> This is part 1 of 2 of the full documentation (pages 1–100 of 111). > The content is paginated: fetch every part to see all of it. > Next part: https://docs.enzoic.com/enzoic-for-active-directory/llms-full.txt/1 > Page index: https://docs.enzoic.com/enzoic-for-active-directory/llms.txt # Overview Enzoic for Active Directory v3.0 and Earlier Enzoic for Active Directory is a tool that integrates into Active Directory and enforces additional password rules to prevent users from using compromised credentials. Unlike products that only check passwords after they are saved, thus requiring subsequent reset by the user, Enzoic validates the password at the time it is being selected. Passwords are then continuously monitored to detect if they become compromised – with automated remediation and alerts. It helps organizations with NIST Password Guideline compliance in Active Directory. Learn more in our [technical FAQ](https://support.enzoic.com/support/solutions/70000125966) on Enzoic for Active Directory Find out what’s new in the latest product release [here](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Getting Started** To get started with Enzoic for Active Directory, we recommend you review the [Installation Prerequisites](/enzoic-for-active-directory/v3.0/installation-and-setup/installation-prerequisites) page to ensure your environment is ready. Then follow the instructions in [Setup Instructions](/enzoic-for-active-directory/v3.0/installation-and-setup/setup-instructions) to get the product up and running in your environment. For deployment in larger environments with many domain controllers, you may wish to review our [Automated Deployments](/enzoic-for-active-directory/v3.0/installation-and-setup/automated-deployments) page. If you would like to evaluate the product in a test setting first, we recommend installing it on a Windows Server virtual machine using a product such as VMWare or one of the cloud hosting providers (AWS EC2, Azure VMs, or GCP Compute Engine). Getting up and running in a simple environment like this takes just a few minutes. The Enzoic Client is an optional component which gives your Windows users better information about what is required to select a good password, as well as feedback as to why a selected password may have been rejected if they are changing their password from the Windows Change Password screen. If you’re interested in deploying the Enzoic Client, you can find instructions for how to do so on the [Client Setup Instructions](/enzoic-for-active-directory/v3.0/installation-and-setup/client-setup-instructions) page. If you have backup software that backs up your Active Directory, you’ll want to exclude some of the volatile keys that Enzoic uses. See the [Backup Considerations](/enzoic-for-active-directory/v3.0/product-usage/backup-considerations) page for more information. Finally, if you have a SIEM system and wish to feed information from Enzoic for Active Directory into it, you can take a look at the [Logging and SIEM Integration](/enzoic-for-active-directory/v3.0/product-usage/logging-and-siem-integration) page. # Installation Prerequisites Enzoic for Active Directory v3.0 and Earlier ## **System Requirements** Enzoic for Active Directory supports any Windows Server 2008R2 or later for Forest and Domain functional level. Microsoft .NET Framework 4.5 or newer is required. Enzoic for Active Directory requires an active Internet connection. You can specify a proxy server if you do not want Enzoic for Active Directory communicating directly over the Internet. Please see Firewall Requirements below for the required IP whitelist. ## **Firewall Requirements** Enzoic for Active Directory must be able to contact its servers to look up the compromised status for passwords. If your firewall supports whitelisting by FQDN, whitelist the following FQDNs for outbound communications over TCP port 443 from your domain controllers: ``` api.enzoic.com app-api.enzoic.com cdn.enzoic.com ``` If your firewall cannot whitelist by FQDN, the IP addresses below should be whitelisted for outbound communications over TCP port 443 from your domain controllers. ``` 13.235.194.196 13.48.121.56 13.48.96.148 15.206.40.21 18.196.181.48 3.10.99.236 3.124.25.136 3.231.37.171 3.24.50.155 3.24.93.121 3.9.236.117 34.214.110.33 35.153.27.185 35.163.59.86 35.168.85.109 35.180.249.238 35.181.124.196 52.192.30.99 52.199.52.28 52.212.218.163 52.48.142.122 52.51.10.65 52.79.68.108 52.89.197.157 54.172.238.226 54.180.42.79 54.233.211.111 54.233.236.93 75.2.9.104 99.83.177.145 ``` ## **Antivirus Whitelisting** If you are running any type of heuristics based antivirus software, for example CrowdStrike, you must whitelist the Enzoic processes and files in the following locations: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` Heuristics-based antivirus applications will often interfere with Enzoic’s ability to read and write from Active Directory. ## **Ensure Enzoic Port is Available** Enzoic for Active Directory uses a local port for communications between its processes on each Domain Controller where it is running. The default port is 6164. If this port is being used by other software on the system, unexpected behaviors may result. If necessary, the port can be changed using the following registry setting after install: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` # Setup Instructions Enzoic for Active Directory v3.0 and Earlier Please ensure you’ve reviewed the information on the [Installation Prerequisites](/enzoic-for-active-directory/v3.0/installation-and-setup/installation-prerequisites) page prior to proceeding. ## **Download the Installer** Links to download the most current version (Domain Controllers must all run the same version): [!!! THESE INSTALLERS ARE FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLERS !!!](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/setup-instructions)\ \ **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: 61b29101a9fa2edafe16d972520673cc\ \ **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.0/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: 41112b102564bb359f85c1aabb883b66 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Multiple Domain Controllers** Enzoic for Active Directory needs to be installed on every writable domain controller in the target domain – it is not necessary to install it on read only domain controllers. Note that Enzoic for Active Directory stores its configuration settings in Active Directory, so once it is configured on one domain controller, the configuration settings will replicate to all the domain controllers in the domain. ## **Multiple Domain Environments** Enzoic for Active Directory runs at the domain level and does not support interacting with multiple domains. Its configuration and state are all stored at the domain level. If you have an environment with a multi-domain forest or parent-child domain relationships, Enzoic for Active Directory must be installed and managed separately on each domain in your environment. After installing Enzoic for Active Directory on the first DC in each domain, you will need to run the console application as a domain admin on that domain and go through first time configuration. ## **Setup Wizard Installation** Run the installer, and then reboot the domain controller when prompted. Future upgrades will not generally require a reboot, but the initial install does. Enzoic for Active Directory needs to run on each domain controller; however, it only needs to be configured once. All configuration settings (with the exception of the optional proxy server settings) are stored in Active Directory and automatically shared with all instances of that domain. After the initial reboot, the Setup Wizard will walk you through the configuration process with the following steps. All settings can be modified through the console after initial set-up:
