challenge All Users option is not on, and the user is in the designated group.


User username: PASSCODE required. All users challenged.

The Challenge All Users option is enabled.


User username: Reserve password accepted.

User was asked for the reserve password and entered it correctly.


User username: Successfully logged on with Next Tokencode.

The Next Tokencode was accepted by RSA ACE/Server and access was granted to the user.