Release Notes: Self Service Reset Password Management

Version 6.56 build 1088, April 26, 2013

Specific changes in SSRPM version 6.56:

New features

General

• Profiles can be assigned to Active Directory security group.

Admin Console

• Added new reporting component 'Database Query'. You can use this component to generate reports based on queries you designed.
• Added a filter option to the tabs: Enrolled Users, Not Enrolled Users and Blocked Users. It filters on the account name and supports only a single wild card character, namely the asterisk '*'. If you want to use the asterisk as a character instead of a wild card, you need to use the escape the wild card functionality by adding forward slash before the asterisk: '\*'.
• Added the option to export selected users from the tabs: Enrolled Users, Not Enrolled Users and Blocked Users to CSV.
• Added the option to send an e-mail to the selected users in the tabs: Enrolled Users, Not Enrolled Users and Blocked Users. The templates can be managed in the 'Templates' tab in the general configuration dialog.

Web interface

• Added CAPTCHA functionality to the web interface. The CAPTCHA can be enabled or disabled based on the configuration.
• Made the web interface mobile friendly. If the website is accessed using a mobile phone, it will load a different style sheet in order to make the website easier to navigate when using a handheld device.

Enrollment wizard

• If a user doesn't need to enter any information he/she is automatically enrolled. This applies to configurations such as: SMS authentication, where the phone number is stored in the Active Directory, and no questions.

Credential Provider

• Removed the Tools4ever logo.
• Windows 8 support

Other

• The installation now also includes an AMDX file.
• Updated the translations of the language files, which now includes Chinese.

Fixes/Changes

General

• Fixed the issue with UNLOCK reports.
• Updated the 'Citrix and Microsoft Terminal Services' guide to correct the implementation procedure of XenApp 6.5.
• Fixed the comparison check when determining if a user is should be excluded based on OU.

Wizard installer

• Fixed update issues with version 6.29 and earlier.
• The installer should also install the x86 bit credential provider on x64 bit machines, because it might be loaded by x86 processes.
• The installer should delete the offline logon data file.
• If a user is not enrolled any longer, remove from offline logon data.
• Fixed the issue that the offline logon data for none of the user accounts was not updated if an error occurred while retrieving the data of one user account. This occurred in scenarios where a user used the laptop, his/her account is deleted and another new user logs in.

Reset Wizard

• If the Reset Wizard switches to the offline mode it adjusts the title of the dialog.
• Fixed the custom error handling issue on the 'specify user' page in the reset wizard.
• Corrected the behaviour of the password complexity rules of fine-grained password policies in Windows 2008.

Admin Console

• Added export button for HTML e-mail templates (notification & authentication).
• Fixed the behaviour that 'Last Enrollments' and 'Last Resets' columns on the dashboard could contained more than 10 users or users who never reset their password. This issue only applies to installations using an MS Access database.

Offline Logon GPO

• Fixed the language settings in the GPO, they were linked to the wrong registry path.
• Fixed the French and German language ADM files now contains a translation of the forgot my password button.

Helpdesk Caller ID Authentication Web Interface

• Fixed the issue that label "Answer" was not translated if the web interface was configured for another language.
• Fixed the issue that username on the page ” GetDataAuthenticateUser.asp” contained the search parameter of the specifyuser.asp form and not the username.
• Fixed the authenticate functionality.
• Added an option in the config file to disable autocomplete for all the input fields of the web interface.
• By default the web interface assumes the answers are maximal 15 characters (configurable), now the web interface dynamically increases the maximum answer length, if necessary, and pad it with a random number. This fixes the issue that helpdesk users were sometimes confronted with an 'out of range' error.

Web interface

• Added client language detection.
• Fixed layout issues for IE6 and IE7.
• Fixed multilingual PCM issue.
• Added an option in the config file to disable auto-complete for all the input fields of the web interface.
• Fixed incorrect error message when the user tries to reset the password using only advanced authentication (no challenge questions).
• Added the send test SMS/Email option to the web interface.

Enrollment wizard

• Fixed the button translation in the "Unenroll confirm"-dialog.
• Fixed the issue that the mobile phone number was not displayed for users that are enrolling for the first time, but where the phone number was stored in the AD.