Step 1 - Network Settings Adjust the API timeout duration. This controls how long a user password change will be held waiting for a response from the Enzoic API. If the timeout is reached, the password change will be allowed to go through without checking the user password for compromise. The compromise status will be detected subsequently if Continuous Password Protection is enabled. Although it is completely dependent on your Internet connection, typical response times for the Enzoic API from most locations are less than 500 milliseconds. OPTIONAL: Specify an HTTP proxy server to use if your DC does not have direct Internet access. This setting will need to be configured separately on each Domain Controller.
Step 2 - License Enter the Enzoic License Key provided for your account. You can [register](https://www.enzoic.com/free-trial-2) to obtain a free key
Step 3 - Monitored Entities Specify which Active Directory accounts to protect. You can select any combination of individual users, groups, or containers/OUs. For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Step 4 - One-Click NIST Compliance Choose if you’d like to accept the default settings recommended for NIST 800-63b compliance: * Custom dictionary for context-sensitive words for your business * Common passwords found in cracking dictionaries * Fuzzy matching for common password patterns and substitutions * Continuous monitoring to detect when existing user passwords become vulnerable If you choose NIST 800-63b compliance mode, these settings will be automatically applied and you will get an overall status on the Enzoic Console dashboard indicating whether your current settings in compliance. If you’re unfamiliar with the new NIST 800-63b standard, a quick rundown is [here](https://www.enzoic.com/surprising-new-password-guidelines-nist/) and the full standard can be found [here](https://pages.nist.gov/800-63-3/sp800-63b.html).
Step 5 - Custom Dictionary (only shown when NIST Compliance chosen) **Add Words Specific to Your Business to the Custom Dictionary**\ **(only shown when One-Click NIST Compliance is selected)** If you choose NIST 800-63b compliance mode, you should add words specific to your business and office locations. Add product name(s), your business name(s), names of cities your offices are in, local sports teams, etc. These will be added to the local dictionary and used to prevent passwords containing these terms. Make sure not to include words that are too short or generic, as this will prevent any passwords containing these strings from being used.
Step 6 - Continuous Password Protection Continuous Password Protection checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 7) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Lastly, you can select the Delegate Server used to run Continuous Password Protection scans. This is the DC in your organization which will do the work of checking user passwords for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 7 - Password Policies (not shown when NIST Compliance chosen) **(not shown when One-Click NIST Compliance is selected)** This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking.Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
Step 8 - Administrative Notifications Include one or more email addresses to be notified for administrative events. These events include: 1. Detection of new user password compromise 2. Summary of all users’ compromise status 3. Alert about any service operation errors. An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly.
Step 9 - Test Settings The Test Page allows you to test your settings are working as expected and that the Enzoic API Servers are reachable from your environment. Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.0/product-usage/troubleshooting).
## **Completing Setup** After you have finished the Setup Wizard, you will be placed on the Enzoic Console Dashboard. You will receive a prompt asking if you’d like to run an initial scan of your domain for users with compromised passwords. If you are familiar with the Enzoic AD Lite product, this is essentially the same scan. Proceeding will scan all user passwords in your Active Directory domain to see if the exact password is present in Enzoic’s database of bad passwords (note this scan can take some time for very large domains). At the end of the scan, you will see a dialog with a report showing which users had weak or compromised passwords. From the report, you can select users to perform remediations such as disabling their account or forcing a password change on next login. You may also export the results to a CSV for reference. Completing the setup process above will get you started with some initial settings. You can always tweak the settings from the Monitoring Settings area. # Client Setup Instructions Enzoic for Active Directory v3.0 and Earlier

Sample policy display with Enzoic Client installed

Sample password rejection message with Enzoic Client installed

Enzoic for Active Directory includes an optional Windows client application that can be deployed to domain-joined Windows workstations in your organization to provide users with better feedback and assistance when selecting a new password. The Windows client application augments the built-in Windows password change screen by adding text to indicate what your password requirements are and in the case of a rejected password change, additional details as to the reasons. For example, if a user’s password is rejected due to being a known compromised password, they will be informed of this fact and asked to select a different password. ## **A Note About Windows Credential Providers** Windows is capable of supporting multiple credential providers. A vanilla Windows installation will have a default system credential provider which processes user password-based logins and handles user password changes. Enzoic installs as another credential provider and by default will disable the Windows system credential provider. This is necessary for Enzoic to process password changes and provide the user with feedback. In some environments, other credential providers, such as Windows Hello for Business or 3rd party credential providers which provide multi-factor or biometric authentication, may be present and may be the default provider. Typically the Enzoic Client will NOT be able to coexist with these, since they will generally disable other credential providers on the system and make themselves the default. Therefore, it is either necessary to uninstall these other providers or forego using the Enzoic Client. ## **Download the Client Installer** The installer is available as an MSI to ease deployment via GPO. Microsoft .NET Framework 4.5 is required. Links to download the most current version (Domain Controllers must all run the same version): [THIS INSTALLER IS FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLER](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/client-setup-instructions) \ MD5: 2d68b363f3cecc54b2b942a4739e0877 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Automated Deployment to Multiple Workstations via GPO** You can use GPO push installs to easily install the Enzoic for Active Directory Client to multiple user workstations. Note that the Enzoic Client requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. ### **Steps for Pushing the Enzoic Client via GPO**
Step 1 - Create a Distribution Point 1. Log on to the server you wish to use as a distribution host as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Computers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForADClient.msi` into the distribution point 5. Give the `Domain Computers` security group read access to the `EnzoicForADClient.msi` file in the distribution point. 6. Click Finish.
