HP Compaq tc4400 User manual

Reference Guide
ProtectTools Security Manager
Document Part Number: 389171-003
February 2006

© Copyright 2005, 2006 Hewlett-Packard Development Company, L.P.
Microsoft and Windows are U.S. registered trademarks of Microsoft
Corporation. Java is a U.S. trademark of Sun Microsystems, Inc. Intel is a
trademark or registered trademark of Intel Corporation or its subsidiaries in
the United States and other countries.
The information contained herein is subject to change without notice. The
only warranties for HP products and services are set forth in the express
warranty statements accompanying such products and services. Nothing
herein should be construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errors or omissions contained herein.
Reference Guide
ProtectTools Security Manager
Third Edition February 2006
First Edition May 2005
Document Part Number: 389171-003

Reference Guide iii
Contents
1Introduction
ProtectTools Security Manager . . . . . . . . . . . . . . . . . . . . 1–1
Accessing the ProtectTools Security Manager . . . . . 1–2
Understanding Security Roles . . . . . . . . . . . . . . . . . . . . . 1–3
Managing ProtectTools Passwords . . . . . . . . . . . . . . . . . 1–4
Creating a Secure Password . . . . . . . . . . . . . . . . . . . 1–8
2 Smart Card Security for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2–1
Initializing the smart card. . . . . . . . . . . . . . . . . . . . . . . . . 2–2
Smart card BIOS security mode. . . . . . . . . . . . . . . . . . . . 2–3
Enabling smart card BIOS security mode
and setting the smart card administrator password . . 2–4
Changing the smart card administrator password . . . 2–6
Setting and changing the smart card user
password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2–7
Storing the administrator or user card password . . . . 2–8
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2–10
Updating BIOS smart card settings . . . . . . . . . . . . . 2–10
Selecting the smart card reader . . . . . . . . . . . . . . . . 2–10
Changing the smart card PIN. . . . . . . . . . . . . . . . . . 2–11
Backing up and restoring smart cards . . . . . . . . . . . 2–11

iv Reference Guide
Contents
3 Java Card Security for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3–1
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3–2
Changing a Java Card PIN. . . . . . . . . . . . . . . . . . . . . 3–2
Selecting the smart card reader . . . . . . . . . . . . . . . . . 3–3
Advanced tasks (administrators only) . . . . . . . . . . . . . . . 3–4
Assigning a Java Card PIN . . . . . . . . . . . . . . . . . . . . 3–4
Assigning a name to a Java Card. . . . . . . . . . . . . . . . 3–5
Setting power-on authentication . . . . . . . . . . . . . . . . 3–6
Backing up and restoring Java Cards . . . . . . . . . . . 3–10
4 Embedded Security for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–1
Setup procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–2
Enabling the embedded security chip . . . . . . . . . . . . 4–2
Initializing the embedded security chip. . . . . . . . . . . 4–3
Setting up the basic user account. . . . . . . . . . . . . . . . 4–4
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–6
Using the Personal Secure Drive. . . . . . . . . . . . . . . . 4–6
Encrypting files and folders. . . . . . . . . . . . . . . . . . . . 4–6
Sending and receiving encrypted e-mail . . . . . . . . . . 4–7
Changing the Basic User Key password . . . . . . . . . . 4–7
Advanced tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4–8
Backing up and restoring. . . . . . . . . . . . . . . . . . . . . . 4–8
Changing the owner password. . . . . . . . . . . . . . . . . 4–10
Resetting a user password . . . . . . . . . . . . . . . . . . . . 4–10
Enabling and disabling Embedded Security . . . . . . 4–10
Migrating keys with the Migration Wizard . . . . . . . 4–11

Contents
Reference Guide v
5 BIOS Configuration for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–1
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–2
Managing boot options . . . . . . . . . . . . . . . . . . . . . . . 5–2
Enabling and disabling system configuration
options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–3
Advanced tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5–5
Managing ProtectTools settings . . . . . . . . . . . . . . . . 5–5
Managing Computer Setup passwords . . . . . . . . . . . 5–8
6 Credential Manager for ProtectTools
Basic concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6–1
Setup procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6–2
Logging on to Credential Manger . . . . . . . . . . . . . . . 6–2
Registering credentials . . . . . . . . . . . . . . . . . . . . . . . 6–5
General tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6–9
Creating a virtual token . . . . . . . . . . . . . . . . . . . . . . . 6–9
Changing the Windows logon password . . . . . . . . . 6–10
Changing a token PIN . . . . . . . . . . . . . . . . . . . . . . . 6–10
Managing identity . . . . . . . . . . . . . . . . . . . . . . . . . . 6–11
Locking the computer . . . . . . . . . . . . . . . . . . . . . . . 6–13
Using Microsoft Network logon . . . . . . . . . . . . . . . 6–14
Using Single Sign On . . . . . . . . . . . . . . . . . . . . . . . 6–17
Advanced tasks (administrator only) . . . . . . . . . . . . . . . 6–22
Specifying how users and administrators log on. . . 6–22
Configuring custom authentication requirements . . 6–23
Configuring Credential Manager properties . . . . . . 6–24
Configuring Credential Manager settings . . . . . . . . 6–25
Glossary
Index

