Defender 5.9.3 - Administration Guide

DSS

Specifies a list of Defender Security Servers (by IP address or DNS name) and ports for the Defender Desktop Login software to authenticate against.

Each IP address or DNS name must have a port which is specified using a colon. For multiple entries, use a semicolon as shown in the example (without a space).

SHARED_SECRET

Specifies the shared secret which is used to securely communicate and authenticate against the Defender Security Server.

EXCLUSION_MODE

Determines how Defender Desktop Login authenticates users.

This parameter can take one of the following values:

• 0  Specifies that all users must authenticate via Defender.
• 1  Specifies that members of groups in the EXCLUSION_GROUPS parameter are not required to authenticate via Defender.
• 2  Specifies that only members of groups in the EXCLUSION_GROUPS parameter must authenticate via Defender.

EXCLUSION_GROUPS

Specifies the groups whose members must or are not required to authenticate via Defender.

Behavior of this parameter depends on the value set in the EXCLUSION_MODE parameter.

To specify multiple groups in this parameter, use a semicolon as a separator.

ALWAYS_ALLOW_LOCAL_LOGON

Specifies whether to allow local users to log on to a computer that has Defender Desktop Login installed without authenticating via Defender.

This parameter can take one of the following values:

• 0  Do not allow local users to bypass Defender authentication (default value)
• 1  Always allow local users to bypass Defender authentication

ALLOW_OFFLINE_LOGON

Specifies whether users are allowed to log on if all Defender Security Servers are unavailable.

This parameter can take one of the following values:

• 0  Specifies that users cannot log on if all Defender Security Servers are unavailable.
• 1  Specifies that users can only log on for a specified period of time from the moment when all Defender Security Servers become unavailable. If you specify this value, use the OFFLINE_LOGON_DAYS to set the number of days you want.
• 2  Specifies that users can only log on a specified number of times from the moment when all the Defender Security Servers become unavailable. If you specify this value, use the OFFLINE_LOGON_COUNT to set the number of times you want.

OFFLINE_LOGON_DAYS

Specifies the period of time (in days) during which users can log on. This period is counted from the moment when all Defender Security Servers become unavailable.

You can only use this parameter if you set the ALLOW_OFFLINE_LOGON parameter value to 1.

OFFLINE_LOGON_COUNT

Specifies the number of times user can log on from the moment when all Defender Security Servers become unavailable.

You can only use this parameter if you set the ALLOW_OFFLINE_LOGON parameter value to 2.

DISPLAY_NOTIFICATIONS

Specifies whether to provide the user with information about the remaining number of offline logons or the remaining number of days when the offline logon will be available.

This parameter can take one of the following values:

• 0  Specifies not to display any offline logon notifications.
• 1  Specifies to display offline logon notifications.

STORE_PASSWORDS

Specifies whether to store user’s password, so that the user is not prompted to reenter the password during each two-factor login.

This parameter can take one of the following values:

• 0  Specifies not to store the user’s password.
• 1  Specifies to store the user’s password.

MANAGE_PASSWORDS

Specifies whether Defender Desktop Login can change a user’s password when the password has expired.

This parameter can take one of the following values:

0  Specifies that Defender Desktop Login can change user’s password.

• 1  Specifies that Defender Desktop Login cannot change user’s password.

WAIT_FOR_NETWORK

Specifies the time period (in seconds) during which Defender Desktop Login waits for the network to become available at startup. The default value is 60 seconds.