Step 2 - Create a Group Policy Object (GPO) 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click your domain in the left pane, and then click Create a GPO in this domain, and Link it here…. Note that by default this will deploy the Enzoic Client to all workstations in your domain. If you wish to deploy to a subset, you should apply the GPO to the desired OU or Group. 4. Type `Enzoic Client Distribution` or a name of your choosing, leave Source Starter GPOset to (none), and then click OK.
Step 3 - Prepare the Group Policy Object 1. Right-click the newly created `Enzoic Client Distribution` GPO, and then click Edit… 2. Expand the Computer Configuration, then Policies, then Software Settings nodes in the left pane. 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForADClient.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\server\distribution point share\EnzoicForADClient.msi`. Do not just navigate to the file and select it. 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 4 - Complete the Installation Windows will now install the Enzoic for Active Directory Client on the targeted systems the next time they are restarted.
### **Troubleshooting GPO Deployments** If the client is failing to deploy via GPO, check the following: **Does the GPO apply to the affected system?**\ Check the Scope tab on the GPO in the Group Policy Management Console to ensure the affected workstation(s) are covered by the GPO. **Have the affected workstation(s) been restarted?**\ In some cases it may take two reboot cycles before the GPO gets deployed. **Is the distribution point share and MSI accessible by the affected system(s)?**\ Check that they can access the share and MSI. **Do the affected system(s) have at least .NET Framework 4.5 installed?**\ The MSI will not handle installing this, so you will need to ensure that all target systems have at least .NET Framework 4.5 before pushing the Enzoic Client. **Check the Event Log on the affected system for GPO or install failures occurring after the reboot.** \ If the installer is failing, there should be some indication here. # Upgrade Instructions Enzoic for Active Directory v3.0 and Earlier Upgrading from an older version to the current release is straightforward and only involves running the installer for the current release on each domain controller in the monitored domain. A reboot will not be required after upgrading, unless upgrading from a version older than 2.0. It is safe to upgrade from any previous version to the current release. ## **Download the Installers for the Latest Release** The installer is available as both an MSI and an EXE. The EXE version will install the necessary version of the .NET Framework if it is not already available on your server, while the MSI will not. If in doubt, you should use the EXE installer. Links to download the most current version (Domain Controllers must all run the same version): [THESE INSTALLERS ARE FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLERS](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/upgrade-instructions) **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: 5886d1c2fd245ca8df8509c04eeb40c2 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.0/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: 2d68b363f3cecc54b2b942a4739e0877 Review the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Upgrades in Environments with Multiple Domain Controllers** Enzoic for Active Directory needs to be upgraded on every writable domain controller in the target domain. In organizations where upgrading all servers at once is not possible or permitted, rolling upgrades over longer periods of time are supported. The only restriction is that the server designated as the Enzoic for Active Directory Delegate server in your domain must be upgraded to the new version first. The installer will not allow you to proceed with the upgrade on other DC’s until the Delegate has been upgraded. If you are unsure which Domain Controller in your environment is acting as the Delegate, you may determine this by running the Enzoic Console, going to Settings and clicking on the “Other Settings” tab. The current Delegate will be displayed there. ## **Installing the Upgrade** Run the new installer on each DC in the monitored domain in order to upgrade it. As noted in the section above, you must run the upgrade on the Delegate server in your domain first. After the upgrade is complete, run the Enzoic Console and verify there are no issues displayed on the Dashboard or in System Health. # Automated Deployments Enzoic for Active Directory v3.0 and Earlier ## **Setup with a Configuration File** Starting with version 2.9, Enzoic for Active Directory can be installed and configured headlessly using a YAML configuration file. All of the Enzoic for AD settings can be specified via settings in this file. To get started, download the sample enzoic-config.yml file below and open in a text editor. The settings in the file are documented with comments, but we recommend familiarizing yourself with the product in a test environment first to better understand the various options. Download the sample configuration file: [enzoic-config.yml](https://cdn.enzoic.com/files/enzoic-config.yml) To specify the configuration file during installation, use the MSI version of the installer and pass in two properties: ENZ\_IMPORT\_CONFIG\_FILE – the full path to your YAML configuration file\ ENZ\_PRODUCT\_KEY – your Enzoic for Active Directory product key Sample MSI command line: ``` msiexec.exe /i "c:\EnzoicForAD.msi" ENZ_IMPORT_CONFIG_FILE="c:\path\to\enzoic-config.yml" ENZ_PRODUCT_KEY=”your-product-key” ``` ## **Deploying Enzoic for Active Directory via GPO** You can use GPO push installs to easily install Enzoic for Active Directory across multiple domain controllers in your environment. Note that Enzoic for Active Directory requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. If you are deploying to Windows Server 2008R2, you will need to deploy .NET Framework 4.5 prior to deploying Enzoic for Active Directory.