GINA

• Fixed the compatibility issue with PCM and the SSRPM Offline credential provider.
• If the SSRPM GINA fails to load the next GINA in the chain, it will try to load the MS GINA and display an error in the GINA dialog. This behavior can be disabled using the GPO.

Service

• Improved the application of the prefix used by SMS authentication. The service will only apply the prefix if the phone number starts with a 0 followed by a number in the range of 1-9 and it will remove the leading 0 before adding the prefix.
• Fixed the issue that report component for unenrolled user only displayed results for specified OU's if those OU's where an exact match for OU's that where assigned to a profile.
• Changed the licensing reporting component to display the number of enrolled users if it concerns an "enrolled domain/ou" license and the number of AD users if it concerns a "domain/ou" license.

Version 6.54 build 1086, April 13-th, 2012

Specific changes in SSRPM version 6.54:

New Features:

General

• Multi lingual support for PCM rules

Fixes:

Helpdesk Caller ID authentication Web Interface

• Corrected the search functionality for SSRPM installations using an MS Access database.

Admin Console

• Corrected some spelling errors.

Corrected some spelling errors.

• Corrected the client side validation related to the check whether or not answer is part of the question.

Reset Wizard

• Fixed issues with occurred when switching to a user that did not have any authentication method, such as questions, SMS or email.

Credential Provider

• Fixed the problems with RDP and pass-through authentication. In previous versions of SSRPM the user needed to enter their credentials twice in certain configurations. For example: if they connect, using Remote Desktop, from Windows 7 to another machine with Windows 7(where the SSRPM Client Software was installed). If the SSRPM Credential Provider was not installed the user only needed to enter the credentials once.

Version 6.52 build 1084, March 6th, 2012

Specific changes in SSRPM version 6.52:

New Features:

General

• SSRPM can sent an reset confirmation by e-mail to the end user, if the mail address is present in the Active Directory.
• The notification and advanced authentication email message templates support a few more variables, such as %ACCOUNTNAME% and %RESETTIME%.

Client Software Installer

• The client software installer can be deployed by a single MSI package, which detects whether or not it should install the 32 bit or 64 bit components.

Credential provider

• It is now possible to configure the SSRPM credential provider to wrap another credential provider using a GPO setting.
• Included ADM files to configure the logo and language settings for the Offline Logon credential provider
• Added language files for the offline logon extension software (English, Dutch, French and German).

Helpdesk Caller Identification web interface

• Improvde the interface to make it more user friendly.

Fixes:

Client software installer

• Fixed the installation issues on Windows 7 via GPO.

Website

• Fixed an Internet Explorer 9 compatibility issue.

Wizards

• If user started the client software and the SSRPM service was unreachable, it looked like the wizard did not start. The problem was that the application first tried to communicate with the SSRPM service, before displaying the user interface. In this version that issue is fixed.
• Fixed a potential problem with the offline logon, the data file grew in specific configurations.

GINA

• Added a check to prevent the GINA from loading itself again.

Service

• Fixed the license errors that occurred when the enrollment wizard tried to get the offline logon data.

Version 6.47 build 1079, December 2nd, 2011

Specific changes in SSRPM version 6.47:

New Features:

General

• Changed the license model. Certain functionality of SSPRM is now requires a license with a specific module. Currently SSRPM distinguished 4 modules:
  • Base
  • Advanced Authentication for SMS and E-mail authentication
  • COM Object for using the COM object (i.e. the Web interface)
  • Helpdesk Authentication for using reversible encryption and the Helpdesk Authentication web interface.
  • Offline logon for using the offline logon functionality
• Offline logon functionality. Especially for this functionality SSRPM includes an MSI package with a separate Credential Provider and GINA.

Reset Client

• Password Complexity Manager (PCM) integration. The reset client is now able to show password complexity rules defined by PCM as well as check if the new password meets the requirements defined by that policy.

Service

• Reversible encryption, it is now possible to configure SSRPM to encrypt the answers instead of creating a hash. The advantage of using reversible encryption is that it is possible to use the Helpdesk Authentication web interface.

Helpdesk Caller Identification web interface

• This web interface is intended for helping the helpdesk authenticate users, without the user telling the helpdesk their complete answers to the questions. The helpdesk enters the user name and asks the user to specify specific characters from the answers his/her questions. The service randomly selects which characters are required. For example: Enter the 2nd and 5th character to the question: "In which city was your first job?". The helpdesk caller identification web interface only confirms if the user answered correctly or not. It requires the answers to be stored using clear text or reversible encryption and a license with the module "Helpdesk authentication".

Enrollment wizard

• Added an extra settings to the sms/e-mail authentication configuration. It is possible to allow user to enroll without having to enter a phone number or e-mail address. And it possible to temporarily disable the resend button after clicking on it.

Admin console

• The dashboard has a new style.
• It is now possible to configure SSRPM to require advanced authentication only in specific situations, such as when the user is using:
  • The reset client
  • The web interface
  • The reset client during an offline logon procedure

Website

• New styling
• The website requires a license with the module "COM Object".
• Password Complexity Manager (PCM) integration. The web interface is now able to show password complexity rules defined by PCM.

Credential Provider

• The credential provider shows the Tools4ever logo in the tile.

Documentation

• The GPO Distribution Guide and the Web Interface Guide now include explanations for Windows Server 2008.

Fixes:

Admin console

• In the previous version it was not possible to check the option 'Select new random questions if one or more answers are incorrect' in the dialog 'SSRPM - Configure Random Questions'. This bug has been fixed.

Website

• The website uses the same enrollment options as the client concerning advanced authentication (SMS and e-mail).
• The website selects new random questions if the option 'Select new random questions if one or more answers are incorrect' is active.

Version 6.41 build 1073, June 24th, 2011

Specific changes in SSRPM version 6.41:

New Features:

General

• SMS Authentication: If enabled requires the users to provide an mobile phone number during enrollment to which the SSRPM will send an SMS containing a PIN code, which the user needs to enter during reset.
• Added an extra setting to the e-mail authentication configuration. It is now possible to configure e-mail authentication to allow users, whose e-mail addresses are unknown to SSRPM, to reset their passwords using their current enrollment data. This situation can occur on existing installations, where the users did not re-enroll yet and the e-mail addresses are not stored in the configured data source.
• Updated the challenge questions. If you have an existing installations you can get the new questions by adding the default SSRPM configuration to the database.

Website

• The SSRPM website is now available in the following languages: English, Dutch, French, Portuguese, German, Spanish, Italian, Polish, Czech and Russian.

Fixes:

Credential Provider

• The Credential provider will use the default path to the locale file if none is specified in the GPO

GINA

• The GINA will use the default path to the locale file if none is specified in the GPO

Version 6.36 build 1068, April 29th, 2011

Specific changes in SSRPM version 6.36:

New Features:

Clients

• It is now possible to select method that SSRPM uses to determine the language of the user using the GPO setting "SSRPM Determine Default Language Method".

Website

• Added the French language file for the website.

Fixes:

Service

• Fixed problems with the service installation on Windows 2008.
• Fixed the problems with the e-mail functionality on Windows 2008

Admin Console

• Fixed the installation error "%1 Is Not a Valid Win32 Application"

Credential Provider

• Fixed the issue that the credential provider was not enabled by default if it was installed manually and not by GPO.

Website

• Fixed the unenrollment action
• Updated the dutch language file

Version 6.34 build 1066, Februari 18th, 2011

Specific changes in SSRPM version 6.34:

New Features:

General

• Email authentication: If enabled requires the users to provide an email address during enrollment to which the service will send an email containing a PIN code, which the user needs to enter during reset.
  *Be aware that if you enable this feature on an existing installation, already enrolled users won't be able to reset their passwords. Unless their email addresses are stored in the specified datasource, which could be the SSRPM database or the Active Directory.

Admin Console

• Custom error handling: Allows the administrator to customize specific error message for the clients.

Fixes:

Service

• Fixed the character conversion used by the e-mail protocol. If the service tried to mail a report, containing a character that could not be converted, it would send an empty e-mail.
• Fixed the issues that arose when the hashing method was changed in an active installation.

