Frequently Asked Questions (FAQ)

Do I need to install the SSRPM Service?

Yes. SSRPM will not work without the SSRPM Service, and need to be installed and running when using SSRPM. The SSRPM service eventually handles all SSRPM functionality. In most cases only one SSRPM Service needs to be installed.

Can I define my own default questions?

Yes. SSRPM is shipped with a list of default questions, which you can edit. You can define your own default questions as well. These questions can be used for one or more profiles.

Do I need to install the SSRPM User client Software on each workstation?

Yes. The SSRPM User Client Software is needed for all end-users which need to use SSRPM. That's why the software needs to be installed on each of these end-user's workstation(s). Alternatively you can use GPO's (see: Appendix B: Group Policy Objects) to distribute the SSRPM User Client Software through your network. See the "GPO Distribution Guide" for more information, of which the latest version is available on the Tools4ever website.

Is it possible to distribute the SSRPM User Client Software through my network?

Yes. This can be done with the use of GPO's (see: Appendix B: Group Policy Objects). See the "GPO Distribution Guide" for more information, of which the latest version is available on the Tools4ever website.

How can I install the User Client Software without the use of a GPO?

You can run the SSRPM User Client Software installer ('SsrpmUserClientSoftware.msi', which is located by default at: 'C:\Program Files\Tools4ever\SSRPM\Admin Console' on the computer on which the SSRPM Admin Console is installed) on each client workstation.

Will the user be notified that he or she needs to enroll into SSRPM?

The enrollment process is integrated in the user logon procedure. During a user logon the SSRPM Enrollment Wizard will check if a user has already enrolled into SSRPM. If this isn't the case, this Wizard will start the enrollment process automatically.

Is the communication within SSRPM secure?

Yes. SSRPM uses encrypted RPC as a communication protocol, and stores all the end-user answers as an irreversible MD5 encrypted hash value.

Do I need to have Microsoft Access installed for the database?

No. For the database storage, SSRPM will use the standard JET engine, which is running by default on each Windows machine.

Is it possible that another GINA extension is installed on a client computer?

Yes. There are a lot other extensions which add extra functionality to the windows logon system. If such a GINA is installed on a client machine the SSRPM GINA extension will extend this GINA. In this way the functionality of the other GINA extension will stay. This concept is called GINA Chaining.

When are users locked out or blocked from SSRPM?

When a user answers several questions incorrectly after several configurable number of retries which prevents answer guessing by a possible attacker.

When a user is locked out or blocked from SSRPM, is this user locked out from Windows as well?

No. The user will only be locked out from SSRPM, which means that the user (temporarily) cannot use the SSRPM functionality.

Is it possible for a user to do a password reset when he or she is locked out from Windows?

Yes. During a password reset, the SSRPM Service will check if the user is currently locked out from Windows. If so, the service will automatically unlock the user.