Home » Compaq Manuals » Laptops » Compaq 6910p » Manual Viewer

Compaq 6910p ProtectTools - Windows Vista and Windows XP - Page 78

Device Access Manager for HP ProtectTools - hp review

Add to My Manuals
Save this manual to your list of manuals

Page 78 highlights

Device Access Manager for HP ProtectTools Short description Details Solution Users have been denied access to devices within Device Access Manager, but the devices are still accessible. Simple Configuration and/or Device Class Configuration have been used within Device Access Manager to deny users access to devices. Despite being denied access, users can still access the devices. Verify that the HP ProtectTools Device Locking service has started. As an administrative user, browse to Control Panel > Administrative Tools > Services. In the Services window, search for the HP ProtectTools Device Locking/Auditing service. Be sure that the service is started and that the startup type is Automatic. A user has unexpected access to a device or a user is unexpectedly denied access to a device. Device Access Manager has been used to deny users access to some devices and allow users access to other devices. When the user is using the system, they can access devices they believe Device Access Manager has denied and are denied access to devices they believe Device Access Manager should allow. The Device Class Configuration within Device Access Manager should be used to investigate the Users device settings. Select Security Manager > Device Access Manager > Device Class Configuration. Expand the levels in the Device Class tree and review the settings applicable to the User. Check for any "Deny" permissions that may be set on the user or any Windows Group of which they may be a member, e.g., Users, Administrators. Allow or deny-which takes precedence? Within Device Class Configuration, the The user is denied access to the device. Deny takes following configuration has been set: precedence over Allow. ● The Allow permission has been granted to a Windows group (e.g., BUILTIN\Administrators) and the Deny permission has been granted to another Windows group (e.g., BUILTIN\Users) at the same level in the device class hierarchy (e.g., DVD/CD-ROM Drives). If a user is a member of both those groups (e.g., Administrator), which takes precedence? Access is denied due to the way in which Windows works out the effective permission for the device. One group is denied, and one group is allowed, but the user is a member of both groups. The user is denied because denying access is given precedence over allowing access. One workaround is to deny the Users group at the DVD/ CD-ROM Drives level and to allow the Administrators group at the level below DVD/CD-ROM Drives. A further workaround would be to have specific Windows groups, one for allowing access to DVD/CD and one for denying access to DVD/CD. Specific users would then be added to the appropriate group. 72 Chapter 8 Troubleshooting ENWW

