HP Compaq tc4400 User manual

Reference Guide
ProtectTools Security Manager
Document Part Number: 389171-003
February 2006

© Copyright 2005, 2006 Hewlett-Packard Development Company, L.P.
Microsoft and Windows are U.S. registered trademarks of Microsoft
Corporation. Java is a U.S. trademark of Sun Microsystems, Inc. Intel is a
trademark or registered trademark of Intel Corporation or its subsidiaries in
the United States and other countries.
The information contained herein is subject to change without notice. The
only warranties for HP products and services are set forth in the express
warranty statements accompanying such products and services. Nothing
herein should be construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errors or omissions contained herein.
Reference Guide
ProtectTools Security Manager
Third Edition February 2006
First Edition May 2005
Document Part Number: 389171-003

Reference Guide iii
Contents
1Introduction
ProtectTools Security Manager . . . . . . . . . . . . . . . . . . . . 1–1
Accessing the ProtectTools Security Manager . . . . . 1–2
Understanding Security Roles . . . . . . . . . . . . . . . . . . . . . 1–3
Managing ProtectTools Passwords . . . . . . . . . . . . . . . . . 1–4
Creating a Secure Password . . . . . . . . . . . . . . . . . . . 1–8
2 Smart Card Security for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2–1
Initializing the smart card. . . . . . . . . . . . . . . . . . . . . . . . . 2–2
Smart card BIOS security mode. . . . . . . . . . . . . . . . . . . . 2–3
Enabling smart card BIOS security mode
and setting the smart card administrator password . . 2–4
Changing the smart card administrator password . . . 2–6
Setting and changing the smart card user
password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2–7
Storing the administrator or user card password . . . . 2–8
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2–10
Updating BIOS smart card settings . . . . . . . . . . . . . 2–10
Selecting the smart card reader . . . . . . . . . . . . . . . . 2–10
Changing the smart card PIN. . . . . . . . . . . . . . . . . . 2–11
Backing up and restoring smart cards . . . . . . . . . . . 2–11

iv Reference Guide
Contents
3 Java Card Security for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3–1
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3–2
Changing a Java Card PIN. . . . . . . . . . . . . . . . . . . . . 3–2
Selecting the smart card reader . . . . . . . . . . . . . . . . . 3–3
Advanced tasks (administrators only) . . . . . . . . . . . . . . . 3–4
Assigning a Java Card PIN . . . . . . . . . . . . . . . . . . . . 3–4
Assigning a name to a Java Card. . . . . . . . . . . . . . . . 3–5
Setting power-on authentication . . . . . . . . . . . . . . . . 3–6
Backing up and restoring Java Cards . . . . . . . . . . . 3–10
4 Embedded Security for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–1
Setup procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–2
Enabling the embedded security chip . . . . . . . . . . . . 4–2
Initializing the embedded security chip. . . . . . . . . . . 4–3
Setting up the basic user account. . . . . . . . . . . . . . . . 4–4
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–6
Using the Personal Secure Drive. . . . . . . . . . . . . . . . 4–6
Encrypting files and folders. . . . . . . . . . . . . . . . . . . . 4–6
Sending and receiving encrypted e-mail . . . . . . . . . . 4–7
Changing the Basic User Key password . . . . . . . . . . 4–7
Advanced tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–8
Backing up and restoring. . . . . . . . . . . . . . . . . . . . . . 4–8
Changing the owner password. . . . . . . . . . . . . . . . . 4–10
Resetting a user password . . . . . . . . . . . . . . . . . . . . 4–10
Enabling and disabling Embedded Security . . . . . . 4–10
Migrating keys with the Migration Wizard . . . . . . . 4–11

Contents
Reference Guide v
5 BIOS Configuration for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–1
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–2
Managing boot options . . . . . . . . . . . . . . . . . . . . . . . 5–2
Enabling and disabling system configuration
options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–3
Advanced tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–5
Managing ProtectTools settings . . . . . . . . . . . . . . . . 5–5
Managing Computer Setup passwords . . . . . . . . . . . 5–8
6 Credential Manager for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6–1
Setup procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6–2
Logging on to Credential Manger . . . . . . . . . . . . . . . 6–2
Registering credentials . . . . . . . . . . . . . . . . . . . . . . . 6–5
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6–9
Creating a virtual token . . . . . . . . . . . . . . . . . . . . . . . 6–9
Changing the Windows logon password . . . . . . . . . 6–10
Changing a token PIN . . . . . . . . . . . . . . . . . . . . . . . 6–10
Managing identity . . . . . . . . . . . . . . . . . . . . . . . . . . 6–11
Locking the computer . . . . . . . . . . . . . . . . . . . . . . . 6–13
Using Microsoft Network logon . . . . . . . . . . . . . . . 6–14
Using Single Sign On . . . . . . . . . . . . . . . . . . . . . . . 6–17
Advanced tasks (administrator only) . . . . . . . . . . . . . . . 6–22
Specifying how users and administrators log on. . . 6–22
Configuring custom authentication requirements . . 6–23
Configuring Credential Manager properties . . . . . . 6–24
Configuring Credential Manager settings . . . . . . . . 6–25
Glossary
Index