Admin Console

• In the Reporting Menu there were 2 'delete report' options and 'add report' was missing.
• It is now possible to import reports on Windows 2008, even if the reports are not in the same directory as the executable.

Reset Wizard

• Added Dutch translations for the 'Successful Unlock' dialog.

Version 6.29 build 1061, July 16th, 2010

Specific changes in SSRPM version 6.29:

Clients

• Added Russian to the available languages.

Website

• The website now includes language files for English, Portuguese(Brazilian) and Dutch.

Service

• It is now possible to disable reporting per service.

Several Fixes:

Admin Console

• Fixed the January date bug, which caused the Admin Console to incorrectly display all dates in January.
• Fixed the Sunday date bug, which cause the Admin Console to display the weekday as Sunday in certain dialogs.
• The profile name is no longer changed if the administrator cancels editing the profile.

Credential provider

• It will shows the last logged on user at log on, instead of the "Select a user" screen.

Website

• Canceling the un-enroll action no longer results in the unenrollment of the user.

Version 6.27 build 1059, December 18th, 2009

Specific changes in SSRPM version 6.27:

Service

• The service will now support both the "Domain / OU" and the "Enrolled Domain / OU" licenses.

Reset Wizard

• It is possible to use the GPO to specify a default domain which the SSRPM Reset Wizard should select if available.

Several Fixes:

Service

• The service will now perform a user count during every license check for the new license type. In the previous version this was only done once a week.

Reset wizard

• Fixed for the issue with the 'Forgot my password' link for Windows 7 x64. The 64 bit version registered the Credential provider incorrectly.

Version 6.24 build 1056, November 6th, 2009

Specific changes in SSRPM version 6.24:

Service

• Improved compatibility with Password Synchronization Manager (PSM).
• Improved security, the IP-address which is stored in the log files is now obtained from the RPC.
• Improved security by added logging when reset data is retrieved.
• New license key model:
  • Old licenses will be need to be replaced. To make it more user friendly the service will remain operational during a grace period of 30 days.
  • The new license will be based on the number of enrolled users, instead of the number of users in the Active directory.
  • The new license temporarily allows for the user limit to be exceeded, during which time it can be configured to send warning e-mails. The customer will have a grace period of 30 days to reduce the number of enrolled users or request a new license, during which time the service will remain fully functional.

Admin console

• Added more support for UMRA actions, on unlock, un-enroll, block and unblock events.
• Added a warning dialog to warn an administrator, if one or more licenses requires support and prepare an e-mail to request the required support.
• Added a new report component for the Get Reset Data action.
• Added a log immediately option.

Web site

• Added an check to see if a user is enrolled and the option to un-enroll.
• Improved the security of the web site by adding changes to prevent cross-site scripting.

Enrollment and Reset wizards

• Changed error messages for errors 11001 and 11004.

Several Fixes:

General

• The 64-bit client software installer will now create the correct registry settings.
• The service installer will now properly install the client software.
• Fixed tab order of the Registry Update Client.
• Fixed the issue of case-sensitive answer checking for already enrolled users.

Admin console

• Added a warning dialog should an administrator rename a profile.
• Added extra validation checks when configuring a customized date format.
• Updated the help with an improved explanation of the date format.
• Added an extra check to validate dates from the database to prevent the Admin console from crashing.

Reset wizard

• Added a warning dialog in the client when a profile is unknown.
• Fixed unauthorized action error which occurred in the Reset Client when the service name was not stored in the registry.
• Moved the default focus from the specify-user link to the first edit box in the questions dialog.

Enrollment wizard

• Added date format validation, if a custom date format is illegal, it will be ignored.

Version 6.17 build 1049, July 15th, 2009

Specific changes in SSRPM version 6.17:

Reset wizard

• All icon have a tool tip.
• All controls, text and images are accessible by using the tab-key, if the GPO setting 'TabAllControls' is set to '1'.

Enrollment wizard

• The date in the re-enroll warning be formatted by using a date format specified in the registry. This format should be pushed using the GPO.
• All icon have a tool tip.
• All controls, text and images are accessible by using the tab-key, if the GPO setting 'TabAllControls' is set to '1'.