Step 1 - Create an MST file with your product key and YML config path embedded *(Note this step is optional – if you wish, you may instead install Enzoic for Active Directory on the first domain controller in your environment, configure it as you wish and then push the installer to your other domain controllers via GPO, without needing to use a YML configuration file. In this case, the other domain controllers will pick up the shared configuration directly from Active Directory.)* 1. Download Microsoft’s Windows Installer SDK – [Download](http://download.microsoft.com/download/7/c/4/7c426dfc-46e2-4ded-bab4-3b33600ad7d1/msi45sdk.msi) 2. Install the SDK, Find and Run the Orca install (installs to `C:\Program Files (x86)\Windows Installer 4.5 SDK\TOOLS` by default) 3. Run Orca 4. Open the Enzoic for AD MSI in Orca 5. Open the Transform menu and select “New Transform” 6. Navigate to the Property table in the left pane and edit the values for the following properties in the right hand pane: * ENZ\_IMPORT\_CONFIG\_FILE – enter the UNC network path to your enzoic-config.yml file (this will be the network share distribution point for the GPO) * ENZ\_PRODUCT\_KEY – enter your product key 7. Open the Transform menu and select “Generate Transform”, save the MST file 8. Copy the MSI, MST and YML file to your distribution point in the next step.
Step 2 - Create a Distribution Point 1. Log on to a server in the target domain as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Controllers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForAD.msi` (and optionally the MST and YML file from step 1 above) into the distribution point 5. Give the `Domain Controllers` security group read access to the `EnzoicForAD.msi`file in the distribution point. 6. Click Finish.
Step 3 - Create a Group Policy Object 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click the `Domain Controllers` OU in the left pane, and then click Create a GPO in this domain, and Link it here… 4. Type `Enzoic for Active Directory` and then press ENTER.
Step 4 - Prepare the Group Policy Object 1. Right-click the `Enzoic for Active Directory` GPO, and then click Edit… 2. Expand the Computer Configuration, Policies, and Software Settings 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForAD.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\file server\distribution point share\EnzoicForAD.msi` 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 5 - Complete the Installation Windows installs Enzoic for Active Directory during startup, and then immediately requires a manual restart to load the Password Filter. Restart each Domain Controller to complete the installation.
# Logging and SIEM Integration Enzoic for Active Directory v3.0 and Earlier ## **Log Files** By default, Enzoic for Active Directory stores logs in the following location:\ **`C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs`** The following log files are available:
LogTypeFilename(s)Format(s)Description
ConsoleEnzoicConsole_{logDate}.json
EnzoicConsole_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic console UI.
ServiceEnzoicService_{logDate}.json
EnzoicService_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic service. These tend to be the most useful for troubleshooting and contain details for when a compromised password is found for a user by Compromised Password Protection as well as when a password change is blocked.
FilterEnzoicFilter.txtTXTThese are logs generated by the Enzoic password filter DLL.
Logs rollover and are only stored for the last 7 days. ## **SIEM Integration** Enzoic for Active Directory logs important events to a JSON format log file which can be used for ingestion into SIEM systems. The following describes the information contained in these log entries. Logs files are stored at:\ `C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs` ### **1.1 Log Entry Fields / Structure** Each JSON log entry has the following structure.
FieldDescription
timeTimestamp at which the event occurred.
threadIdThe managed .NET thread ID which was running.
levelLevel of event severity. This can be one of the following: INFO, WARN, ERROR.
eventDataA JSON object containing additional details, specific to the event. The object has one field, “data” containing an object with the actual details.
eventThis is either a message or an enum value indicating the event kind. (see the eventKind field in table 1.2)
### **1.2 Event Data Fields – Common to All Events** The content of eventData varies per the type of logged event, but the following fields are always present.
FieldDescription
eventKindIndicates the nature of the event. See table 1.3 for possible values.
detailsEither a free-form complex object or extended message. Can be null.
### **1.3 Event Kinds**
NameDescription
InfoGeneral informational message.
WarningA recoverable problem or unusual event has occurred.
ErrorA (possibly unrecoverable) problem has occurred, and may require user intervention or investigation.
PasswordChangedUser account password was changed.
PasswordChangeRejectedUser account password change was attempted, but the password did not pass the integrity checks.
CompromiseDetectedDelayedRemediationScheduledA compromised password was detected, and was either remediated, or scheduled for remediation after a delay.
DelayedRemediationActionTakenA previously scheduled remediation was applied.
