Deploying the agent via Group Policy Object

The use of Microsoft Group Policy or Group Policy Objects (GPO) enables the SafeNet administrator to centrally manage the agent configuration for users and computers in an Active Directory environment. It allows to configure many important policy settings to provide flexibility and support extensive configuration information.

For more details about the Group Policy and Group Policy Objects, see Group Policy Overview.

Configuring the ADMX and ADML settings

The SafeNet Agent for Windows Logon policy settings are stored in a Windows Administrative Template (ADMX) file. The settings can be edited using the Windows tools. It can be propagated to the entire domain, or be applied to the local computer and domain controllers only.

Open the administrative template and perform the following steps to configure the settings:

1. From the Windows taskbar, select Start > All Programs > Accessories > Run.

2. Enter gpmc.msc and click OK. The Group Policy Management window is displayed.

   

3. Perform one of the following actions:

   • To propagate the settings to all clients in the domain, right-click Default Domain Policy or newly created GPO under the domain node.
   • To apply the settings to the local machine and any other domain controllers in this domain, go to the Domain Controllers node and right-click Default Domain Controllers Policy.

   From the drop down menu, select Edit. The Group Policy Management Editor window is displayed.

4. In the left pane, navigate to Computer Configuration > Policies > Administrative Templates > WLA Policies > AuthGINA. The settings are displayed in the right pane.

5. Enable all the setting as per your requirement, if not already enabled, with default value or user-defined value.

   Click here to see the description of the registry settings available with the agent.

Deploying the agent

Deploying SafeNet Agent for Windows Logon via GPO requires:

• Creating a Distribution Point
• Creating a Group Policy Object
• Adding ADMX and ADML File to Group Policy Object Editor
• Deploying the MSI

Creating a distribution point

To deploy an MSI through GPO, perform the following steps to create a distribution point on the Publishing Server:

1. Log in to the server as an administrator.

2. Create a shared network folder.

   Note

   The shared network folder contains the MSI package and Agent file.

3. Set permissions on this folder to allow access to the distribution package.

4. Copy and paste the SafeNet Agent for Windows Logon MSI file (SafeNet Authentication Service Agent for Win 8-10-2012-2016 x64.msi) and Agent file in the previously created shared network folder.

Creating a Group Policy Object

An MSI package is deployed/distributed through GPO. To create and enforce a new GPO, perform the following steps:

1. From the Windows taskbar, select Start > All Programs > Accessories > Run.

2. Enter gpmc.msc and click OK. The Group Policy Management window is displayed.

3. Expand Forest (your forest) > Domains (your domain).

4. Right-click the Group Policy Objects and select New.

5. Enter a name for your policy and leave Source Starter GPO as none.

6. Right-click the domain name and select Link an Existing GPO.

7. In Select GPO pop-up window, select newly created GPO and click OK.

8. Click the newly created GPO. In the right pane, right-click the linked domain name and select enforce. The GPO will be linked with the domain.

Adding ADMX and ADML File to Group Policy Object Editor

To add the ADMX and ADML file to the GPO Editor, perform the following steps:

1. Copy the Local Group Policy definition (C:\Windows\PolicyDefinitions) to Domain Group Policy (C:\Windows\SYSVOL\sysvol\<domain_name>\Policies).

2. Copy the ADMX file (SafeNetAgentForWindowsLogon.admx) from the package and paste it to the following location:

   C:\Windows\SYSVOL\sysvol\<domain_name>\Policies\PolicyDefinitions

3. Copy the appropriate ADML language file (SafeNetAgentForWindowsLogon.adml) to a language folder under the \PolicyDefinitions.

   For example, in Windows Server 2019, the English language file provided should be written to: C:\Windows\SYSVOL\sysvol\<domain_name>\Policies\PolicyDefinitions\en-US

Deploying the MSI

To deploy the WLA MSI to the client machines, perform the following steps:

1. Open and right-click the GPO and select Edit.

2. In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Software Settings > Software Installation.

   

3. Right-click the Software Installation, and select New > Package.

4. Select the SafeNet Agent for Windows Logon MSI file (SafeNet Authentication Service Agent for Win 8-10-2012-2016 x64.msi) from the previously created shared folder.

