Lenovo ThinkCentre M58 Quick reference guide

HardwarePasswordManager
DeploymentGuide
Updated:July,2010

HardwarePasswordManager
DeploymentGuide
Updated:July,2010

Note:Beforeusingthisinformationandtheproductitsupports,readthegeneralinformationinAppendixD
“Notices”onpage49.
ThirdEdition(July2010)
©CopyrightLenovo2010.
LENOVOproducts,data,computersoftware,andserviceshavebeendevelopedexclusivelyatprivateexpenseandare
soldtogovernmentalentitiesascommercialitemsasdenedby48C.F.R.2.101withlimitedandrestrictedrightsto
use,reproductionanddisclosure.
LIMITEDANDRESTRICTEDRIGHTSNOTICE:Ifproducts,data,computersoftware,orservicesaredeliveredpursuant
aGeneralServicesAdministration“GSA”contract,use,reproduction,ordisclosureissubjecttorestrictionssetforth
inContractNo.GS-35F-05925.

Contents
Preface.................v
Chapter1.Overview..........1
Chapter2.InstallingHardware
PasswordManageron
ThinkManagementConsole......3
Prerequisites................3
Preparingthecoreserver...........4
ThinkManagementConsolewithHPMserver
setup...................5
MigratingtoanewLDAPserver.........6
InstallingHardwarePasswordManagerona
Lenovodevice................6
Chapter3.ManagingHardware
PasswordManagerdeviceswith
ThinkManagementConsole......9
ViewingHardwarePasswordManagerdevicesand
theirproperties...............9
ManagingenrolledusersonHardware
PasswordManagerdevices........10
ConguringanLDAPserverconnection...10
ViewingHardwarePasswordManagerusers
andtheirproperties...........11
Removingauser’saccesstoaHardware
PasswordManagerdevice........12
ManagingHardwarePasswordManager
groups................12
Managingremoteactionsandpolicysettingsfor
HardwarePasswordManagerdevices.....13
Updatingclientpoliciesglobally........14
Updatinghardwarepasswordsglobally.....15
Updatingtheemergencyaccount.......16
Changingserverpolicysettings........17
Deningscopesandrolesforconsoleusers...18
Chapter4.HardwarePassword
ManagerClient............21
HardwarePasswordManagerdevicesetup...21
RegisteringadevicewiththeHardwarePassword
Managerserverandenrollingtherstuser....21
EnrollingadditionalusersonaHardwarePassword
Managerdevice..............22
RemovingauserfromaHardwarePassword
Managerdevice..............23
UnregisteringadevicefromtheHardware
PasswordManagerserver..........23
UpdatingcredentialsonaHardwarePassword
Managerdevice..............24
Chapter5.Deployment........25
Fingerprintintegration............25
SafeGuardEasy/SafeGuardEnterprise
compatibility...............26
One-touchregistration...........26
Pre-registration............27
Userenrollmentonapre-registeredsystem.27
Chapter6.Scenarios.........29
Servicescenarios(congurationchanges)....29
Scenario1-Hardwareconguration
changes...............29
Scenario2-CMOSerror.........29
Scenario3-Replacethengerprintdevice..30
Scenario4-Hardwarepasswordsalready
set.................30
Scenario5-Setupundertheoperatingsystem
(remoteBIOSsettings)..........30
Scenario6-Replacethesystemboard...31
Scenario7-Addaharddiskdrive.....31
Scenario8-Replaceormoveaharddisk
drive.................31
Scenario9-Changetheharddisklocation
withinasystem............32
Scenario10-Removeaharddiskdrive...32
Scenario11-FlashingtheBIOS......32
Scenario12-Registeredsystemcannolonger
accesstheHardwarePasswordManager
server................33
Scenario13-EntertheBIOSsetup.....33
Scenario14-Loaddefaultsettingsinthe
BIOSsetup..............33
Scenario15-Donotprotectallharddrives.33
UserScenarios..............34
Scenario1-ForgotHardwareAccount
credentials,networkconnected......34
Scenario2-ForgotHardwareAccount
credentials,NOTnetworkconnected....34
Scenario3-Forgotthecorporatepassword.34
Scenario4-Manualloginusingdifferent
keyboardtypes............34
Scenario5-Handlingenrollmentfrommultiple
bootpartitions.............35
Scenario6-BitLocker..........35
AppendixA.Securityand
convenience..............37
AppendixB.Disasterrecovery....39
©CopyrightLenovo2010iii