Gina

• All controls and text are accessible by using the tab-key, if the GPO setting 'TabAllControls' is set to '1'.

Admin Console

• Add dialog to specify a custom date format for the Admin Console.
• Dates are displayed using the date format, if specified.

Several Fixes:

Service

• Fixed a potential bug in the SHA encryption mechanism.
• The Base64 encoder could cause the SSRPM Service to crash.

Version 6.15 build 1047, April 21th, 2009

Specific changes in SSRPM version 6.15:

Profiles

• Most options in the profile can now be changed without having to re-enroll the users.
• An option has been added to limit the amount of resets a user can perform in a specified time frame.

Service

• SSRPM uses MD5 to hash the user answers by default. As of this version, SSRPM can also use SHA256 (only available on Windows 2003 or higher).

Reporting

• A report component has been added to report on unlock account events.

Several Fixes:

General

• Added a retry mechanism to the client connection manager.
• Some variables where compared case sensitive.
• If user name could not be found, SSRPM could crash. It could also cause an 'Invalid parameter was passed' error message in the Admin Console.
• The SSRPM GINA now checks if it actually is starting the SSRPM Reset Wizard.

Admin Console

• When an enrolled user was selected, part of the text remained black. This made it difficult to read the line.
• It could take a very long time to get the enrolled users from the SSRPM service.
• The not enrolled user count was not correctly updated.

Service

• The Base64 encoder could cause the SSRPM Service to crash.

Reset Wizard

• Windows 2008 password complexity rules were not displayed correctly.

COM Object

• If the COM Object was unable to connect to the SSRPM Service, it was possible that it would crash.

Version 6.06 build 1041, August 8th, 2008

Specific changes in SSRPM version 6.06:

Com Object

• The SSRPM COM Object is now available in 64bit.

Documentation

• The web interface has been updated with a topic on how to install the SSRPM Web Interface in a DMZ environment.
• A backup guide has been added. This guide explains how to backup and restore the SSRPM configuration and user data.

Enrollment Wizard

• It is now possible to force the enrollment wizard to stay within the desktop. Users will not be able to move the wizard outside their desktop.

Several Fixes:

Admin Console

• If notify on account unlock is checked and a possible invalid email address has been entered, a warning may be displayed that the parameter is incorrect.

Service

• Some users were unable to connect to the SSRPM Service when starting the reset wizard from the Windows Logon Screen. Because of this a different method of registering the RPC interface was implemented. To enable this feature, a value in the registry called 'RpcServerRegisterIfEx' had to be set to one. As of this release, the default value of this setting is one.
• Fixed a potential crash bug in the database engine.
• Fixed a memory leak in the HTML CSS handling.

Reset Wizard

• The forced unenrollment time was displayed incorrectly when a warning was displayed that the user had to reenroll.
• The help button has been removed from the reset wizard because of potential security issues.

Version 6.04 build 1039, April 4th, 2008

Specific changes in SSRPM version 6.04:

Service

• Several advanced configuration options have been added to SSRPM. A complete description of the advanced options can be found in the implementation guide.

Several Fixes:

Admin Console

• While editing a profile it was possible to configure the profile in such a way that the user had to answer more random questions than the total number of answered questions.

Service

• If certain characters were present in the account name or OU, the password reset could fail.

Version 6.02 build 1037, January 31th, 2008

Several Fixes:

Admin Console

• In specific situations a connection to the SSRPM Service could not be restored after an upgrade. The Admin Console will now retry to connect to the SSRPM Service several times.
• If the user deselected the option to create the database during the SSRPM Service Setup Wizard, a warning was shown to the user. This messages prevented the user from continuing with the wizard.
• If the service settings are updated and the new configuration is incorrect, the configuration is not stored.
• The profile option to generate new random questions each time a question was answered incorrectly, was not working properly.
• The advanced random question options in the profiles were not saved correctly.

Service

• If a corrupt license code was entered, the SSRPM Service could crash.
• A database could not be created or upgraded with MSSQL 2000.
• Rows that were exported to CSV during report generation were not enclosed in double quotes.