5. Select the deployment Method – Assigned and click OK.

6. Double-click MSI and under Deployment tab, click Advanced. Select Ignore language checkbox.

7. On Security tab, select the client machine, give the required permission and click OK.

8. Now, the GPO will have the MSI Installation package. Next time, if the GPO is updated on the client computer, it will silently install the MSI. To apply the changes instantly, use the following command gpupdate /force.

1. Under Details tab, Enabled status displays for the created GPO.

   

Upgrading the agent

Perform the following steps to upgrade the existing WLA package with a new package:

1. Perform Step 1 to Step 4 in Deploying the MSI section.

2. In the Deploy Software pop-up window, select Advanced and click OK.

3. Go to the Upgrades tab and click Add.

   

   The Add Upgrade Package window is displayed.

4. Under Choose a package from, select Current Group Policy Object (GPO) or click Browse to select a specific GPO.

5. Under Package to upgrade, select the desired package from the list, and then select Package can upgrade over the existing package.

6. Click OK.

   

Updating the agent configuration file

Before deploying the updated agent configuration file, ensure that the .agent file contains the required configuration. For more information, see Configuring the agent file.

Deploying the updated agent configuration file

Perform the following steps to deploy the updated .agent file SASPCE_Passwordless_Sample.agent:

1. Click here to download the UpdateAgentConfig_GPO zip file.

2. Unzip the downloaded zip file. It contains the UpdateAgentConfig.cmd command script.

3. Rename the updated .agent file SASPCE_Passwordless_Sample.agent to UpdatedWindowsLogon.agent.

4. Copy and paste the following into a network folder location that must be accessible from the GPO client machine:

   • UpdateAgentConfig.cmd command script
   • UpdatedWindowsLogon.agent file

5. Launch the Group Policy Management Editor on the GPO server or domain controller.

6. In the left pane, navigate to Computer Configuration > Preferences > Windows Settings > Files.

7. Right-click and select New > File. On the New File Properties window, on the General tab, perform the following steps:

   1. From the Action dropdown, select Replace.

   2. In the Source file(s) field, enter the network path of the .agent file. For example, \\Server\Share\DeploymentFiles\UpdatedWindowsLogon.agent.

   3. In the Destination file field, enter C:\Windows\Temp\WlaAgent\UpdatedWindowsLogon.agent.

   4. Click Apply > OK.

   

8. In the left pane, click Control Panel Settings > Scheduled Tasks.

9. Right-click and select New > Immediate Task (At least Windows 7). On the New Task (At least Windows 7) window, perform the following steps:

   On the General tab:

   1. In the Name field, enter UpdateAgentConfig.

   2. Under Security options, click Change User or Group. On the Select User or Group window, in the Enter the object name to select field, enter system, and then click OK.

   3. Select the Run with highest privileges check box.

   4. From the Configure for dropdown, select Windows 7, Windows Server 2008R2.

   

   On the Actions tab:

   1. Click New.

   2. On the New Action window, under Settings > Program/script, enter cmd.exe.

   3. In the Add arguments (optional) field, enter /c "\\Server\Share\DeploymentFiles\UpdateAgentConfig.cmd".

   4. Click OK.

   5. Click Apply.

   

10. To apply the changes immediately, run the following command on the client machine:

    gpupdate/force

Uninstalling the agent

Perform the following steps to uninstall the agent:

1. Perform Step 1 to Step 3 in Creating a Group Policy Object section.

2. Select Group Policy Objects, right-click the desired group policy, and then click Edit.

3. In the left pane, go to Computer Configuration > Policies > Software Settings > Software installation.

4. In the right pane, right-click the software package that you want to uninstall, hover on All Tasks, and then click Remove.

   

5. On the Remove Software window, select Immediately uninstall the software from users and computer, and then click OK.