AppendixC.Hintsandtips......43
AppendixD.Notices.........49
Trademarks................50
ivHardwarePasswordManagerDeploymentGuide

Preface
ThisguideisintendedforITadministrators,orthosewhoareresponsiblefordeployingtheLenovo®
HardwarePasswordManager™programoncomputersintheirorganizations.Thepurposeofthisguideisto
providetheinformationrequiredforinstallingHardwarePasswordManagerononeormanycomputers,
providedthatlicensesforthesoftwareareavailableforeachtargetcomputer.TheHardwarePassword
Managerapplicationprovidesapplicationhelp,whichadministratorsanduserscanconsultforinformation
aboutusingtheapplicationitself.
LenovoHardwarePasswordManagerisdevelopedforITprofessionalsandtheuniquechallengesthey
mayencounter.ThisdeploymentguidewillprovideinstructionsandsolutionsforworkingwithHardware
PasswordManager.Ifyouhavesuggestionsorcomments,communicatewithyourLenovoauthorized
representative.Tolearnmoreaboutthetechnologiesthatcanhelpyoulowerthetotalcostofownershipand
tocheckforperiodicupdatestothisguide,gothefollowingWebsite:
http://www.lenovo.com
©CopyrightLenovo2010v

viHardwarePasswordManagerDeploymentGuide

Chapter1.Overview
TheLenovoHardwarePasswordManager(HPM)givesanadministratortheabilitytomanagehardware
passwordsforallregisteredPCdevices.Further,itcreatesthenotionofaBIOS-leveluserIDandpassword
fortheendusertouseasasinglesign-onproxy.ThisuserIDandpasswordcanbesynchronizedwiththe
WindowsIDandpasswordfortheuser.TheuseralsohastheoptiontoauthenticatehimselftoBIOSusing
hisngerprint.Whenthedevicepowerson,theuserisaskedforthesecredentials.Ifprovided,thedevice
willlogintheusertohisdesktop.Thismechanismpreservestheuser'sprivacyandmakesitpossibleforhim
tousethedevice,eventhoughhedoesnotknowwhattheactualhardwarepasswordsare.
WhenHPMisinstalled,theLenovoThinkManagementConsolecoreserveractsastheHPMserver—it
managesandauthenticatesHPMdevices.Inaddition,anActiveDirectoryoreDirectoryLDAPserver
functionsastheauthenticationserverforHardwarePasswordManager—theHPMserverchecksuser
credentialsagainstdataontheLDAPserver.
OnLenovoclientdeviceswhichsupportHPM,theadministratorinstallsanagentthatcontainsaHardware
PasswordManagerapplication.Whentheclientdevicepowerson,itcommunicatesthroughUDPport
50001withtheHPMserver.
Aftertheclienthasbootedtotheoperatingsystem,itusestheHardwarePasswordManagerclientapplication
tocommunicatewithaWebserviceontheserver.ThiscommunicationisthroughanHTTPSchannel.
TheadministratorusestheHPMfeaturesintheThinkManagementConsoletomanageHPMdevicesand
createanddeploypoliciestothesedevices.ThesepoliciesdeterminehowHardwarePasswordManager
isimplementedforthedevices;forexample,theadministratorselectswhichuseroptionsareavailable
onHPMdevicesaspartofthepolicydenition.
©CopyrightLenovo20101