Reset Wizard

• If a profile was configured to unlock an account only and the user name was changed during the password reset sequence, the user would still be presented with a finish button. Clicking on the finish button did not finish or advance the wizard.
• If a user was blocked, he could still run the reset wizard and try to answer the questions after which he would be presented with the 'user blocked' message.

Version 6.00 build 1035, December 21th, 2007

Specific changes in SSRPM version 6.00 build 1035:

Failover/Redundancy support

• Together with MS SQL Server SSRPM can be configured to automatically fail over to another SSRPM Service whenever a problem occurs.

Unlock Account

• Users can now choose to only unlock their account.

Mandatory Questions

• Administrator Defined Questions can now be marked 'mandatory'. These types of questions must be answered by the user during enrollment.

Random Questions

• Profiles can now be configured to use random questions. During enrollment the user must answer several questions; during password reset, the user must answer a random subset of these questions.

GINA

• The GINA controls can now be positioned relative to the 'OK' button. This solves compatability issues with several other GINA's.
• The SSRPM GINA automatically detects the presence of the Entrust Entelligence GINA and loads in such a way that no compatability issues will occur.
• An option has been added to load a specific GINA after the SSRPM GINA has loaded.

Advanced configuration

• A registry option has been added to allow domain admins to enroll.
• A registry option has been added to force SSRPM to use specific domain controllers.
• A registry option has been added to register the RPC interface differently. This solves 'error 5' problems when running the SSRPM Reset Wizard from the logon screen.

Profiles

• An option to disable the unlocking of an account during password reset has been added.
• An option to disable password reset has been added. (So that the user can only unlock his account)
• An option to specify the minimum question length has been added.
• An option to specify the minimum answer length has been added.

Reporting

• A new report component has been added to log information regarding SSRPM licensing.
• Reports can now be exported to CSV files.

Other

• Database connection speed has been improved.
• Questions are now globally stored and shared amongst profiles. Editing the question in a profile, will also edit the question in all other profiles.
• Several additional custom messages have been added to the SSRPM User Client Software to clarify why access to the SSRPM service is denied.

Several Fixes:

Admin Console

• On Windows 2000 the Admin Console would not start. The error generated was: "TzSpecificLocalTimeToSystemTime could not be located in the dynamic link library KERNEL32.dll".
• A memory leak could occur when viewing log message details.
• If the service was upgraded whenever the user was asked to upgrade the service, a log of events (and possibly errors) was not displayed.
• If a license was added, it would often be displayed as 'not initialized'. This behaviour has changed: the new license is immediately checked.
• In some cases the browse user dialog would fail to return a correct name.

Enrollment Wizard

• The default enrollment check interval was set to an extremely long time.
• The enrollment check interval could not be set to 0 (which means: 'check always')

Service

• Canonical names longer than 255 characters were not supported.
• Adding dates to the database could fail because of time format differences.

Version 5.00 build 1028, August 31th, 2007

Specific changes in SSRPM version 5.00 build 1028:

Reporting

• Every event in SSRPM is now logged to the SSRPM database. (Enrollment, unenrollment, Password Reset, Account Block) Reports can be generated and sent by email on scheduled intervals. SSRPM is shipped with several default reports. These default reports can be customized and new reports can be created.

Web Interface

• The Web Interface Example has been updated. All of the SSRPM Profile options are now enforced by the web interface itself.

Email

• Keywords can now be used in email addresses.

COM Object

• Password complexity rules can now be retrieved for a specified domain if the profile permits it.

Logging

• The SSRPM Service now writes it's log information to several different log files.

Several Fixes:

General

• Incorrect Login name format fixed. Users can now properly use different syntaxes when specifying their account names.
• The %FAILEDRESETCOUNT% keyword was never resolved in emails.

Web Interface

• If the input was not checked (in for instance the web interface) the user could enroll using the same question multiple times. This was not possible in the Enrollment Wizard.
• A user could enroll with answers shorter than the minumum answer length.

VBScript Example

• A variable was not declared, which caused an error.

Version 4.12 build 1024, August 10th, 2007

Specific changes in SSRPM version 4.12 build 1024:

Move Users

• Users that are moved from one organizational unit to the other are no longer unenrolled. After they have moved to the new OU, they will still be able to reset their password.