Reference Guide 1–1
1
Introduction
ProtectTools Security Manager
ProtectTools Security Manager software provides security
features that help protect against unauthorized access to the
computer, networks, and critical data. Enhanced security
functionality is provided by the following software modules:
■Smart Card Security for ProtectTools
■Java Card Security for ProtectTools
■Embedded Security for ProtectTools
■BIOS Configuration for ProtectTools
■Credential Manager for ProtectTools
The software modules available for your computer may vary
depending on your model. For example, Embedded Security for
ProtectTools requires that the Trusted Platform Module (TPM)
embedded security chip (select models only) be installed on your
computer, and Smart Card Security for ProtectTools requires an
optional smart card and reader.
ProtectTools software modules may be preinstalled, preloaded,
or available for download from the HP Web site. Visit
http://www.hp.com for more information.
✎The instructions in this guide are written with the assumption
that you have already installed the applicable ProtectTools
software modules.

1–2 Reference Guide
Introduction
Accessing the ProtectTools Security Manager
To access the ProtectTools Security Manager from the
Microsoft® Windows® Control Panel:
»Select Start > All Programs > HP ProtectTools Security
Manager.
✎After you have configured the Credential Manager module,
you can also open ProtectTools by logging on to Credential
Manager directly from the Windows logon screen. For more
information, refer to “Logging on to Windows with Credential
Manager,” in Chapter 6, “Credential Manager for
ProtectTools.”

Introduction
Reference Guide 1–3
Understanding Security Roles
In managing computer security (particularly for large
organizations), one important practice is to divide responsibilities
and rights among various types of administrators and users.
✎In a small organization or for individual use, these roles may
all be held by the same person.
For ProtectTools, the security duties and privileges can be
divided into the following roles:
■Security officer—Defines the security level for the company
or network and determines the security features to deploy,
such as smart cards, biometric readers, or USB tokens.
✎Many of the features in ProtectTools can be customized by
the security officer in cooperation with HP. For more
information, visit http://www.hp.com.
■IT administrator—Applies and manages the security features
defined by the security officer. Can also enable and disable
some features. For example, if the security officer has
decided to deploy smart cards, the IT administrator can
enable smart card BIOS security mode.
■User—Uses the security features. For example, if the security
officer and IT administrator have enabled smart cards for the
system, the user can set the smart card PIN and use the card
for authentication.

1–4 Reference Guide
Introduction
Managing ProtectTools Passwords
Most of the ProtectTools Security Manager features are secured
by passwords. The following table lists the commonly used
passwords, the software module where the password is set, and
the password function.
The passwords that are set and used by IT administrators only are
indicated in this table as well. All other passwords may be set by
regular users or administrators.
ProtectTools Password
Set in this
ProtectTools Module Function
Computer Setup setup
password
✎Also known as
BIOS administrator,
f10 Setup, or
Security Setup
password.
BIOS Configuration, by
IT administrator
Protects access to the
Computer Setup utility.
Power-on password BIOS Configuration Protects access to the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation.
(Continued)

Introduction
Reference Guide 1–5
Smart card administrator
password
✎Also known as BIOS
administrator card
password.
Smart Card Security,
by IT administrator
Used for smart card
power-on (BIOS)
authentication. Allows
access to the Computer
Setup utility and the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation. It also
allows for creating
recovery files to restore
user or administrator
cards.
Smart card user password
✎Also known as BIOS
user card password.
Smart Card Security Used for smart card
power-on (BIOS)
authentication.
Allows access to the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation.
Smart card PIN Smart Card Security Protects access to the
smart card contents and
authenticates users of
the smart card.
When used for power-on
authentication, the smart
card PIN also protects
access to the Computer
Setup utility and to the
computer contents.
Smart card recovery file
password
Smart Card Security Protects access to the
recovery file that
contains the BIOS
passwords.
(Continued)
ProtectTools Password
Set in this
ProtectTools Module Function