2HardwarePasswordManagerDeploymentGuide

Chapter2.InstallingHardwarePasswordManageron
ThinkManagementConsole
TouseHPMfunctionality,theLenovoThinkManagementConsolemustbeinstalled.Asyoucongurethis
installation,youwilldeneconnectiondetailsforyourLDAPservertoprovideauthenticationservicesfor
HPM.Policiesforhowhardwarepasswordsaregeneratedandhowclientdevicesaremanagedaredened
intheconsoleaswell.
Next,youinstalltheHPMclientsoftwareonindividualLenovodevicesthatsupportHPM.ABIOSsetting
isusedtoenableordisableHPMsupportonthesedevices.ThissettingmustbesettoEnabledforthe
devicetoworkwithHPM.
Aftercompletingtheseinstallationtasks,youcanbeginregisteringLenovoHPMdeviceswiththeHPM
serverandenrollusersonthosedevices.
Prerequisites
ThefollowingitemsshouldbeconsideredpriortoinstallingLenovoThinkManagementConsolewithHPMon
yourserver:
•Theservershouldhaveaccesstotheinternetinordertoobtainprerequisitesandtoactivateafterthe
installationiscomplete.
•TheservershouldhaveastaticIPaddress.
•TheservercannotbeaDomainController.Itisrecommended,however,tohavetheserverjoinadomain.
•TheaccountwithwhichyoulogintotoperformtheinstallationofthecoreservermusthaveAdministrator
privilegesontheserverwithfullread/writeaccess.IdeallythisaccountwouldalsobeaDomain
Administratoraccount.Thisaccountwillbeusedtocreatetheinitialadministrator-levelaccountthatis
usedtologintotheThinkManagementConsole.
Inordertoensureaclean,workinginstallation,thefollowinginstallationorderisrecommended:
1.InstalltheWindows®Server2003R2(32-bit)operatingsystemwithSP2orWindowsServer2008
R2(64-bit)operatingsystem.
2.InstalltheWindowsComponentInternetInformationServices(IIS).
Note:FortheWindowsServer2003R2(32-bit)operatingsystem,thisMUSTbedonebeforeinstalling
ASP.Net.
3.InstallthefollowingWindowsComponents:
•ASP.Net
•SNMP
4.UseWindowsUpdatetoinstallallavailablecriticalupdates.
5.InstallMicrosoft®.NETFramework®2.0orlater.
6.InstallWebServicesEnhancements(WSE)3.0forMicrosoft.NETifyouareusingtheWindowsServer
2008R2(64-bit)operatingsystem,orinstallWebServicesEnhancements(WSE)2.0SP3ifyouareusing
theWindowsServer2003R2(32-bit)operatingsystem.
AftertheThinkManagementConsoleisinstalled,itisrecommendedthatyouenableSecurityandPatch
Managertoobtainupdatesforthisproduct.Intheconsoleapplication,clickHelp➙LANDesk®Help
Wizard➙SecurityUpdatesforaguidetoconguringSecurityandPatchManager.
©CopyrightLenovo20103

Preparingthecoreserver
TheHPMcoreserverwillusetheThinkManagementConsole9.0thatisbasedonLANDeskManagement
Suite9.0.FormoreinformationaboutLANDeskManagementSuitesystemrequirements,gotothefollowing
Website:
http://community.landesk.com/support/docs/DOC-7478
FordetailsonprerequisitesforinstallingThinkManagementConsole9.0,gotothefollowingWebsite:
http://community.landesk.com/support/docs/DOC-6767
ThepreferredplatformforThinkManagementConsole9.0istheWindowsServer2008R2(64-bit)operating
system.ThefollowinginstructionsdescribehowtoconguretheWindowsServer2008R2(64-bit)operating
systemtomeettheThinkManagementConsole9.0prerequisites.
1.InstalltheWindowsServer2008R2(64-bit)operatingsystemfromtheinstallationmedia.Itis
recommendedtoinstalltheserveroperatingsystemagainfortheHPMcoreserver,becauseexisting
operatingsystemimagesmighthaveincompatiblesettingswiththeHPMcoreserver.
2.RunWindowsUpdateandensurethatallnecessarycriticalupdateshavebeenapplied.
3.Namethecoreserver.Itisimportantthatthecoreservernameissetcorrectly.Afterbeinginstalled,an
HPMcoreservercannotberenamed.
4.DisabletheIndexingServiceandWindowsSearchServicebecausetheymightinterferewiththenormal
operationoftheHPMcoreserver.Formoredetails,gototheWebsite:
http://community.landesk.com/support/docs/DOC-7245
5.Addtheapplicationserverrole.
a.ClickStart➙ServerManager.
b.ClickAddRoles.
c.SelectWebServer(IIS).
d.ClickNext.Y ouwillbepromptedtoaddadditionalrequiredfeaturesforthisrole.
e.SelectAddRequiredFeatures.
f.OntheSelectServerRolesscreen,selectApplicationServer.Youwillbepromptedtoadd
additionalrequiredfeaturesforthisrole.
g.ClickAddRequiredFeatures.
h.OntheSelectServerRolesscreen,clickNext.
i.ClickNext.
j.SelectWebServer(IIS)Support.Y ouwillbepromptedtoaddadditionalroleservicesandfeatures.
k.ClickAddRequiredRoleServices.
l.SelectCOM+NetworkAccess.
m.ClickNext.
n.ClickNext.
o.UndertheRoleServicessection,selectedASP,CGI,andServerSideIncludesunderApplication
Development.
p.ScrolldowntothebottomofthelistandselectIIS6ManagementCompatibility.
q.ClickNext.
r.TheConrmInstallationSelectionsdialogboxisdisplayed.ClickInstall.
s.ClickClosewhentheinstallationcompletes.
4HardwarePasswordManagerDeploymentGuide