## **Log Entry Details for Each Event Kind** ### **1.4 Info** Recorded when there is a general informational message. Example: ```json { "time": "2019-08-07 16:24:57.2758", "threadId": "22", "level": "INFO", "event": "Service shutdown.", "eventData": { "data": { "eventKind": "Info", "details": null } } } ``` ### **1.5 Warning** Recorded when a recoverable problem or unusual event has occurred. Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "WARN", "event": "The user tu1 no longer exists. Cleaning up artifacts related to this user.", "eventData": { "data": { "eventKind": "Warning", "details": null } } } ``` ### **1.6 Error** Recorded when a problem has occurred that may require user intervention or investigation. The eventData payload contains the exception details and can be helpful to support for further investigation.
FieldDescription
exceptionClassThe name of the .NET exception class, if there is an exception.
exceptionMessageThe exception message, if there is an exception.
Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "ERROR", "event": "Something bad happened..", "eventData": { "data": { "eventKind": "Error", "details": null, "exceptionClass": "Exception", "exceptionMessage": "Exception text" } } } ``` ### **1.7 PasswordChanged** Recorded when a user password was successfully changed.
FieldDescription
userThe SAM account name of the account that was updated.
Example: ```json { "time": "2019-08-07 15:00:59.9008", "threadId": "16", "level": "INFO", "event": "PasswordChanged", "eventData": { "data": { "user": "tu1", "eventKind": "PasswordChanged", "details": null } } } ``` ### **1.8 PasswordChangeRejected** Recorded when a user password change was rejected by Enzoic due to policy settings.
FieldDescription
userThe SAM account name of the account on which the password change was attempted.
detection methodsEnzoicApi,
LocalDictionary,
PasswordSimilarity,
UserDisplayName,
UserName,
UserEmail
match typesExactMatch,
FuzzyMatch,
RootPasswordMatch
Example: ```json { "time":"2020-09-02 14:15:08.5068", "threadId": "4", "level": "INFO", "event": "The password is compromised and cannot be used. Detected by EnzoicApi and matched on RootPasswordMatch", "eventData": { "data": { "user": "testfosmo", "detectionMethod":"EnzoicApi", "matchTypes":[ "RootPasswordMatch" ], "eventKind": "PasswordChangeRejected", "details": null } } } ``` ### **1.9 CompromiseDetectedDelayedRemediationScheduled** Recorded by Continuous Password Protection when a user password was detected as compromised and a delayed remediation was scheduled (e.g. force password change after 24 hours)
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenIndicates the action that was taken in response to the compromise. See table 1.11 for possible values.
actionDelayHoursThe number of hours before the delayed remediation will take effect . This only applies when actionTaken is ForcePasswordChangeOnLoginDelayed or DisableAccountDelayed
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "CompromiseDetectedDelayedRemediationScheduled", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLoginDelayed", "actionDelayHours": 1, "eventKind": "CompromiseDetectedDelayedRemediationScheduled", "details": null } } } ``` ### **1.10 DelayedRemediationActionTaken** Recorded by Continuous Password Protection when a previously scheduled delayed remediation was taken. For example, if a user was scheduled to force a password change after 24 hours, this event gets logged when the user is set to Force Password Change on Next Logon in AD.
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenPossible values: ForcePasswordChangeOnLogin, DisableAccount
actionDelayHoursAlways zero.
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "DelayedRemediationActionTaken", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLogin", "actionDelayHours": 0, "eventKind": "DelayedRemediationActionTaken", "details": null } } } ``` ### **1.11 Remediation Actions** The possible remediation action values for log events are listed below.
NameDescription
ForcePasswordChangeOnLoginThe affected user account is updated to require the password to be changed on the next login attempt.
ForcePasswordChangeOnLoginDelayedThe affected user account is updated to require the password to be changed on the next login attempt. This action is delayed by the number of configured hours.
DisableAccountThe affected user account is disabled.
DisableAccountDelayedThe affected user account is disabled. This action is delayed by the number of configured hours.
NotifyOnlyAn email notification is sent to the configured recipients. No further remediation is taken.