1–6 Reference Guide
Introduction
Java™ Card PIN Java Card Security Protects access to the
Java Card contents and
authenticates users of
the Java Card.
When used for power-on
authentication, the Java
Card PIN also protects
access to the Computer
Setup utility and to the
computer contents.
Basic User Key password
✎Also known as
Embedded Security
password.
Embedded Security Used to access
Embedded Security
features, such as secure
e-mail, file, and folder
encryption. When used
for power-on
authentication, also
protects access to the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation.
Emergency Recovery
Token password
✎Also known as
Emergency
Recovery Token Key
password.
Embedded Security,
by IT administrator
Protects access to the
Emergency Recovery
Token, which is a
backup file for the
embedded security chip.
Owner password Embedded Security,
by IT administrator
Protects the system and
the TPM chip from
unauthorized access to
all owner functions of
Embedded Security.
(Continued)
ProtectTools Password
Set in this
ProtectTools Module Function

Introduction
Reference Guide 1–7
Credential Manager logon
password
Credential Manager This password offers
2 options:
■It can be used in a
separate logon to
access Credential
Manager after logging
on to Microsoft
Windows.
■It can be used in
place of the Windows
logon process,
allowing access to
Windows and
Credential Manager
simultaneously.
Credential Manager
recovery file password
Credential Manager,
by IT administrator
Protects access to the
Credential Manager
recovery file.
Windows logon password Windows Control
Panel
Can be used in manual
logon or saved on the
smart card.
ProtectTools Password
Set in this
ProtectTools Module Function

1–8 Reference Guide
Introduction
Creating a Secure Password
When creating passwords, you must first follow any
specifications that are set by the program. In general, however,
consider the following guidelines to help you create strong
passwords and reduce the chances of your password being
compromised:
■Use passwords with more than 6 characters, preferably more
than 8.
■Mix the case of letters throughout your password.
■Whenever possible, mix alphanumeric characters and include
special characters and punctuation marks.
■Substitute special characters or numbers for letters in a
key word. For example, you can use the number 1 for letters
IorL.
■Combine words from 2 or more languages.
■Split a word or phrase with numbers or special characters in
the middle, for example, “Mary2-2Cat45.”
■Do not use a password that would appear in a dictionary.
■Do not use your name for the password, or any other personal
information, such as birth date, pet names, or mother's
maiden name, even if you spell it backwards.
■Change passwords regularly. You might change only a couple
of characters that increment.
■If you write down your password, do not store it in a
commonly visible place very close to the computer.
■Do not save the password in a file, such as an e-mail, on your
computer.
■Do not share accounts or tell anyone your password.

Reference Guide 2–1
2
Smart Card Security for
ProtectTools
Basic concepts
Smart Card Security for ProtectTools manages the smart card
setup and configuration for computers equipped with an optional
smart card reader.
With Smart Card Security, you can
■Access smart card security features.
■Initialize a smart card so that it can be used with other
ProtectTools modules, such as Credential Manager for
ProtectTools.
■Work with the Computer Setup utility to enable smart card
authentication in a power-on environment, and to configure
separate smart cards for an administrator and a user. This
requires a user to insert the smart card and optionally enter
a PIN prior to allowing the operating system to load.
■Set and change the password used to authenticate users of
the smart card.
■Back up and restore smart card BIOS passwords stored on the
smart card.

2–2 Reference Guide
Smart Card Security for ProtectTools
Initializing the smart card
You must initialize the smart card before using it.
To initialize the smart card:
1. Insert the smart card into the reader.
2. Select Start > All Programs > HP ProtectTools Security
Manager.
3. In the left pane, select Smart Card Security, and then select
Smart Card.
4. In the right pane, click Initialize.
5. Type your name in the first box in the Initialize the smart
card dialog box.
6. Set and confirm the smart card PIN in the appropriate boxes.
The PIN code must be between 4 and 8 numeric characters.
ÄTo avoid losing access to the computer, do not forget the
smart card PIN. If you forget your smart card PIN, it may be
impossible to operate the computer. The smart card will be
locked and made unusable unless the smart card PIN is
entered correctly within 5 attempts. The count for these
attempts resets after the correct PIN is entered.
7. Click OK to complete the initialization.