WhenusingtheWindowsServer2008R2(64-bit)operatingsystem,theMonitoring/Alerts(SNMP)additional
featuremustbeinstalledaswell.
1.ClickStart➙ServerManager.
2.IntheServerManagerconsole,clickFeaturesandthenclickAddFeaturesintherightpaneof
thewindow.
3.SelectSNMPServices.
4.ClickNext.
5.ClickInstall.
6.ClickClose.
WhenusingtheWindowsServer2003R2(32-bit)operatingsystemwithSP2,additionalWindows
componentsmustbeinstalled.
1.ClickStart➙ControlPanel➙AddorRemovePrograms.
2.ClickAdd/RemoveWindowsComponents.
3.Addthefollowingcomponents:
a.ApplicationServer
•ASP.NET
•InternetInformationServices(IIS)
b.ManagementandMonitoringTools
•SimpleNetworkManagementProtocol
4.ClickNext.
5.ForOptionalNetworkingComponents,selectYes.
6.ClickFinish.
7.InstallMicrosoft.NETFramework2.0.
8.Restarttheserver.
WebServicesEnhancements(WSE)3.0forMicrosoft.NETmustalsobeinstalled.Thiscomponentis
providedbyMicrosoftatthefollowingWebsite:
http://www.microsoft.com/downloads/details.aspx?FamilyID=018a09fd-3a74-43c5-8ec1-8d789091255d&displaylang=en
1.DownloadtheMicrosoftWSE3.0.msiinstallerpackagefromthelinkabove.
2.Extracttheinstallerpackageandruntheexecutableonthecoreserver.
3.FollowtheinstructionsintheInstallationdialogboxusingonlythedefaultsettings.
ThinkManagementConsolewithHPMserversetup
MakesuretheLDAPserver(MicrosoftActiveDirectoryorNovelleDirectory)thatactsastheLDAP
authenticationserverforHardwarePasswordManagerisworkingproperly.
ToobtaintheinstallationpackageforThinkManagementConsolewithHPM,registertodownloadfromthe
Websiteathttp://www.landesk.com/lenovo.Aftercompletingtheregistration,youwillreceiveanemailwith
alinktodownloadtheinstallationpackageaswellasLANDeskcredentialsforactivatingthecoreserver
afterinstallation.
Afteryouhavedownloadedtheinstallationpackage,followtheinstructionsbelowtocompletethecore
serverinstallation.
1.LogontotheserverwithAdministratorprivileges.
2.ExtracttheThinkManagement82D.exeinstallationpackage.Copyandpastethepathwherethe
installationsourceleswillbeextractedtototheclipboardforeasieraccess.
Chapter2.InstallingHardwarePasswordManageronThinkManagementConsole5

3.RuntheThinkManagementConsoleAutorun.exefromthelocationwheretheinstallationpackagewas
extractedto.SelectInstallonthecoreserver.FollowthepromptsintheInstallationwizardand
selectRestartNowafterinstallation.
4.ActivatethecoreserverbyenteringyourLANDeskcontactnameandpasswordintheCoreServer
ActivationUtility(internetconnectionrequired).
5.ConguretheLDAPServer:
a.ConnecttheHARDWAREPASSWORDMANAGERserverandLDAPAuthenticationservertonetwork.
b.LaunchtheThinkManagementConsole.
c.Inthetoolbox,thereisaThinkVantageHardwarePasswordManagergroupwiththreeitems:HPM
EnrolledUsers,HPMGroups,andRemoteActionsandPolicySettings.ClickHPMGroupsandthen
clickCongureLDAPserver(thethirdbutton)onthetoolbar.
d.EntertheinformationfortheLDAPserverthatwillserveastheauthenticationserver.Thefollowing
itemsneedtobedenedfortheLDAPserver:
•Hostname:ThenameoftheLDAPserver.
•Port:Theportnumbertocommunicatewiththeserver.Thedefaultportis389forMicrosoft
ActiveDirectory.IfyouneedtoqueryaglobalcatalogtoaccessmultipleActiveDirectory
domains,changetheportto3268.IfyouselectNovelleDirectoryasyourLDAPserver,the
defaultportis636.
•Servertype:Selectthetype,eitherMicrosoftActiveDirectoryorNovelleDirectory.
•Encryptiontype:Selectthetypeofencryptionusedforcommunicationwiththeserver.
•Authorizeduser:
–TheusernameforloggingintotheMicrosoftActiveDirectoryserver.
–Adomain\usernameorsimplyausername.
–TheusernameforloggingintoaNovelleDirectoryserver.
Note:Itisbettertousecn=adminname,o=admincontext.IfBindRestrictionsissettoNone,
adminname.admincontextwillwork.IfBindRestrictionsissettoDisallowanonymoussimple
bind,adminname.admincontextwillnotwork.
–Password:ThepasswordfortheauthorizeduserontheLDAPserver.
e.ClickOKwhentheinformationiscomplete.
ThinkManagementConsolecoreserversetupcompletesnow.
MigratingtoanewLDAPserver
YoumayndthatyouneedtochangetheIPaddressorhostnameofyourLDAPserver.Youmayalsoneed
tochangetoanewserverwithadifferentIPaddress,orevenchangetoadifferenttypeofLDAPserver.
Ifanyofthesechangesoccurs,youneedtocreateanewLDAPserverconguration.Todothis,repeatthe
LDAPcongurationtaskinstep5.ItisrecommendedthatexistingregisteredHPMdevicesbederegistered
andthenregisteredonceagainwiththenewLDAPconguration.Otherwise,thedevicesregisteredwiththe
oldLDAPcongurationwillnotbeabletoperformvariousHPMactionssuchasanintranetaccountlogin.
InstallingHardwarePasswordManageronaLenovodevice
ToaddHardwarePasswordManagerfeaturestoaLenovodevice,youmustdeployanHPMagenttothe
device.Youcandothisbyusingeitherapushorapullmethod.
TodeployanagentwithHardwarePasswordManagerclientfeatures:
6HardwarePasswordManagerDeploymentGuide

