diff --git a/docs/passwordpolicyenforcer/11.1/admin/cmdlets/cmdlets.md b/docs/passwordpolicyenforcer/11.1/admin/cmdlets/cmdlets.md index 65422a35b5..736362d8e9 100644 --- a/docs/passwordpolicyenforcer/11.1/admin/cmdlets/cmdlets.md +++ b/docs/passwordpolicyenforcer/11.1/admin/cmdlets/cmdlets.md @@ -9,6 +9,9 @@ sidebar_position: 60 The PPE Cmdlets are available to manage Password Policy Enforcer from a Windows PowerShell. The cmdlets are not case-sensitive. +Starting with version **11.1**, the PowerShell cmdlets are built on .NET 8.0 and require PowerShell version 7.5 or newer to function. +**Installation link**: [https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.5](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.5) + To establish the connection: **Step 1 –** Open a Windows PowerShell. Some cmdlets require administrative permissions. You can use diff --git a/docs/passwordpolicyenforcer/11.1/admin/command_line_interface.md b/docs/passwordpolicyenforcer/11.1/admin/command_line_interface.md index 6a1dd949f6..8a07f1d9f3 100644 --- a/docs/passwordpolicyenforcer/11.1/admin/command_line_interface.md +++ b/docs/passwordpolicyenforcer/11.1/admin/command_line_interface.md @@ -35,9 +35,8 @@ If a reboot was not done, add **/forcerestart** at the end ## Mailer You can run the Password Policy Enforcer Mailer from the command line to deliver email immediately, -or to troubleshoot problems. PPEMail.exe is copied into the \Program Files (x86) - -\Password Policy Enforcer\ folder when the Password Policy Enforcer Mailer is installed. +or to troubleshoot problems. PPEMail.exe is copied into the \Program Files\Netwrix\Password Policy +Enforcer\ folder when the Password Policy Enforcer Mailer is installed. PPEMail.exe starts a simulation when run without any parameters. It finds users whose password will expire soon, but no email is sent or saved to the pickup folder. Use the simulation mode to find diff --git a/docs/passwordpolicyenforcer/11.1/admin/compromisedpasswordcheck.md b/docs/passwordpolicyenforcer/11.1/admin/compromisedpasswordcheck.md index 5d0c35063d..4cfe7f0140 100644 --- a/docs/passwordpolicyenforcer/11.1/admin/compromisedpasswordcheck.md +++ b/docs/passwordpolicyenforcer/11.1/admin/compromisedpasswordcheck.md @@ -6,9 +6,9 @@ sidebar_position: 30 # Compromised Password Check -The Compromised Password Checker finds compromised passwords. Users can be notified via email and -advised or forced to change their password. The check can be scheduled to check existing passwords -against a compromised hash list at any time. +The Compromised Password Checker identifies weak or unsafe passwords, including compromised, reused, +or empty ones. Users can be notified via email and advised or forced to change their password. +The check can be scheduled to run at any time to verify existing passwords against security rules. :::note Create the **Compromised Passwords Base** file prior to enabling the Compromised Password @@ -39,6 +39,9 @@ Click the **Compromised Password Check** toggle to enable/disable the feature. - **Log events in Windows Application Event Viewer** select this option if you want to log events. - **Force users to change password** select this option to force users to change compromised passwords. +- **Report password reuse by another account** select this option to generate password reuse report. +- **Force users to change password** select this option to force users to change reused + passwords. - **Recipient of the full report on the found compromised passwords** specify the email address of the administrator who should receive the full report. - **From** specify the email sender. @@ -54,13 +57,27 @@ Click **Save** to save your settings before running the check or setting up a sc Click **Run now** to run the check. Depending on your network, the check can take quite a while to complete. You can schedule it for off hours instead of running it now. -Here is an example of the compromised passwords list: +Here is an example of the compromised passwords report: +--- +**List of compromised passwords** |User | Account | Sid | Email | Description | | --- | --- | --- | --- | --- | | admin | Administrator | S-1-5-21-1006207104-1546379664-2458629591-500 | | Sending emails is not possible due to the lack of an email address in the account. | | user2 | user2 | S-1-5-21-1006207104-1546379664-2458629591-1118 | user2@company.com | Email has been sent | + +**List of reused passwords** +|User | Account | Sid | Email | Description | +| --- | --- | --- | --- | --- | +| admin | Administrator | S-1-5-21-1006207104-1546379664-2458629591-500 | | Sending emails is not possible due to the lack of an email address in the account. | +| user2 | user2 | S-1-5-21-1006207104-1546379664-2458629591-1118 | user2@company.com | Email has been sent | + +**Users with empty password:** +Guest (S-1-5-21-1006207104-1546379664-2458629591-501) + +--- + #### Schedule the Compromised Password Check Click **Schedule** to set up a schedule to run the Compromised Password Check. diff --git a/docs/passwordpolicyenforcer/11.1/admin/configconsole.md b/docs/passwordpolicyenforcer/11.1/admin/configconsole.md index 78ce271c28..9e479b8813 100644 --- a/docs/passwordpolicyenforcer/11.1/admin/configconsole.md +++ b/docs/passwordpolicyenforcer/11.1/admin/configconsole.md @@ -86,7 +86,7 @@ Users with write permission to these objects can configure Password Policy Enfor Policy to distribute a local configuration to many computers. See the [Domain and Local Policies](/docs/passwordpolicyenforcer/11.1/installation/domain_and_local_policies.md) topic for additional information. -![Connected To Local Configuration](/images/passwordpolicyenforcer/11.1/administration/connecttodomain.webp) +![Connected To Local Configuration](/images/passwordpolicyenforcer/11.1/administration/connecttolocal.webp) ### Help @@ -105,10 +105,11 @@ Links to documentation and support tools. ### Settings -There are three tabs: +There are four tabs: - General - Notifications +- Mail Service - License #### General @@ -174,6 +175,8 @@ Here are the default settings. - **Log event when password accepted by service** adds an entry to the Windows Application Event Log whenever a password is accepted. The logged event includes the username. Default is not checked. +- **Use old icons in Live Policy Feedback** allows switching between displaying old-style and new-style icons in the Password Policy Enforcer Client on the change password screen. + #### Notifications Open the **Settings** > **Notifications** tab to set up notifications. Notifications are only @@ -181,21 +184,10 @@ available when **domain** is selected with the Connected To configuration settin If you make changes, click **Save** to keep your changes or **Discard** to cancel. -Here are the default settings. - ![Notifications Settings](/images/passwordpolicyenforcer/11.1/administration/settingsnotifications.webp) - **Send email reminders**: check this option to send reminders. Default is not checked. - - - **SMTP Server**: enter IP address. - - **Port**: enter port number. - - **Username**: enter your username. - - **Password**: enter your password. - - **Use TLS**: check this option to enable TLS email encryption. - -- **Save email to a pickup folder**: check this option to have the Mailer save emails to a folder - for later delivery by a mail server. The mail server must monitor this folder for new email. - +- **Save email to a pickup folder**: check this option to have the Mailer save emails to a folder for later delivery by a mail server. The mail server must monitor this folder for new email. - **Path**: Click **Browse** and select the path to the pickup folder. :::note @@ -203,7 +195,6 @@ Saving email to a pickup folder is the fastest and most reliable delivery method option if your mail server supports pickup folders. ::: - The Password Policy Enforcer Mailer sends emails at 2:00 AM every day (local time on your server). Check the Windows Application Event Log to monitor its progress. You can also run the Password Policy Enforcer Mailer from the command line to send email immediately, or to troubleshoot problems. @@ -214,6 +205,74 @@ You can change the time the mailer runs. Set the **PPE Mailer** service startup desired time. ::: +##### Configuring Email Settings + +There are three possible ways to configure email settings: + - **SMTP Server** + - **Google OAuth2** + - **O365 OAuth2** + +###### SMTP Server + +![Notifications