Smart Card Security for ProtectTools
Reference Guide 2–3
Smart card BIOS security mode
When enabled, smart card BIOS security mode requires you to
use a smart card to start the computer.
The process of enabling smart card BIOS security mode involves
the following steps:
1. Enable Smart Card Power-on Authentication Support in
BIOS Configuration. Refer to “Enabling and disabling Smart
card or Java Card power-on authentication support,” in
Chapter 5, “BIOS Configuration for ProtectTools.”
✎Enabling this setting allows you to use a smart card for
power-on authentication. The smart card BIOS security
mode features are unavailable until you enable smart card
power-on authentication support.
2. Enable smart card BIOS security mode in Smart Card
Security. Refer to “Enabling smart card BIOS security mode
and setting the smart card administrator password,” later in
this chapter.
3. Set the smart card administrator password.
✎The smart card administrator password is set as part of the
process of enabling smart card BIOS security mode.
The smart card administrator password is not the same as the
Computer Setup setup password. The smart card administrator
password links the smart card to the computer for identification
purposes, and also allows you to do the following:
■Access Computer Setup or the contents of the computer.
■Create new administrator and user smart cards.
■Create a recovery file to restore either a user or administrator
smart card.

2–4 Reference Guide
Smart Card Security for ProtectTools
Enabling smart card BIOS security mode
and setting the smart card administrator
password
To enable smart card BIOS security mode and set the smart card
administrator password:
1. Select Start > All Programs > HP ProtectTools Security
Manager.
2. In the left pane, select Smart Card Security, and then
select BIOS.
3. In the right pane, under BIOS Security Mode, click Enable.
4. Click Next.
5. Enter the Computer Setup setup password at the prompt, and
click Next.
6. Insert the new administrator smart card, and follow the
on-screen instructions. The instructions vary and may include
the following tasks:
❏Initializing the smart card. Refer to “Initializing the smart
card”for detailed instructions.
❏Setting the smart card administrator password. Refer to
“Storing the administrator or user card password” for
detailed instructions.
❏Creating a recovery file. Refer to “Creating a recovery
file” for detailed instructions.

Smart Card Security for ProtectTools
Reference Guide 2–5
Disabling smart card BIOS security mode
When disabling smart card BIOS security mode, the smart card
administrator and user passwords are disabled, and the use of the
smart card is no longer needed to access the computer.
✎If smart card BIOS security mode has previously been enabled,
the button on the “Smart Card Security BIOS” page changes to
Disable.
To disable smart card security:
1. Select Start > All Programs > HP ProtectTools Security
Manager.
2. In the left pane, select Smart Card Security, and then
select BIOS.
3. In the right pane, under BIOS Security Mode, click Disable.
4. Insert the card containing the current smart card administrator
password, and then click Next.
5. Enter the smart card PIN at the prompt and click Finish.

2–6 Reference Guide
Smart Card Security for ProtectTools
Changing the smart card administrator
password
The smart card administrator password is set as part of the
process for enabling smart card BIOS security mode. You can
change the smart card administrator password after it has been
set. Refer to “Smart card BIOS security mode,” earlier in this
chapter, for more information about the smart card administrator
password.
✎The following procedure updates the smart card administrator
password stored on the card and in Computer Setup.
To change the smart card administrator password:
1. Select Start > All Programs > HP ProtectTools Security
Manager.
2. In the left pane, select Smart Card Security, and then
select BIOS.
3. In the right pane, under BIOS Security Mode, next to BIOS
administrator card, click Change.
4. Enter the smart card PIN and click Next.
5. Insert the new administrator card and click Next.
6. Enter the smart card PIN and click Finish.

Smart Card Security for ProtectTools
Reference Guide 2–7
Setting and changing the smart card
user password
To set or change the smart card user password:
1. Select Start > All Programs > HP ProtectTools Security
Manager.
2. In the left pane, select Smart Card Security, and then
select BIOS.
3. In the right pane, under BIOS Security Mode, next to BIOS
user card, click the Set button.
✎If there is already a user password in Computer Setup,
click the Change button.
4. Enter the smart card PIN and click Next.
5. Insert the new user card and click Next.
❏If there is already a user password on the card, the
Finish dialog box is displayed. Omit steps 6 through 8
and go to step 9.
❏If there is no user password on the card, the BIOS
Password Wizard opens.
6. In the BIOS Password Wizard, you can either
❏Enter a password manually.
❏Generate a random 32-byte password.
✎Using a known password enables you to create duplicate
cards without using a recovery file. Generating a random
password offers more security; however, you must have a
recovery file to make backup cards.