Section	Page
Introduction to security	7
HP ProtectTools features	8
Accessing HP ProtectTools Security	9
Achieving key security objectives	10
Protecting against targeted theft	10
Restricting access to sensitive data	10
Preventing unauthorized access from internal or external locations	11
Creating strong password policies	11
Additional security elements	12
Assigning security roles	12
Managing HP ProtectTools passwords	12
Creating a secure password	14
HP ProtectTools Backup and Restore	14
Backing up credentials and settings	14
Restoring credentials	16
Configuring settings	16
Credential Manager for HP ProtectTools	17
Setup procedures	18
Logging on to Credential Manger	18
Using the Credential Manager Logon Wizard	18
Logging on for the first time	19
Registering credentials	19
Registering fingerprints	19
Setting up the fingerprint reader	20
Using your registered fingerprint to log on to Windows	20
Registering a Java Card, USB eToken, or virtual token	20
Registering a USB eToken	20
Registering other credentials	20
General tasks	21
Creating a virtual token	21
Changing the Windows logon password	21
Changing a token PIN	21
Managing identity	22
Clearing an identity from the system	22
Locking the computer	23
Using Windows Logon	23
Logging on to Windows with Credential Manager	23
Adding an account	24
Removing an account	24
Using Single Sign On	24
Registering a new application	24
Using automatic registration	24
Using manual (drag and drop) registration	25
Managing applications and credentials	25
Modifying application properties	25
Removing an application from Single Sign On	25
Exporting an application	26
Importing an application	26
Modifying credentials	26
Using Application Protection	27
Restricting access to an application	27
Removing protection from an application	27
Changing restriction settings for a protected application	28
Advanced tasks (administrator only)	29
Specifying how users and administrators log on	29
Configuring custom authentication requirements	30
Configuring credential properties	30
Configuring Credential Manager settings	31
Example 1—Using the “Advanced Settings” page to allow Windows logon from Credential Manager	31
Example 2—Using the “Advanced Settings” page to require user verification before Single Sign On	32
Embedded Security for HP ProtectTools	33
Setup procedures	34
Enabling the embedded security chip	34
Initializing the embedded security chip	35
Setting up the basic user account	36
General tasks	37
Using the Personal Secure Drive	37
Encrypting files and folders	37
Sending and receiving encrypted e-mail	37
Changing the Basic User Key password	38
Advanced tasks	39
Backing up and restoring	39
Creating a backup file	39
Restoring certification data from the backup file	39
Changing the owner password	40
Resetting a user password	40
Enabling and disabling Embedded Security	40
Permanently disabling Embedded Security	40
Enabling Embedded Security after permanent disable	40
Migrating keys with the Migration Wizard	41
Java Card Security for HP ProtectTools	43
General tasks	44
Changing a Java Card PIN	44
Selecting the card reader	44
Advanced tasks (administrators only)	45
Assigning a Java Card PIN	45
Assigning a name to a Java Card	46
Setting power-on authentication	46
Enabling Java Card power-on authentication and creating an administrator Java Card	47
Creating a user Java Card	48
Disabling Java Card power-on authentication	48
BIOS Configuration for HP ProtectTools	49
General tasks	50
Managing boot options	50
Enabling and disabling system configuration options	51
Advanced tasks	53
Managing HP ProtectTools add-on module settings	53
Enabling and disabling smart card power-on authentication support	53
Enabling and disabling power-on authentication support for Embedded Security	54
Enabling and disabling Automatic DriveLock hard drive protection	55
Managing Computer Setup passwords	55
Setting the power-on password	56
Changing the power-on password	56
Setting the setup password	56
Changing the setup password	57
Setting password options	57
Enabling and disabling stringent security	57
Enabling and disabling power-on authentication on Windows restart	57
Device Access Manager for HP ProtectTools	59
Starting background service	60
Simple configuration	61
Device class configuration (advanced)	62
Adding a user or a group	62
Removing a user or a group	62
Denying access to a user or group	62
Allowing access to a device class for one user of a group	62
Allowing access to a specific device for one user of a group	63
Drive Encryption for HP ProtectTools	65
Encryption management	66
User management	67
Recovery	68
Troubleshooting	69
Credential Manager for HP ProtectTools	69
Embedded Security for HP ProtectTools	72
Device Access Manager for HP ProtectTools	78
Miscellaneous	79
Glossary	83

Match case Limit results 1 per page

Device Access Manager for HP ProtectTools

Short description

Details

Solution

Users have been denied

access to devices within

Device Access Manager,

but the devices are still

accessible.

Simple Configuration and/or Device

Class Configuration have been used

within Device Access Manager to deny

users access to devices. Despite being

denied access, users can still access the

devices.

Verify that the HP ProtectTools Device Locking service

has started.

As an administrative user, browse to

Control Panel >

Administrative Tools > Services

. In the

Services

window, search for the

HP ProtectTools Device

Locking/Auditing

service. Be sure that the service is

started and that the startup type is

Automatic

A user has unexpected

access to a device or a

user is unexpectedly

denied access to a device.

Device Access Manager has been used

to deny users access to some devices

and allow users access to other devices.

When the user is using the system, they

can access devices they believe Device

Access Manager has denied and are

denied access to devices they believe

Device Access Manager should allow.

The Device Class Configuration within Device Access

Manager should be used to investigate the Users

device settings.

Select

Security Manager > Device Access Manager

> Device Class Configuration

. Expand the levels in

the Device Class tree and review the settings

applicable to the User. Check for any “Deny”

permissions that may be set on the user or any

Windows Group of which they may be a member, e.g.,

Users, Administrators.

Allow or deny—which

takes precedence?

Within Device Class Configuration, the

following configuration has been set:

●

The Allow permission has been

granted to a Windows group (e.g.,

BUILTIN\Administrators) and the

Deny permission has been granted

to another Windows group (e.g.,

BUILTIN\Users) at the same level in

the device class hierarchy (e.g.,

DVD/CD-ROM Drives).

If a user is a member of both those

groups (e.g., Administrator), which takes

precedence?

The user is denied access to the device. Deny takes

precedence over Allow.

Access is denied due to the way in which Windows

works out the effective permission for the device. One

group is denied, and one group is allowed, but the user

is a member of both groups. The user is denied

because denying access is given precedence over

allowing access.

One workaround is to deny the Users group at the DVD/

CD-ROM Drives level and to allow the Administrators

group at the level below DVD/CD-ROM Drives.

A further workaround would be to have specific

Windows groups, one for allowing access to DVD/CD

and one for denying access to DVD/CD. Specific users

would then be added to the appropriate group.

Chapter 8

Troubleshooting

ENWW