To remove a domain connection
On the Administration site, select the Management Policy you want to configure and click the Helpdesk Scope link.
On the Helpdesk Scope page, select the domain connection you want to delete and click Remove. Note, that the domain connection will be removed from this helpdesk scope only. If you want to permanently remove the domain connection, remove it from everywhere where it is used, and then on the General Settings|Domain Connections tab, click Remove under the required connection.
Questions and Answers policy allows you to create secret questions and specify Q&A profile settings. Secret questions are questions to which users provide answers when registering with Password Manager. Using the Q&A profile settings you can specify requirements for user’s questions and answers. For example, you can prevent users from using the same answer for multiple questions.
Secret questions are questions to which users provide their own answers, thus creating a personal Questions and Answers profile. Before users can register with Password Manager by creating their personal Questions and Answers profiles, you must configure a question list containing the questions that will be presented to users.
You can create the question list in several languages, so that users can select a preferred language of questions and answers.
Password Manager uses personal Question and Answers profiles as an authentication method to allow users and helpdesk operators to manage user passwords in Active Directory domains and in multiple connected systems. A Q&A profile, or personal profile, is a set of questions specified by the Password Manager administrator, to which users must provide their secret answers that later can be used to authenticate the users. You can also require users to specify their own questions in their personal profiles. Then, users can securely reset their passwords or unlock their accounts by answering a series of questions from their personal profiles.
You can set requirements for answers that users specify in their Questions and Answers profiles. For example, you can prevent users from specifying the same answer for different questions, or set a minimum answer length. For more information, see Configuring Q&A Profile Settings.
Password Manager allows you to specify criteria for recognizing users' Questions and Answers profiles as not compliant with the current password management settings. This is essential if you want users to update their profiles each time when Q&A policy settings are changed. Helpdesk operators can force users to update their Q&A profiles if the profiles do not comply with current Q&A policy.
For information on how to enforce update of Q&A profiles, see User Enforcement Rules.
Secret questions can contain the following types of questions:
Question type |
Description |
Mandatory questions |
Questions of this type are an integral part of a user's Q&A profile. Users must provide an answer to each of these questions. |
Optional questions |
Users can select what optional questions to answer. Administrator specifies only the number of questions that users must answer. |
Helpdesk questions |
Security questions used by helpdesk to verify user's identity before performing password- and account management tasks. Answers to these questions are always stored using reversible encryption. |
User-defined |
Questions that must be created by the user. |
For users to be able to create their personal Questions and Answers profiles, you must specify at least one secret question.
To create secret questions in the default language
|
IMPORTANT: If you add a questions to the question list in the default language, all translations of the question list will not be configured until you change them accordingly. This means that users will not be able to use the disabled languages for creating Q&A profiles. If you remove a question from the question list in the default language, this question will be automatically removed from translations of the question list. |
|
NOTE: Modifying a question list does not affect existing personal Questions or Answers profiles unless the users have to update their profiles as a result of the enforcement rules that require users to update Q&A profiles when the question list is modified. For more information on the enforcement rules, see User Enforcement Rules. |
To translate secret questions
|
IMPORTANT: If you delete the translated question list, all users who have created their Questions and Answers profiles will be forced to update their Q&A profiles, if you have configured the enforcement rule. For more information, see Invite Users to Create/Update Q&A Profiles. |
Q&A profile settings allow you to define settings and requirements for user’s questions and answers. For example, you can prevent users from using the same answer for multiple questions. Questions and answers that do not comply with the policy will not be accepted.
For an overview of Q&A policy and profile settings, see Questions and Answers Policy Overview.
To configure Questions and Answers policy
Option |
Description |
Question Settings | |
Users must answer this number of optional questions to register |
Set the required number of optional questions that a user must answer to create a Questions and Answers profile. |
Users must answer this number of user-defined questions to register |
Set the required number of user-defined questions that a user must specify to create a Questions and Answers profile. |
Minimum length of user-defined questions |
Set the least number of characters that user-defined questions can contain. |
Answer Settings |
|
Minimum length of answers |
Set the least number of characters that users' answers can contain. |
Reject the same answers for different questions |
Select to prevent users from specifying same answers for different questions. |
Reject answers that contain corresponding questions |
Select to prevent users from specifying answers that contain corresponding questions. |
Store answers using reversible encryption |
Select to store users' answers using reversible encryption. If you do not select this check box, answers to secret questions (mandatory, optional, and user-defined) will be hashed using the hashing algorithm you specified when initializing the instance. If you want to change the hashing algorithm, you need to re-initialize the instance. For more information, see Instance Reinitialization. Note, that answers to helpdesk questions are always stored using reversible encryption. |
Security Settings |
|
Allow users to hide their answers |
Select this check box to allow users to hide their answers on the screen, so that answer entry fields will look like a series of asterisks. |
Hide users’ answers by default |
Select this check box to have Password Manager display users' answers as asterisks while they are typing in their answers. |
Do not require users to confirm answers if answers are hidden |
Select this check box to allow users to enter their answers only once, if answers are hidden. |
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy