Intel® Authenticate – Integration Guide for Microsoft SCCM
Total Page：16
File Type：pdf, Size：1020Kb
Intel® Authenticate Integration Guide for Microsoft* System Center Configuration Manager (SCCM) Version 3.8 Document Release Date: 30 May 2019 Legal Notices and Disclaimers You may not use or facilitate the use of this document in connection with any infringement or other legal analysis concerning Intel products described herein. You agree to grant Intel a non-exclusive, royalty-free license to any patent claim thereafter drafted which includes subject matter disclosed herein. No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this document. The products described may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade. Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or retailer or learn more at intel.com. Intel, Intel vPro, Intel Core, Xeon, and the Intel logo are trademarks of Intel Corporation or its subsidiaries in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others. Microsoft, Windows, and the Windows logo are trademarks, or registered trademarks of Microsoft Corporation in the United States and/or other countries. Java is a registered trademark of Oracle and/or its affiliates. The Bluetooth® word mark and logos are registered trademarks owned by Bluetooth SIG, Inc. and any use of such marks by Intel is under license. © 2016-2019 Intel Corporation Intel® Authenticate – Integration Guide for Microsoft* SCCM ii *Other names and brands may be claimed as the property of others Table of Contents Table of Contents Table of Contents iii 1 Introduction 1 1.1 What is Intel® Authenticate? 1 1.2 Authentication Factors 2 1.2.1 Bluetooth® Proximity 2 1.2.2 Face Recognition 3 1.2.3 Fingerprint 4 1.2.4 Protected PIN 4 1.2.4.1 Protected PIN Settings 5 1.2.4.2 PIN Throttling Mechanism 5 1.2.5 Intel® AMT Location 6 1.2.6 Physical Smartcard 7 1.3 Actions 7 1.3.1 OS Login 8 1.3.1.1 Blocking the Windows* Password 8 1.3.2 VPN Login 9 1.3.3 Walk-Away Lock 10 1.3.4 Custom Actions 10 1.4 Intel Authenticate Components 11 1.4.1 Client and Engine 11 1.4.2 Policies 11 1.4.3 Factor Management Application 12 1.4.4 Intel Authenticate App 13 1.5 Deployment and Security Considerations 13 1.6 Support for Multiple Users 14 2 Client Platform Prerequisites 15 2.1 Prerequisites for Installation 15 2.1.1 Data Migration After Firmware Upgrade 17 2.2 Prerequisites for Bluetooth Proximity 18 2.3 Prerequisites for Fingerprint 19 2.4 Prerequisites for Face Recognition 20 2.5 Prerequisites for Intel AMT Location 20 2.5.1 Configuring Home Domains Using Intel SCS 21 2.5.2 Configuring Home Domains Using ePo Deep Command 22 2.6 Prerequisites for Physical Smartcard 22 2.7 Minimum PowerShell Version 23 2.8 Firewall Policy 23 2.9 Using the Check Tool 24 Intel® Authenticate – Integration Guide for Microsoft* SCCM iii *Other names and brands may be claimed as the property of others Table of Contents 2.9.1 Checking Installation Prerequisites 25 2.9.2 Checking Factors 27 2.9.3 Gathering Data Remotely via WMI 29 3 Setting Up VPN Login 32 3.1 Supported VPN Clients 32 3.2 Configuring the VPN Appliance 32 3.3 Defining the CA Template for VPN Login 33 3.4 Defining VPN Login in the Policy 34 4 Setting Up Certificate-Based OS Login 35 4.1 Considerations when Using Certificates 36 4.2 Defining the CA Template for OS Login 37 4.3 Defining Certificate-Based OS Login in the Policy 38 5 Setting Up Web Login 40 5.1 Defining the CA Template for Web Login 40 5.2 Defining a Web Login Action in the Policy 41 6 Integrating with Microsoft SCCM 43 6.1 Deployment Flow Using SCCM 43 6.2 Supported Versions of SCCM 43 6.3 Preparing a Digital Signing Certificate 44 6.4 Installing the Add-on 46 6.5 What Does the Add-on Create in SCCM? 47 6.6 Creating a Policy 49 6.7 Enabling the Task Sequences 50 6.8 Resetting Factors 51 6.9 Upgrade Flow Using SCCM 52 7 Troubleshooting 53 7.1 Troubleshooting Installation 53 7.2 Troubleshooting Enrollment 53 7.3 Troubleshooting OS Login 55 7.4 Troubleshooting Certificate-Based OS Login 56 7.5 Troubleshooting VPN Login 57 7.6 Troubleshooting Bluetooth Proximity 58 7.7 Troubleshooting Fingerprint 61 7.8 Troubleshooting Face Recognition 64 7.9 Troubleshooting Windows Hello 65 7.10 Using the Support Tool 66 7.10.1 Collecting Logs 67 7.10.2 Restarting Services and Processes 67 Intel® Authenticate – Integration Guide for Microsoft* SCCM iv *Other names and brands may be claimed as the property of others Table of Contents 7.11 Event Viewer IDs 68 8 Other Certificate Management Options 71 8.1 Integrating with Third-Party Middleware 72 8.2 Manually Generating Certificates 73 Intel® Authenticate – Integration Guide for Microsoft* SCCM v *Other names and brands may be claimed as the property of others 1 Introduction 1 Introduction This guide describes how to integrate and use Intel® Authenticate with Microsoft* System Center Configuration Manager (SCCM). Note: Intel Authenticate also has separate integration packages to use when integrating with: • McAfee* ePolicy Orchestrator (McAfee ePO) • Active Directory Group Policy Objects (GPO) For information about how to integrate and deploy with ePO or GPO, refer to the guide in the relevant integration package. 