1.IntheThinkManagementconsole,clickTools➙Conguration➙AgentConguration.
2.ClickNewontheAgentCongurationtoolbar,andenteranameforthisagentconguration.
3.MakesuretheHardwarePasswordManageroptionisselectedintheAgentComponentstoInstall
section.
4.Savetheconguration.
Ifyouonlyplantouseasingleagentcongurationoryouplantousethepullmethodofdeployment,you
shouldsetthisnewagentcongurationtobethedefaultconguration.
Tomakethisagentcongurationthedefault:
1.IntheAgentCongurationpaneoftheThinkManagementConsoleright-clickthenewagent
conguration.
2.ClickSetasdefault.Agreencheckmarkwillappearovertheiconforthisconguration.
YoucannowusethepushmethodtodeploytheagenttoyourLenovodevices.RefertotheGetting
StartedandDiscoveringandInstallingAgentshelpwizardsundertheHelpmenuintheconsoleformore
information.ForGettingStarted,youonlyneedtoperformtheLaunchtheCongureServicesTooland
CongureSchedulerCredentialssteps.
Notes:
1.Tosimplifythedevicediscoveryprocess,turnofftheWindows®rewall.
2.ForWindowsXP,simplelesharingmustbedisabledontheLenovodevice.Thisisnormallydisabled
bydefaultfordevicesthatlogintoadomain.YoucanturnoffthisoptionfromWindowsExplorer.Click
Tools➙FolderOptions➙View,scrolltothebottomofthelistandclearUsesimplelesharing.
3.ForWindowsVista®itisagoodpracticetoturnUserAccountControloff.
Whentheagentisdeployed,theHPMClientPortalisinstalledonthedevice.ThelenameoftheClientPortal
iscmp_portal.exe,whichislocatedintheC:\ProgramFiles\Lenovo\HardwarePasswordManagerdirectory.
Youcanalsodeploytheagentbyusingthepullmethod.Thismethodinvolvesconnectingtoashared
folderontheHPMserverandrunninganapplicationthatwillinstallthedefaultagentcongurationthat
wasdescribedpreviously.
1.LogintotheLenovodeviceastheDomainAdminorasalocaladministrator.
2.ConnecttotheLDLOGONshareeitherdirectlythroughexplorerorbymappinganetworkdriveto
\\<yourHPMservername>\ldlogonusingtheDomainAdmincredentialsorothercredentialsthat
havebeengivenaccesstothisshare.
3.FromtheshareddrivelaunchWSCFG32.EXE.Adialogboxisdisplayedshowingthecomponentsthat
willbeinstalled.MakesuretheThinkVantageHardwarePasswordManageroptionisselected.
4.Followthepromptstocompletetheagentinstallation.
InsomecasesitmaybenecessarytoincludetheThinkVantageHardwarePasswordManagerclientina
corporateimageordeployedthroughsomeothersystemmanagementtoolorprocess.Toaccommodate
thesescenarios,aself-containedexecutablepackageoftheagentcongurationcanbegeneratedfromthe
console.Thisexecutablewillinstalltheagentwithoutanyuserinteraction.
Tocreateaself-containedexecutableagentinstallationpackage:
1.Right-clickNewagentcongurationintheAgentCongurationpaneoftheThinkManagementConsole.
2.ClicktheCreateself-containedclientinstallationpackage.
3.Specifythefolderwhereyouwanttosavetheexecutableleinthedialogboxdisplayed.
Chapter2.InstallingHardwarePasswordManageronThinkManagementConsole7