Settings](/images/passwordpolicyenforcer/11.1/administration/settingsnotifications2.webp) + +- **SMTP Server**: enter IP address. +- **Port**: enter port number. +- **Username**: enter your username. +- **Password**: enter your password. +- **Use TLS**: check this option to enable TLS email encryption. + +###### Google OAuth2 + +![Notifications Settings](/images/passwordpolicyenforcer/11.1/administration/settingsnotifications3.webp) + +- **User Account**: authenticated Google Workspace account. +- **Client ID**: value configured in the Google Workspace Admin Console. +- **Client Secret**: value configured in the Google Workspace Admin Console. +- **Clear Credentials**: removes stored values and tokens. +- **Update Credentials**: initiates token generation in a browser window. + +:::note +The Google OAuth2 timeout can be configured in **PPEConfiguration.json**. +By default, it is set to **1 minute**: +``` +"Configuration": { + "GoogleOAuthTimeout": 60 +} +``` +::: + +###### O365 OAuth2 + +![Notifications Settings](/images/passwordpolicyenforcer/11.1/administration/settingsnotifications4.webp) + +- **User Account**: Office 365 account. +- **Client ID**: value configured in the Office 365 Admin Console. +- **Client Secret**: value configured in the Office 365 Admin Console. +- **Tenant ID**: Office 365 tenant identifier. +- **Clear Credentials**: removes values. + +#### Mail Service + +Open the **Settings** > **Mail Service** tab to set up mail service for notifications. + +If you make changes, click **Save** to keep your changes or **Discard** to cancel. + +![Mail Server Tab](/images/passwordpolicyenforcer/11.1/administration/settingsmailserver.webp) + +- **Service**: specify the address of the machine where the mail service is installed. +- **Port**: specify the port number. + +:::note +If you need to use a port other than 12345, open the **PPEMailService.json** file on the machine where +the mail service is installed, update the port value, and restart the mail service to apply the changes. +``` +"MailService": { + "HostName": "localhost", + "Port": 6000 +} +``` +::: #### License diff --git a/docs/passwordpolicyenforcer/11.1/admin/manage-policies/manage_policies.md b/docs/passwordpolicyenforcer/11.1/admin/manage-policies/manage_policies.md index a1a8d111ba..7a2d58e6a3 100644 --- a/docs/passwordpolicyenforcer/11.1/admin/manage-policies/manage_policies.md +++ b/docs/passwordpolicyenforcer/11.1/admin/manage-policies/manage_policies.md @@ -28,13 +28,12 @@ Policy Guide have been added. The policy management links are all on the Password Policies tile: -- Add a Policy. -- Set Up a Policy (click on existing policy name). -- Test Policy. -- Set Priorities. -- Export. -- Context menu (3 stacked dots) beside each defined policy Make Copy, Make Default/Remove Default, - Rename and Delete . +- [Add a Policy.](#add-a-policy) +- [Set Up a Policy](#set-up-a-policy) (click on existing policy name). +- [Test Policy.](#test-policy) +- [Set Priorities.](#set-priorities) +- [Export.](#export) +- Context menu (3 stacked dots) beside each defined policy [Make Copy](#make-copy), [Make Default/Remove Default](#make-defaultremove-default), [Rename](#rename) and [Delete](#delete). ## Add a Policy diff --git a/docs/passwordpolicyenforcer/11.1/admin/manage-policies/rules/dictionary_rule.md b/docs/passwordpolicyenforcer/11.1/admin/manage-policies/rules/dictionary_rule.md index 78b6da0aab..2b65c6c1ee 100644 --- a/docs/passwordpolicyenforcer/11.1/admin/manage-policies/rules/dictionary_rule.md +++ b/docs/passwordpolicyenforcer/11.1/admin/manage-policies/rules/dictionary_rule.md @@ -18,8 +18,7 @@ for long passwords. Select the **Dictionary** check box to enable the Dictionary rule. -Browse to a dictionary file. A sample file **Dict.txt** is installed in the **\Program -Files\Password Policy Enforcer** folder. This file is sorted and ready to use. It contains +Browse to a dictionary file. A sample file **Dict.txt** is installed in the **\Program Files\Netwrix\Password Policy Enforcer\\** folder. This file is sorted and ready to use. It contains approximately 257,000 words, names, and acronyms. Select the **Detect inclusion of non-alpha characters** check box if Password Policy Enforcer should @@ -114,7 +113,7 @@ local disk. Using a shared dictionary degrades performance, and could jeopardize :::note The `\Program Files (x86)\` folder does not exist on 32-bit Windows, so move the -dictionary into the `\Program Files\Password Policy Enforcer\` folder if you have 32-bit and 64-bit +dictionary into the `\Program Files\Netwrix\Password Policy Enforcer\` folder if you have 32-bit and 64-bit computers sharing a common Password Policy Enforcer configuration. ::: diff --git a/docs/passwordpolicyenforcer/11.1/index.md b/docs/passwordpolicyenforcer/11.1/index.md index 6fb267da07..6fd85f1a74 100644 --- a/docs/passwordpolicyenforcer/11.1/index.md +++ b/docs/passwordpolicyenforcer/11.1/index.md @@ -76,7 +76,7 @@ Here are the requirements for both the full and evaluation Password Policy Enfor - 10 - 11 -- .NET 8.0.15 or higher +- .NET Desktop Runtime 8.0.15 or higher ## Password Policy Enforcer Web diff --git a/docs/passwordpolicyenforcer/11.1/installation/installationserver.md b/docs/passwordpolicyenforcer/11.1/installation/installationserver.md index e87dafb918..0e262c7515 100644 --- a/docs/passwordpolicyenforcer/11.1/installation/installationserver.md +++ b/docs/passwordpolicyenforcer/11.1/installation/installationserver.md @@ -62,8 +62,7 @@ Agreement**. selected by default. - Configuration Console – manages policy configuration. Install where ever needed. Selected by default. -- Mailer Service – sends email reminders. Should be installed on a Domain Controller. It is not - selected by default. +- Mailer Service – sends email reminders. It is not selected by default. **Step 8 –** The default location is shown. Click **Browse** and select a new location if needed. diff --git a/static/images/passwordpolicyenforcer/11.1/administration/connecttolocal.webp b/static/images/passwordpolicyenforcer/11.1/administration/connecttolocal.webp new file mode 100644 index 0000000000..a2be10578d Binary files /dev/null and b/static/images/passwordpolicyenforcer/11.1/administration/connecttolocal.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration4.webp b/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration4.webp index afe2ee0587..51cfce3bd0 100644 Binary files a/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration4.webp and b/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration4.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration5.webp b/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration5.webp index c90a500ac5..273c0f1b96 100644 Binary files a/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration5.webp and b/static/images/passwordpolicyenforcer/11.1/administration/ppc_configuration5.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/settingslicense.webp b/static/images/passwordpolicyenforcer/11.1/administration/settingslicense.webp index 8b402a00e4..44eafebd8e 100644 Binary files a/static/images/passwordpolicyenforcer/11.1/administration/settingslicense.webp and b/static/images/passwordpolicyenforcer/11.1/administration/settingslicense.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/settingsmailserver.webp b/static/images/passwordpolicyenforcer/11.1/administration/settingsmailserver.webp new file mode 100644 index 0000000000..1b0e1c3dfb Binary files /dev/null and b/static/images/passwordpolicyenforcer/11.1/administration/settingsmailserver.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications2.webp b/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications2.webp new file mode 100644 index 0000000000..19ba5a2875 Binary files /dev/null and b/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications2.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications3.webp b/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications3.webp new file mode 100644 index 0000000000..181c40d170 Binary files /dev/null and b/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications3.webp differ diff --git a/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications4.webp b/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications4.webp new file mode 100644 index 0000000000..ade4b3e2cd Binary files /dev/null and b/static/images/passwordpolicyenforcer/11.1/administration/settingsnotifications4.webp differ