Several Fixes:

Credential Provider

• When the 'reset password at next logon' flag was set for a user, the user would be unable to reset their password at the logon screen.

Web Interface

• When a user tried to reset his password while answering one or more questions incorrect, he would be notified that is password was reset. In reality the password was not reset because the SSRPM service rejected the incorrect answers.

Enrollment Management

• A query to the SSRPM database could fail. Because of this it was possible that users would not be automatically unenrolled. This has been fixed.

Version 4.04 build 1020, April 30th, 2007

Specific changes in SSRPM version 4.04:

Database

• Support for Microsoft SQL 2000 and 2005 (all versions) has been added. The SSRPM Service can now store all user information in a Microsoft SQL database.

Automatic unenrollment

• Users that have been deleted from the active directory will be automatically unenrolled from the SSRPM Service. All information regarding this user will be deleted from the SSRPM database.

Several Fixes:

General

• When the Enrollment Wizard or the Reset Wizard failed to connect they would display a 'connect to server' dialog even though messages were disabled through the 'EnrollmentWizardDisableMessages' in the GPO.
• In version 4.00 build 1016 the password reset would fail if the SSRPM service was not installed on a domain controller

Admin Console

• The SSRPM Service upgrade failed sometimes because of unexplained RPC errors.

Service

• The log was filled with (non critical) errors regarding name translation. These errors have been given a different log level which can be turned on or off in the logging tab of the Service Configuration dialog.
• The service sometimes crashed right after an enrollment or password reset if the UMRA connector was enabled. This issue has been fixed.

Reset Wizard

• If a user name was not entered in the edit box in the GINA an error was generated in the Admin Console.
• The WelcomeTitle entry in the LocaleResetWizard.txt file was not used, in stead the WelcomeHeader was used.

GINA

• Custom locale files located on the network were not being loaded properly.

UMRA Connector

• The SSRPM service would rarely crash when trying to load the UMRA COM object.

Version 4.00 build 1016, February 9th, 2007

Specific changes in SSRPM version 4.00:

Vista

• Enhancements to completely support Microsoft Windows Vista. The logon screen of Windows Vista can now be changed so that it features a 'Forgot my Password' link which provides the 'Forgot My Password' button functionality.

Multiplatform

• Connection with Tools4ever's product User Management Resource Administrator (UMRA) for integration with other platforms, systems, databases and applications.

Security

• New features to be able to configure the user re-enrollment and unenrollment:
  • Users can now be warned to re-enroll after a specified interval.
  • User can now be automatically unenrolled after a specified interval.
• New option to force a minimum answer length.
• Support for additional password policy enforcement capabilities: 'Password History' and 'Minimum Password Age'.
• Enhanced e-mail notification in which case specific e-mail addresses can be specified per e-mail notification type.
• Additional logging: The source computer name and IP address is logged when a user enrolls or resets his password.
• New feature to be able to deny users from enrolling into SSRPM. Due to security risks, users with Administrative Privileges are never allowed to enroll into SSRPM.

User Interface

• COM interface to support full end-user web functionality, so that users can enroll and reset their passwords via a web browser.
• New option which allows to enable an answer confirmation box in the SSRPM Enrollment Wizard.

Auditing

• Extra user information is shown within the blocked users overview ('block time', 'block count', 'unblock time' and 'block duration').

Other

• Extra SSRPM Keywords have been added.
• A different locale file can be specified for the SSRPM GINA.

Several Fixes:

General

• When searching for users, only the account name was returned. Now the domain name is included as well.
• When browsing for users, groups or computers the new selection overwrote the current selection. The new selection will now be added to the current selection.

SSRPM Admin Console

• When OU's were moved between profiles in the Manage Profile Dialog, the SSRPM Admin Console could crash.

SSRPM Service

• If a canonical name cannot be translated to an LDAP name, SSRPM would try to convert the name itself. This would result in a failure if the canonical name was not just a domain, but also contained an OU.

SSRPM GINA

• Several possible GINA chaining issues have been fixed.