Thenameoftheexecutablelewillbebasedonthenameoftheagentconguration.Theprocesswill
runinthebackgroundforaboutaminute.Twoexecutablelesandtwologleswillbecreated.One
executable,designatedby“_with_status”,willprovideaninstallerthatdisplaysinstallationstatustothe
user.Theotherexecutablewillbeinstalledsilently.
8HardwarePasswordManagerDeploymentGuide

Chapter3.ManagingHardwarePasswordManagerdevices
withThinkManagementConsole
TheavailableHardwarePasswordManagerfunctionsintheconsolearedescribedinthefollowingsections:
•“ViewingHardwarePasswordManagerdevicesandtheirproperties”onpage9
•“ManagingenrolledusersonHardwarePasswordManagerdevices”onpage10
•“ConguringanLDAPserverconnection”onpage10
•“ViewingHardwarePasswordManagerusersandtheirproperties”onpage11
•“Removingauser’saccesstoaHardwarePasswordManagerdevice”onpage12
•“ManagingHardwarePasswordManagergroups”onpage12
•“ManagingremoteactionsandpolicysettingsforHardwarePasswordManagerdevices”onpage13
•“Updatingclientpoliciesglobally”onpage14
•“Updatinghardwarepasswordsglobally”onpage15
•“Updatingtheemergencyaccount”onpage16
•“Changingserverpolicysettings”onpage17
ViewingHardwarePasswordManagerdevicesandtheirproperties
IntheNetworkView,aseparatefolderundertheDevicesfolderisaddedforLenovoHardwarePassword
Managerdevicesthathavebeendiscoveredandmanaged.OpenthisHardwarePasswordManageddevices
foldertoviewalistofComputersandHarddisks.
ToviewaHardwarePasswordManagerdevice’sproperties:
1.IntheThinkManagementConsoleNetworkView,expandtheDevicesfolderandthenexpandthe
HardwarePasswordManagerdevicesfolder.
2.ClickeitherComputersorHarddisksdependingonthedevicetypeyouneed.
3.Right-clickthenameofthedeviceandselectHPMproperties.
TheinformationinthePropertiesdialogboxisnoteditable.Thedetailsincludedoneachofthetabsare
summarizedasbelow.
Summary
Passwordslistedonthistabaredimmedbydefault.SelectShowallpasswordtextsatthebottomofthe
tab.Thispreventstheunintentionaldisplayofhardwarepasswords.
•Registrationtimeandstatus:liststhedate/timeofregistrationandcurrentstatus.
•BIOSpasswords:displaysthepasswordsforeachBIOSproleandthedate/timetheprolewaslast
backedup.Thissectionincludesthesupervisorpassword(SVP),whichlogsontothedevicewith
administratoraccess,andthepower-onpassword(POP),whichlogsontothedeviceasauser.
•Harddiskpasswords:listspasswordsforaccessingeachharddiskonthedevice.Thissectiondisplays
themasterpassword,theuserpassword,andanybackuppasswordsthatmighthavebeengenerated
fortheharddisk(clickViewtoviewthelistofbackuppasswords).
•Emergencyadminaccount:liststhecredentialsfortheadministrativeaccountthatcanaccessthe
HardwarePasswordManagerdevice.Theemergencyadminaccountiscreatedoneverydevice.This
credentialcanbeusedinanemergencytoaccessthedevice’sBIOSwithadministratorprivileges.
©CopyrightLenovo20109