Reference Guide 1–1
1
Introduction
ProtectTools Security Manager
ProtectTools Security Manager software provides security
features that help protect against unauthorized access to the
computer, networks, and critical data. Enhanced security
functionality is provided by the following software modules:
■Smart Card Security for ProtectTools
■Java Card Security for ProtectTools
■Embedded Security for ProtectTools
■BIOS Configuration for ProtectTools
■Credential Manager for ProtectTools
The software modules available for your computer may vary
depending on your model. For example, Embedded Security for
ProtectTools requires that the Trusted Platform Module (TPM)
embedded security chip (select models only) be installed on your
computer, and Smart Card Security for ProtectTools requires an
optional smart card and reader.
ProtectTools software modules may be preinstalled, preloaded,
or available for download from the HP Web site. Visit
http://www.hp.com for more information.
✎The instructions in this guide are written with the assumption
that you have already installed the applicable ProtectTools
software modules.

1–2 Reference Guide
Introduction
Accessing the ProtectTools Security Manager
To access the ProtectTools Security Manager from the
Microsoft® Windows® Control Panel:
»Select Start > All Programs > HP ProtectTools Security
Manager.
✎After you have configured the Credential Manager module,
you can also open ProtectTools by logging on to Credential
Manager directly from the Windows logon screen. For more
information, refer to “Logging on to Windows with Credential
Manager,” in Chapter 6, “Credential Manager for
ProtectTools.”

Introduction
Reference Guide 1–3
Understanding Security Roles
In managing computer security (particularly for large
organizations), one important practice is to divide responsibilities
and rights among various types of administrators and users.
✎In a small organization or for individual use, these roles may
all be held by the same person.
For ProtectTools, the security duties and privileges can be
divided into the following roles:
■Security officer—Defines the security level for the company
or network and determines the security features to deploy,
such as smart cards, biometric readers, or USB tokens.
✎Many of the features in ProtectTools can be customized by
the security officer in cooperation with HP. For more
information, visit http://www.hp.com.
■IT administrator—Applies and manages the security features
defined by the security officer. Can also enable and disable
some features. For example, if the security officer has
decided to deploy smart cards, the IT administrator can
enable smart card BIOS security mode.
■User—Uses the security features. For example, if the security
officer and IT administrator have enabled smart cards for the
system, the user can set the smart card PIN and use the card
for authentication.

1–4 Reference Guide
Introduction
Managing ProtectTools Passwords
Most of the ProtectTools Security Manager features are secured
by passwords. The following table lists the commonly used
passwords, the software module where the password is set, and
the password function.
The passwords that are set and used by IT administrators only are
indicated in this table as well. All other passwords may be set by
regular users or administrators.
ProtectTools Password
Set in this
ProtectTools Module Function
Computer Setup setup
password
✎Also known as
BIOS administrator,
f10 Setup, or
Security Setup
password.
BIOS Configuration, by
IT administrator
Protects access to the
Computer Setup utility.
Power-on password BIOS Configuration Protects access to the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation.
(Continued)

Introduction
Reference Guide 1–5
Smart card administrator
password
✎Also known as BIOS
administrator card
password.
Smart Card Security,
by IT administrator
Used for smart card
power-on (BIOS)
authentication. Allows
access to the Computer
Setup utility and the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation. It also
allows for creating
recovery files to restore
user or administrator
cards.
Smart card user password
✎Also known as BIOS
user card password.
Smart Card Security Used for smart card
power-on (BIOS)
authentication.
Allows access to the
computer contents when
the computer is turned
on, restarted, or restored
from hibernation.
Smart card PIN Smart Card Security Protects access to the
smart card contents and
authenticates users of
the smart card.
When used for power-on
authentication, the smart
card PIN also protects
access to the Computer
Setup utility and to the
computer contents.
Smart card recovery file
password
Smart Card Security Protects access to the
recovery file that
contains the BIOS
passwords.
(Continued)
ProtectTools Password
Set in this
ProtectTools Module Function