Version 3.22 build 1010, December 8th, 2006

Several Fixes:

SSRPM Enrollment Wizard

• The GPO 'Check Enrollment Interval' setting was not working. Because of this the Enrollment check was executed once per week.
• The GPO 'Check Enrollment Interval' setting was specified in seconds. The GPO 'Check Enrollment Interval' setting is now specified in hours.
• The date at which the enrollment is checked, was updated every time the Enrollment Wizard successfully connected to the SSRPM Service.

SSRPM Reset Wizard

• The SSRPM Reset Wizard was not translated, when the Portuguese languages was used.

SSRPM GINA

• The GINA (the 'Forgot my password...' button) was not translated to other languages.

SSRPM User Client Software Installer

• If the SSRPM User Client Software was installed together with the SSRPM Admin Console. The Windows Installer would try (and fail) to reboot the computer. Automatic rebooting has been disabled.

Version 3.21 Build 1008, November 24th, 2006

Specific changes in SSRPM version 3.21:

• Multilingual support for the user interface in the SSRPM Enrollment Wizard, SSRPM Reset Wizard, SSRPM GINA and administrator defined questions. SSRPM is shipped with default questions in the following languages: English, French, German, Italian, Spanish, Polish, Portuguese and Dutch.
• Support for x64 Edition-based Windows
• Display details of blocked users

Several Fixes:

SSRPM Admin Console

• Creating or editing a profile: If a user enters a number of questions that must be answered that is higher than the amount of available questions, the user is warned. The user was however not able to change the number anymore.
• Creating or editing a profile: A user was able to enter 0 admin and 0 user defined questions. This is not allowed.
• Service Configuration: The security tab displayed a different icon than the page itself.
• Service Installation Wizard, Installation Options: When the service is not running, a version and build number of 0.00 and 0000 were displayed. This has been changed to 'unavailable'.
• Error dialog: There was not enough space in the dialog for some of the error messages.

SSRPM Service

• When a user from a child domain or a trusted domain tries to connect to the service it receives an error due to a failure in the name translation. The log displays an error 'Failed to initialize name translation'.
• Profile Management: If a user disabled Account Blocking in the profile configuration, users were still blocked when answering too many questions incorrectly.
• License: If a Domain/OU license was used, the users were counted every time.
• Database: Special characters like ' were not handled correctly. This would result in failure to enroll users with names containing these characters.

SSRPM Enrollment Wizard

• Define Question page: When Windows XP themes are enabled the answer edit box displayed '*' characters in stead of bullets.

SSRPM Reset Wizard

• Specify user page/dialog: When only one domain is found it should be selected.
• Reset password page: If the password complexity rules had been disabled and the minimum password length was smaller than 6, the SSRPM Reset Wizard always warned that the password must be longer than 0 characters.

SSRPM GINA

• The SSRPM Reset Wizard always started when a user presses a key on the keyboard and the 'select domain' combobox was active. This only happened at the logon screen, not at the 'locked computer' screen.
• If for some reason the SSRPM Reset Wizard location could not be read from the registry, the SSRPMGINA.DLL could crash.

SSRPM Installer

• The shortcut for the SSRPM help was targeted at the SSRPM Admin Console instead of the help.
• When a Windows installer version of 2 or lower was used, the SSRPM installer appeared to hang during installation/modification or removal. This was due to the fact that the Windows Installer displayed a hidden message box.

SSRPM User Client Software Installer

• If for some reason the 'SSRPMGina.dll' file could not be copied to the system32 folder of a computer, the registry would still be updated. This could result in a failure to load the logon screen when booting a computer.

Version 3.20 Build 1006, October 12th, 2006

First Release

Website

• The website now includes language files for English, Portuguese(Brazilian) and Dutch.

Service

• It is now possible to disable reporting per service.

Several Fixes:

Admin Console

• Fixed the January date bug, which caused the Admin Console to incorrectly display all dates in January.
• Fixed the Sunday date bug, which cause the Admin Console to display the weekday as Sunday in certain dialogs.
• The profile name is no longer changed if the administrator cancels editing the profile.

Credential provider

• It will shows the last logged on user at log on, instead of the "Select a user" screen.

Website

• Canceling the un-enroll action no longer results in the unenrollment of the user.