Enrolledusers:
AllusersthatareenrolledtoaccesstheHardwarePasswordManagerdevicearelistedonthistab.The
intranetaccountusernameisthenameusedforLDAPuseraccountlogin.Thehardwareaccountusername
isthenameusedtosavedatatothehardwareaccount(asecureareaofnon-volatilememorythatcanonly
beaccessedbythecomputer’sBIOS).TheLDAPpathshowstheuser’slocationintheLDAPservertree(for
example,CN=ADMINISTRATOR,CN=USERS,DC=TESTLAB).
Memberof:
Thistabliststheintranetaccountgroupsthatthedeviceisamemberof.TheLDAPpathshowsthegroup’s
locationintheLDAPservertree.
Remoteactions:
TheRemoteactionssectionlistsallpreviousremoteactionsthathavebeenappliedtothisHardware
PasswordManagerdevice.TheRemoveuserremoteactionssectionlistsusersthatwereenrolledon
thedevicebutwhoseaccesshasbeenremoved.
Clientpolicy:
TheWindowspolicylistshowsthestatusofoperatingsystemrelatedpolicysettingscurrentlyappliedon
thedevice.TheBIOSpolicylistshowsthestatusofBIOS-relatedpolicysettingscurrentlyappliedonthe
device.ThesesettingsareselectedintheUpdateClientPolicydialog;see“Updatinghardwarepasswords
globally”onpage15formoreinformation.
ManagingenrolledusersonHardwarePasswordManagerdevices
WhenaLenovoHardwarePasswordManagerdeviceisregisteredwiththeHardwarePasswordManager
server,themainuserofthatdeviceisenrolledasanauthorizeduserofthatHardwarePasswordManager
device.YoucanenrolladditionalusersoneachHardwarePasswordManagerdevice,byusingtheClient
PortalonthedeviceorbyincludingtheuserinaHardwarePasswordManagergroupthathasrightsto
thatdevice.
TomanageusersforHardwarePasswordManagerdevices,usetheHPMEnrolledUsersoptioninthe
ThinkManagementConsoletoolbox(orclickTools➙ThinkVantageHardwarePasswordManager➙
HPMEnrolledUsers).
UsingtheHPMEnrolledUserstool,youcan
•ConguretheLDAPserverconnection
•ViewalistofHardwarePasswordManagerusers
•ViewthepropertiesofaHardwarePasswordManageruser
•Revokeauser’saccesstoaHardwarePasswordManagerdevice
ConguringanLDAPserverconnection
IntheManageEnrolledUsersview,usersandgroupsarelistedinatreestructurethatdisplaystheusers
andgroupsontheLDAPserveryouuseforHardwarePasswordManagerauthentication.Toviewthattree
structure,youmustrstconguretheLDAPserverconnection.
TheinformationyouenterinthisdialogenablestheHardwarePasswordManagerservertoconnecttothe
LDAPserver,whichcanbeeitheraMicrosoftActiveDirectoryserveroraNovelleDirectoryserver.
10HardwarePasswordManagerDeploymentGuide

YoucanmigratefromoneLDAPservertoanotherwithoutlosingdata.Ifyoundthatyouneedtousea
differentserverforLDAPauthentication,enterthecongurationdataforthenewserver.
TocongureanLDAPserverconnection:
1.ClickHPMEnrolledUsersinthetoolbox(orclickTools➙ThinkVantageHardwarePassword
Manager➙HPMEnrolledUsers).
2.ClickLDAPserver.
3.TypethehostnameoftheLDAPserverintheHostnameeld.
4.Ifyouwanttouseaportotherthanthedefaulttoaccesstheserver,clearUsedefaultportandenter
anotherportnumber.
5.SelectServertype(MicrosoftActiveDirectoryorNovelleDirectory).
6.SelectEncryptiontypefortheserver.
7.TypethecredentialsusedtoaccesstheLDAPserverintheAuthorizeduserandPasswordeld.The
usercanbeintheformofthedomain\usernameorcansimplybetheusername.
ViewingHardwarePasswordManagerusersandtheirproperties
TheHPMEnrolledUserstoolenablesyoutoviewallusersthatareenrolledtoaccessLenovoHardware
PasswordManagerdevices.Youcanviewalistofallusers,oryoucanselectgroupsintheLDAPdirectory
treetoviewsubsetsofthelist.YoucanviewallpropertiesforeachenrolledHardwarePasswordManager
user,includingtheuserID,LDAPpath,groupsthatincludetheuser,anddevicestheuserisenrolledon.
ThesepropertiesarenoteditableinthePropertiesdialogbox.
ToviewenrolledHardwarePasswordManagerusersandtheirproperties:
1.ClickHPMEnrolledUsersinthetoolbox(orclickTools➙ThinkVantageHardwarePassword
Manager➙HPMEnrolledUsers).
2.Toviewallenrolledusers,clickAllusersinthetreestructure.
3.Toviewasubsetofusers,expandanygroupsthatarelistedinthetreestructureandclickagroupname.
4.Toviewauser’sproperties,right-clicktheuserinauserlistandclickProperties.
Note:Y oucanalsoselecttheuserandclickPropertiesonthetoolbar.
OptionsinthePropertiesdialogboxaresummarizedasbelow.
Summary:
ThistabliststheIDandcommonnameoftheuser,thepathintheLDAPtreewheretheuserisfound,and
theuser’scurrentstatus.ThedateandtimewhentheuserwasenrolledasaHardwarePasswordManager
userisalsolisted.
Memberof:
ThistabliststheLDAPgroupstowhichtheuserbelongs,withtheLDAPpathofeachgroup.
Enrolleddevices:
Thistabliststhedevicesonwhichtheuserisenrolled,withthedevicenameandmachineID.
Remoteactions:
Chapter3.ManagingHardwarePasswordManagerdeviceswithThinkManagementConsole11

