IBM Security Access Manager for Enterprise Single Sign-On, Version 8.2.1

Lock and Unlock policies

Know the different lock and unlock policies, where to find and set these policies, their descriptions, and their default values.

pid_script_lock_enabled

IMS Entry	Enable lock script during locking of the user's AccessAgent session?
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Whether to enable running the lock script when locking the AccessAgent session of the user. Note: The lock script is run only if the session of the user is visible during locking. In Local User Session Management (LUSM), currently invisible user sessions do not have the lock script executed. The lock script is run regardless of whether there is desktop inactivity or locking is manually triggered. For example, pressing Win+L or tapping an RFID card. The lock script is useful for closing applications when locking a guest AccessAgent session. The lock script can also be used with the unlock script in a Local User Session Management scenario to record any single-instance application that might: be running before lock. be relaunched during unlock. Important: When using Microsoft Windows 7 or later: The lock script is run after the computer locks instead of before the computer locks. The user is not prompted for action upon computer lock. Blocking lock scripts are not supported. The scripts are expected to perform non-blocking actions. For instance, a message box prompt in the script is not supported.
Registry
Type	Boolean
Values	#True: Yes #False: No (default value)
Scope	User
Note	Refreshed on sync.

pid_script_lock_type

IMS Entry	Lock script type
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Type of lock script to run. Note: Effective only if `pid_script_lock_enabled` is enabled. See `pid_script_lock_enabled`.
Registry
Type	Positive integer
Values	#1: Batch (default) #2: VBScript
Scope	User
Note	Refreshed on sync.

pid_script_lock_code

IMS Entry	Lock script code
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Source code of lock script to run. Note: Effective only if `pid_script_lock_enabled` is enabled. See `pid_script_lock_enabled`.
Registry
Type	String
Values
Scope	User
Note	Refreshed on sync.

pid_script_unlock_enabled

IMS Entry	Enable unlock script when user unlocks an existing AccessAgent session?
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Whether to enable the running of the unlock script when the user unlocks an existing AccessAgent session. Note: The unlock script is run only if the user has an existing AccessAgent session and is unlocking the session. The unlock script is not run if the user is unlocking a shared workstation that is: logged on with a generic Windows account and not currently logged on to AccessAgent In this case, the logon script (`pid_script_logon_enabled`) is run instead. The unlock script can be used in Local User Session Management. The script can automatically launch single-instance applications that might be terminated by other users who are logged on to the same workstation. The unlock script is not supported if `pid_lock_option` is `2` (such as transparent screen lock is used).
Registry
Type	Boolean
Values	#True: Yes #False: No (default value)
Scope	User
Note	Refreshed on sync.

pid_script_unlock_type

IMS Entry	Unlock script type
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Type of unlock script to run. Note: Effective only if `pid_script_unlock_enabled` is enabled. See `pid_script_unlock_enabled`.
Registry
Type	Positive integer
Values	#1: Batch (default) #2: VBScript
Scope	User
Note	Refreshed on sync.

pid_script_unlock_code

IMS Entry	Unlock script code
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Source code of unlock script to run. Note: Effective only if `pid_script_unlock_enabled` is enabled. See `pid_script_unlock_enabled`.
Registry
Type	String
Values
Scope	User
Note	Refreshed on sync.

✓

pid_unlock_option

IMS Entry	Unlock computer policy
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Unlock computer policy for controlling who can unlock a computer when it is locked by a user who is logged on to AccessAgent. Same user refers to the same user who locked the computer. Administrator refers to the Windows user with Administrator privilege on that computer. The Wallet must contain the Windows credentials of an Administrator user on that computer. Note: Effective only if `pid_lusm_sessions_max` is `1`. This policy is ignored if `pid_lock_option` is `2` (transparent screen lock). In transparent screen lock mode, any user can unlock the computer. If the policy is set to `3` and a different user tries to unlock the computer, AccessAgent unlocks the computer and displays the current desktop. However, AccessAgent logs on the user to a new Wallet. If the policy is set to `4`, only the same user can unlock the computer and return to the current desktop. For other users, AccessAgent logs off from the old desktop and logs on to the new Wallet. AccessAgent does not require a user to present a second factor. If a new Wallet does not have a desktop account on the computer, the user must log on to Windows. This option is not supported for smart card. Important: Limitations for Microsoft Windows 7 or later versions: Option `3` works only with a Shared Desktop. Option `4` logs off the current AccessAgent logon session without attempting to log on again as a second user.
Registry	`[DO] "UnlockOption"`
Type	DWORD Positive integer
Values	#1: Only the same user can unlock #3: Any user with or without current desktop account Wallet can unlock (default value) #4: Only the same user can unlock, but different user can re-log on to Windows
Scope	Machine User
Note	Refreshed on sync for user policy. Refreshed on use for machine policy.