# Backup Considerations Enzoic for Active Directory v3.0 and Earlier If you are routinely backing up Active Directory in your environment, you may wish to exclude certain volatile Enzoic entries. Enzoic stores its configuration data in Active Directory, as well as some transitory data under the Enzoic container in AD’s System container. Excluding the Enzoic containers which represent this transitory data can prevent exceptions in your backup software, where backups fail due to items getting created and deleted while the backup is running. A list of the AD containers we recommend excluding from your backups is below: ``` System\Enzoic System\DEL-EnzoicTest* ``` # Troubleshooting Enzoic for Active Directory v3.0 and Earlier You can use the following checks to verify the installation completed as expected. * Check windows\system32 and confirm the presence of EnzoicFilter.dll * Check the registry HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa for the presence of Enzoic in the notifications packages value * Check the Event viewer system logs after reboot to confirm there are no errors about indicating a failure to load the EnzoicFilter.dll * Check the product logs at ..\ProgramData\Enzoic\Enzoic. Log files should typically be retrieved from the DC configured as the Delegate Server. You can check which server is the Delegate from the Enzoic Console | Monitoring Settings | Continuous Password Protection area. ## **Network Reachability** If you are seeing problems reaching the Enzoic servers, please review your proxy server settings as well as the [Firewall Requirements section of Install Prerequisites](/enzoic-for-active-directory/v3.0/installation-and-setup/installation-prerequisites#firewall-requirements). ## **Email Notifications Not Being Received** If emails notifications aren’t being received, add **enzoic.com** to your approved senders. If your spam filter requires you to whitelist the Enzoic SMTP servers by IP address, you can determine the current IP address list with the following commands: #### Windows: ``` C:>nslookup -type=TXT amazonses.com | find "v=spf1" ``` #### Linux/OSX: ``` $ dig TXT amazonses.com +short| grep 'v=spf1' ``` This will return the SPF record in use, which will change over time. Example: ``` "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ~all" ``` ## **Enzoic Local Port** Enzoic for Active Directory uses a local port for communications between the password filter and its service. The default port is 6164. If necessary, the port can be changed using a registry setting: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` ## **Antivirus Whitelisting** Some heuristics based antivirus software may trip on Enzoic. To ensure smooth operation, we recommend whitelisting the Enzoic processes and files under: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` # Overview Enzoic for Active Directory v3.2 Enzoic for Active Directory is a tool that integrates into Active Directory and enforces additional password rules to prevent users from using compromised credentials. Unlike products that only check passwords after they are saved, thus requiring subsequent reset by the user, Enzoic validates the password at the time it is being selected. Passwords are then continuously monitored to detect if they become compromised – with automated remediation and alerts. It helps organizations with NIST Password Guideline compliance in Active Directory. Learn more in our [technical FAQ](https://support.enzoic.com/support/solutions/70000125966) on Enzoic for Active Directory Find out what’s new in the latest product release [here](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Getting Started** To get started with Enzoic for Active Directory, we recommend you review the [Installation Prerequisites](/enzoic-for-active-directory/v3.2/installation-and-setup/installation-prerequisites) page to ensure your environment is ready. Then follow the instructions in [Setup Instructions](/enzoic-for-active-directory/v3.2/installation-and-setup/setup-instructions) to get the product up and running in your environment. For deployment in larger environments with many domain controllers, you may wish to review our [Automated Deployments](/enzoic-for-active-directory/v3.2/installation-and-setup/automated-deployments) page. If you would like to evaluate the product in a test setting first, we recommend installing it on a Windows Server virtual machine using a product such as VMWare or one of the cloud hosting providers (AWS EC2, Azure VMs, or GCP Compute Engine). Getting up and running in a simple environment like this takes just a few minutes. The Enzoic Client is an optional component which gives your Windows users better information about what is required to select a good password, as well as feedback as to why a selected password may have been rejected if they are changing their password from the Windows Change Password screen. If you’re interested in deploying the Enzoic Client, you can find instructions for how to do so on the [Client Setup Instructions](/enzoic-for-active-directory/v3.2/installation-and-setup/client-setup-instructions) page. If you have backup software that backs up your Active Directory, you’ll want to exclude some of the volatile keys that Enzoic uses. See the [Backup Considerations](/enzoic-for-active-directory/v3.2/product-usage/backup-considerations) page for more information. Finally, if you have a SIEM system and wish to feed information from Enzoic for Active Directory into it, you can take a look at the [Logging and SIEM Integration](/enzoic-for-active-directory/v3.2/product-usage/logging-and-siem-integration) page. # Installation Prerequisites Enzoic for Active Directory v3.2 ## **System Requirements** Enzoic for Active Directory supports any Windows Server 2008R2 or later for Forest and Domain functional level. Microsoft .NET Framework 4.5.1 or newer is required. Enzoic for Active Directory requires an active Internet connection. You can specify a proxy server if you do not want Enzoic for Active Directory communicating directly over the Internet. Please see Firewall Requirements below for the required IP whitelist. ## **Firewall Requirements** Enzoic for Active Directory must be able to contact its servers to look up the compromised status for passwords. If your firewall supports whitelisting by FQDN, whitelist the following FQDNs for outbound communications over TCP port 443 from your domain controllers: ``` api.enzoic.com app-api.enzoic.com cdn.enzoic.com ``` If your firewall cannot whitelist by FQDN, the IP addresses below should be whitelisted for outbound communications over TCP port 443 from your domain controllers. ``` 13.235.194.196 13.48.121.56 13.48.96.148 15.206.40.21 18.196.181.48 3.10.99.236 3.124.25.136 3.231.37.171 3.24.50.155 3.24.93.121 3.9.236.117 34.214.110.33 35.153.27.185 35.163.59.86 35.168.85.109 35.180.249.238 35.181.124.196 52.192.30.99 52.199.52.28 52.212.218.163 52.48.142.122 52.51.10.65 52.79.68.108 52.89.197.157 54.172.238.226 54.180.42.79 54.233.211.111 54.233.236.93 75.2.9.104 99.83.177.145 ``` ## **Antivirus Whitelisting** If you are running any type of heuristics based antivirus software, for example CrowdStrike, you must whitelist the Enzoic processes and files in the following locations: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` Heuristics-based antivirus applications will often interfere with Enzoic’s ability to read and write from Active Directory. ## **Ensure Enzoic Port is Available** Enzoic for Active Directory uses a local port for communications between its processes on each Domain Controller where it is running. The default port