ThistablistsanyRemoveUseractionsthathavebeenperformedontheuser,includingthenameofthe
devicefromwhichtheuserwasremovedandthedateandtimeofthelaststatuschange.
Removingauser’saccesstoaHardwarePasswordManagerdevice
AfterauserhasbeenenrolledonaHardwarePasswordManagerdevice,youcanremovethatenrollment
iftheusershouldnolongerhaveaccesstothedevice.Toremoveauser,createaremoteactionthatis
appliedtoeachdeviceyouspecify.ThenexttimewhenthedeviceisconnectedtotheHardwarePassword
Managerservertoupdateitspolicy,theuserwillberemovedfromthelistofusersforthatdevice.
ToremoveauserfromaHardwarePasswordManagerdevice:
1.ClickHPMEnrolledUsersinthetoolbox(orclickTools➙ThinkVantageHardwarePassword
Manager➙HPMEnrolledUsers).
2.Intheuserlist,selecttheuser(s).
3.ClickRevokeuseronthetoolbar.
4.IntheCreateRemoteActiondialogbox,clearthecheckboxforoneormoredevicesfromwhich
youwanttoremovetheuser.
5.ClickOK.
ManagingHardwarePasswordManagergroups
HardwarePasswordManagergroupslinkusergroups(asdenedintheLDAPserver)withHardware
PasswordManagerdevices.HardwarePasswordManagergroupsareusefulbecausetheyallowmultiple
userstoaccessoneormoredeviceswithoutindividuallyenrollingeachuseroneachdevice.Whena
deviceisaddedtoagroup,allmembersofthatgrouphavetheaccesstothedeviceandcanusean
intranetaccounttologintothedevice.
WhenyouopentheHPMGroupstool,groupsarelistedintheLDAPtreeview.Eachgroupiscreatedonyour
LDAPserver;youcannotcreateagroupinThinkManagementConsole.However,youcaneditgroups(dene
thegrouprole)anddragdevicesintogroupstoassociatethosedeviceswiththemembersofthegroups.
Intranetaccountgroupsaredistinguishedbytheroledenedfortheusersinthegroup:
•User:anenduserofaHardwarePasswordManagerdevice.
•ServiceTech:anITtechnician,authorizedwithlimitedaccesstothedeviceforservicing.Accesscanbe
limitedtoatimeframe(duration),orthetechniciancanbeauthorizedwithacertainnumberoflogins.
•Administrator:anadministrativeuserauthorizedtoaccessdevices.
Forexample,allmembersofagroupthatisdenedwiththeServiceTechrolecanlogintodevicesinthe
groupforaspeciednumberoftimes.Iftheroleisdenedsotheusercanonlylogintothedevicetwo
times,accesstothedeviceexpiresfortheuserafterthesecondlogin.
ToeditaHardwarePasswordManagergroup:
1.ClickHPMGroupsinthetoolbox(orclickT ools➙ThinkVantageHardwarePasswordManager➙
HPMGroups).
2.IntheLDAPtreeview,clickagroupnameandclickEditIntranetAccountGrouponthetoolbar.Most
itemsintheEditIntranetAccountGroupdialogboxarenoteditable.Y oucanselecttheroleforthe
group;ifyouselectServiceTech,youcanlimittheaccesstoHardwarePasswordManagerdevices.
3.Selecttherolefromthecombobox.
4.SelectWithexpirationifyouwanttolimittheaccesstothedeviceforaperiodoftimeoraspecic
numberoflogins.(ThisappliesonlytoServiceTechusers.)
12HardwarePasswordManagerDeploymentGuide