pid_unlock_different_user_action_countdown_secs

IMS Entry	Confirmation countdown duration, in seconds, for unlocking by a different user
Location	AccessAdmin > User Policy Templates > New template > Create new policy template > AccessAgent Policies > Lock/Unlock Policies AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Confirmation countdown duration, in seconds, for unlocking by a different user. Set the value to 0 to disable confirmation countdown Note: Effective only if `pid_lusm_sessions_max` is `2`. Effective when a user attempts to unlock a computer when another user is already logged on to AccessAgent. If the policy value is not `0`, the user can click the prompt to cancel the switch user. If the user does not confirm, AccessAgent proceeds to unlock the computer.
Registry	`[DO] "UnlockDifferentUserActionCountdownSecs"`
Type	DWORD Non-negative integer
Values	0: to not enable confirmation countdown
Scope	Machine User
Note	Refreshed on sync for user policy. Refreshed on use for machine policy.

pid_lock_option

IMS Entry	Screen lock option
Location	AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Type of screen lock to be used when the computer is locked. Note: If `pid_lusm_sessions_max` is greater than `1`, only policy `1` (ESSO GINA screen lock) is supported. From a transparent screen lock, the user can unlock the computer or switch to another user by presenting a second factor. From a transparent screen lock, the AccessAgent UI is displayed when the IBM® Security Access Manager for Enterprise Single Sign-On Hot Key is pressed. From this screen, the user can manually log off from AccessAgent, which unlocks the computer, and does the actions that are specified by `pid_logoff_manual_action`. The logoff action is available regardless of the setting for `pid_logoff_manual_when_locked_option_enabled`. Even after transparent screen lock is activated, the action that is specified by `pid_desktop_inactivity_action` is still carried out after the period of desktop inactivity elapsed. Then, set `pid_desktop_inactivity_action` to `4`.
Registry	`[DO] "LockOption"`
Type	DWORD
Values	#1: ESSO GINA screen lock (default) #2: Transparent screen lock
Scope	Machine
Note	Refreshed on use.

pid_lock_transparent_text

IMS Entry	Transparent screen lock message
Location	AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Configurable text for transparent screen lock. Note: Effective only if `pid_lock_option` is `2`.
Registry	`[DO] "LockTransparentText"`
Type	SZ
Values	Tap your RFID card or Ctrl-Alt-E to unlock. (default value)
Scope	Machine
Note	The text box can contain up to 40 characters. Refreshed on use.

pid_lock_transparent_hot_key_enabled

IMS Entry	Enable transparent screen lock hot key?
Location	AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Whether the Ctrl-Esc Hot Key sequence is enabled during transparent screen lock. Note: Effective only if `pid_lock_option` is `2` and transparent screen lock is shown. If enabled, this Hot Key is equivalent to the IBM Security Access Manager for Enterprise Single Sign-On Hot Key when the computer is locked. When pressed, the AccessAgent UI is shown on the transparent screen lock. This additional Hot Key is useful for remote access systems (for example, LANDesk) that can send only limited key sequences.
Registry	`[DO] "LockTransparentHotKeyEnabled"`
Type	DWORD
Values	#1: Yes #0: No (default value)
Scope	Machine
Note	Refreshed on use.

pid_unlock_with_win_option

IMS Entry	Option for allowing unlock bypass through Windows
Location	AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Option for unlocking the computer with Windows unlock. Note: Set the policy to `1` for personal workstations, and `2` for shared workstations. Set the policy to `0` if `pid_lusm_sessions_max` is greater than `1`. AccessAgent is logged off when the computer is unlocked with Windows unlock.
Registry	`[DO] "UnlockWithWinOption"`
Type	DWORD
Values	Disabled Windows unlock is always available (default) Windows unlock is available only if AccessAgent is not logged on
Scope	Machine
Note	Refreshed on use.

pid_unlock_user_name_prefill_option

IMS Entry	User name prefill option for unlock prompt
Location	AccessAdmin > Machine Policy Templates > New template > Create new machine policy template > AccessAgent Policies > Lock/Unlock Policies
Description	Option for pre-filling the AccessAgent unlock prompt with a user name. For policy value `0`, the setting for `pid_logon_user_name_prefill_option` applies to the unlock prompt. For policy value `1`, if a user is logged on to AccessAgent, the unlock prompt is pre-filled with the currently logged on user name. If no user is logged on to AccessAgent, the unlock prompt is pre-filled with last logged on user name. This policy is not applicable to private desktop (`pid_lusm_sessions_max` is greater than `1`).
Registry	`[DO] "UnlockUserNamePrefillOption"`
Type	DWORD
Values	#0: Use the user name pre-fill option for logon prompt (default value) #1: Prefill with currently logged on or last logged on user name
Scope	Machine
Note	Refreshed on use.

pid_fast_unlock_enabled

IMS Entry	Enable fast unlock without IMS Server check?
Location	AccessAdmin > Machine Policy Templates > New template > AccessAgent Policies > Lock/Unlock Policies
Description	Whether to allow AccessAgent to unlock a computer using a second authentication factor, without any checks with the IMS Server.
Registry
Type	Boolean
Values	#0: Fast unlock is not enabled #1: Fast unlock is enabled (default value)
Scope	Machine
Note

Feedback