1.1 What is Intel® Authenticate? Intel Authenticate is a true multi factor authentication solution that supports the three different categories of authentication factors: • Something the user knows, like a Personal Identification Number (PIN) • Something the user has, like a smartphone • Something the user is, like their fingerprint The frequency of attacks on Enterprise environments is growing at an alarming rate. The starting point for many security breaches is a compromised login credential. These attacks are successful because most authentication systems store and process authentication data in the software layer. The process of comparing user-submitted data to the stored originals can be vulnerable to attack, modification, or monitoring when done within the environment of the operating system. Intel Authenticate improves security for Enterprise applications and services by strengthening authentication factors and flows. Intel Authenticate supports authentication factors with different levels of security, where factors with the highest level are “hardened” and protected in the hardware of the Intel platform. This makes it difficult for malware and attackers to access or tamper with sensitive authentication data. For each supported action (see Actions on page 7) you can define a combination of authentication factors (see Authentication Factors on the next page) that your end users can use. Note: On non Intel vPro systems, factor sets are limited to a maximum of two factors per set. For example, this factor set is not permitted: {Fingerprint AND Protected PIN AND Face Recognition}. Enforcing a policy that contains more than two factors in a factor set will fail on non Intel vPro systems. This restriction does not apply to Intel vPro systems. On Intel vPro systems, you can define as many factors per factor set as you want. Intel® Authenticate – Integration Guide for Microsoft* SCCM 1 *Other names and brands may be claimed as the property of others 1 Introduction 1.2 Authentication Factors This section describes the authentication factors that are supported by Intel Authenticate. 1.2.1 Bluetooth® Proximity This factor enables the user to enroll their personal / business smartphone as an authentication factor. The entire authentication process using the Bluetooth Proximity factor is automatic and does not require the user to do anything. All they need to do is have their enrolled phone with them when performing the action. This factor has specific prerequisites (see Prerequisites for Bluetooth Proximity on page 18). The security level of this factor depends on the combination of the user’s phone and Windows* version. Window 10 Windows 10 Phone Windows 7 version 1607 version 1703 and higher Android* Protected Protected Protected iPhone* Protected Soft Protected (default) or Soft Note: On Windows 10 version 1703 and higher, the “Protected” security level when using iPhones can be less user friendly. For this combination you need to decide the correct balance of security versus usability for your organization. This is how the different security levels work: • Protected – The phone is enrolled to the user’s platform using a secret code that only the phone and the platform share. The shared code is processed and protected by the hardware on the Intel platform. When the user performs an action for which Bluetooth Proximity is defined as an authentication factor, Intel Authenticate sends an authentication challenge to the phone. If the phone is in close proximity, then the challenge will succeed and the Bluetooth Proximity factor will be accepted. This security level requires the user to install a small app on their phone (see Intel Authenticate App on page 13). • Soft – The phone is enrolled using only Windows Bluetooth pairing. As long as the operating system reports that the phone is “Connected”, the Bluetooth Proximity factor will be accepted.