is 6164. If this port is being used by other software on the system, unexpected behaviors may result. If necessary, the port can be changed using the following registry setting after install: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` # Setup Instructions Enzoic for Active Directory v3.2 Please ensure you’ve reviewed the information on the [Installation Prerequisites](/enzoic-for-active-directory/v3.2/installation-and-setup/installation-prerequisites) page prior to proceeding. ## **Download the Installer** Links to download the most current version (Domain Controllers must all run the same version): [!!! THESE INSTALLERS ARE FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLERS !!!](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/setup-instructions) **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: f2f8e753df7d6437afa4bafa27098c88 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.2/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: fefc3d152de7b86a8259f38c738c6ca4 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Multiple Domain Controllers** Enzoic for Active Directory needs to be installed on every writable domain controller in the target domain – it is not necessary to install it on read only domain controllers. Note that Enzoic for Active Directory stores its configuration settings in Active Directory, so once it is configured on one domain controller, the configuration settings will replicate to all the domain controllers in the domain. ## **Multiple Domain Environments** Enzoic for Active Directory runs at the domain level and does not support interacting with multiple domains. Its configuration and state are all stored at the domain level. If you have an environment with a multi-domain forest or parent-child domain relationships, Enzoic for Active Directory must be installed and managed separately on each domain in your environment. After installing Enzoic for Active Directory on the first DC in each domain, you will need to run the console application as a domain admin on that domain and go through first time configuration. ## **Setup Wizard Installation** Run the installer, and then reboot the domain controller when prompted. Future upgrades will not generally require a reboot, but the initial install does. Enzoic for Active Directory needs to run on each domain controller; however, it only needs to be configured once. All configuration settings (with the exception of the optional proxy server settings) are stored in Active Directory and automatically shared with all instances of that domain. After the initial reboot, the Setup Wizard will walk you through the configuration process with the following steps. All settings can be modified through the console after initial set-up:
Step 1 - Network Settings Adjust the API timeout duration. This controls how long a user password change will be held waiting for a response from the Enzoic API. If the timeout is reached, the password change will be allowed to go through without checking the user password for compromise. The compromise status will be detected subsequently if Continuous Password Protection is enabled. Although it is completely dependent on your Internet connection, typical response times for the Enzoic API from most locations are less than 500 milliseconds. OPTIONAL: Specify an HTTP proxy server to use if your DC does not have direct Internet access. This setting will need to be configured separately on each Domain Controller.
Step 2 - License Enter the Enzoic License Key provided for your account. You can [register](https://www.enzoic.com/free-trial-2) to obtain a free key
Step 3 - Monitored Entities Specify which Active Directory accounts to protect. You can select any combination of individual users, groups, or containers/OUs. For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Step 4 - One-Click NIST Compliance Choose if you’d like to accept the default settings recommended for NIST 800-63b compliance: * Custom dictionary for context-sensitive words for your business * Common passwords found in cracking dictionaries * Fuzzy matching for common password patterns and substitutions * Continuous monitoring to detect when existing user passwords become vulnerable If you choose NIST 800-63b compliance mode, these settings will be automatically applied and you will get an overall status on the Enzoic Console dashboard indicating whether your current settings in compliance. If you’re unfamiliar with the new NIST 800-63b standard, a quick rundown is [here](https://www.enzoic.com/surprising-new-password-guidelines-nist/) and the full standard can be found [here](https://pages.nist.gov/800-63-3/sp800-63b.html).
Step 5 - Custom Dictionary (only shown when NIST Compliance chosen) **Add Words Specific to Your Business to the Custom Dictionary**\ **(only shown when One-Click NIST Compliance is selected)** If you choose NIST 800-63b compliance mode, you should add words specific to your business and office locations. Add product name(s), your business name(s), names of cities your offices are in, local sports teams, etc. These will be added to the local dictionary and used to prevent passwords containing these terms. Make sure not to include words that are too short or generic, as this will prevent any passwords containing these strings from being used.
Step 6 - Password Change Screening (not shown when NIST Compliance chosen) **(not shown when One-Click NIST Compliance is selected)** Select whether you want Enzoic to screen user password changes. When enabled, users who are in one of the monitored groups or OU’s will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password. You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however. The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
Step 7 - User Password Monitoring User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 8) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Lastly, you can select the Delegate Server used to run User Password Monitoring scans. This is the DC in your organization which will do the work of checking user passwords for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 8 - User Credentials Monitoring (if licensed) Note that this page will be omitted if your license isn’t enabled for User Credentials Monitoring. When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs. The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 7) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from those used for Password Monitoring, so you can use different text specific to this alert type if you prefer. Lastly, you can select the Delegate Server used to run User Credentials Monitoring scans. This is the DC in your organization which will do the work of checking user credentials for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 9 - Password Policies (not shown when NIST Compliance chosen) **(only shown when One-Click NIST Compliance is selected)** This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking.Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
Step 10 - Administrative Notifications Include one or more email addresses to be notified for administrative events. These events include: 1. Detection of new user password compromise 2. Summary of all users’ compromise status 3. Alert about any service operation errors. An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly.
Step 11 - Test Settings The Test Page allows you to test your settings are working as expected and that the Enzoic API Servers are reachable from your environment. Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.2/product-usage/troubleshooting).
## **Completing Setup** After you have finished the Setup Wizard, you will be placed on the Enzoic Console Dashboard. You will receive a prompt asking if you’d like to run an initial scan of your domain for users with compromised passwords. If you are familiar with the Enzoic AD Lite product, this is essentially the same scan. Proceeding will scan all user passwords in your Active Directory domain to see if the exact password is present in Enzoic’s database of bad passwords (note this scan can take some time for very large domains). At the end of the scan, you will see a dialog with a report showing which users had weak or compromised passwords. From the report, you can select users to perform remediations such as disabling their account or forcing a password change on next login. You may also export the results to a CSV for reference. Completing the setup process above will get you started with a single default monitoring policy and some initial settings. You can always tweak the settings from the Console Settings or Monitoring Policies area. # Client Setup Instructions Enzoic for Active Directory v3.2

Sample policy display with Enzoic Client installed

Sample password rejection message with Enzoic Client installed

Enzoic for Active Directory includes an optional Windows client application that can be deployed to domain-joined Windows workstations in your organization to provide users with better feedback and assistance when selecting a new password. The Windows client application augments the built-in Windows password change screen by adding text to indicate what your password requirements are and in the case of a rejected password change, additional details as to the reasons. For example, if a user’s password is rejected due to being a known compromised password, they will be informed of this fact and asked to select a different password. ## **A Note About Windows Credential Providers** Windows is capable of supporting multiple credential providers. A vanilla Windows installation will have a default system credential provider which processes user password-based logins and handles user password changes. Enzoic installs as another credential provider and by default will disable the Windows system credential provider. This is necessary for Enzoic to process password changes and provide the user with feedback. In some environments, other credential providers, such as Windows Hello for Business or 3rd party credential providers which provide multi-factor or biometric authentication, may be present and may be the default provider. Typically the Enzoic Client will NOT be able to coexist with these, since they will generally disable other credential providers on the system and make themselves the default. Therefore, it is either necessary to uninstall these other providers or forego using the Enzoic Client. ## **Download the Client Installer** The installer is available as an MSI to ease deployment via GPO. Microsoft .NET Framework 4.5 is required. Links to download the most current version (Domain Controllers must all run the same version): [THIS INSTALLER IS FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLER](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/client-setup-instructions)\ \ \ MD5: fefc3d152de7b86a8259f38c738c6ca4 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Automated Deployment to Multiple Workstations via GPO** You can use GPO push installs to easily install the Enzoic for Active Directory Client to multiple user workstations. Note that the Enzoic Client requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. ### **Steps for Pushing the Enzoic Client via GPO**
Step 1 - Create a Distribution Point 1. Log on to the server you wish to use as a distribution host as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Computers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForADClient.msi` into the distribution point 5. Give the `Domain Computers` security group read access to the `EnzoicForADClient.msi` file in the distribution point. 6. Click Finish.
Step 2 - Create a Group Policy Object (GPO) 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click your domain in the left pane, and then click Create a GPO in this domain, and Link it here…. Note that by default this will deploy the Enzoic Client to all workstations in your domain. If you wish to deploy to a subset, you should apply the GPO to the desired OU or Group. 4. Type `Enzoic Client Distribution` or a name of your choosing, leave Source Starter GPOset to (none), and then click OK.
Step 3 - Prepare the Group Policy Object 1. Right-click the newly created `Enzoic Client Distribution` GPO, and then click Edit… 2. Expand the Computer Configuration, then Policies, then Software Settings nodes in the left pane. 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForADClient.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\server\distribution point share\EnzoicForADClient.msi`. Do not just navigate to the file and select it. 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 4 - Complete the Installation Windows will now install the Enzoic for Active Directory Client on the targeted systems the next time they are restarted.
### **Troubleshooting GPO Deployments** If the client is failing to deploy via GPO, check the following: **Does the GPO apply to the affected system?**\ Check the Scope tab on the GPO in the Group Policy Management Console to ensure the affected workstation(s) are covered by the GPO. **Have the affected workstation(s) been restarted?**\ In some cases it may take two reboot cycles before the GPO gets deployed. **Is the distribution point share and MSI accessible by the affected system(s)?**\ Check that they can access the share and MSI. **Do the affected system(s) have at least .NET Framework 4.5 installed?**\ The MSI will not handle installing this, so you will need to ensure that all target systems have at least .NET Framework 4.5 before pushing the Enzoic Client. **Check the Event Log on the affected system for GPO or install failures occurring after the reboot.** \ If the installer is failing, there should be some indication here. # Upgrade Instructions Enzoic for Active Directory v3.2 Upgrading from an older version to the current release is straightforward and only involves running the installer for the current release on each domain controller in the monitored domain. A reboot will not be required after upgrading, unless upgrading from a version older than 2.0. It is safe to upgrade from any previous version to the current release. ## **Download the Installers for the Latest Release** The installer is available as both an MSI and an EXE. The EXE version will install the necessary version of the .NET Framework if it is not already available on your server, while the MSI will not. If in doubt, you should use the EXE installer. Links to download the most current version (Domain Controllers must all run the same version): [THESE INSTALLERS ARE FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLERS](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/upgrade-instructions)\ \ **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: f2f8e753df7d6437afa4bafa27098c88 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.2/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: fefc3d152de7b86a8259f38c738c6ca4 Review the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Upgrades in Environments with Multiple Domain Controllers** Enzoic for Active Directory needs to be upgraded on every writable domain controller in the target domain. In organizations where upgrading all servers at once is not possible or permitted, rolling upgrades over longer periods of time are supported. The only restriction is that the server designated as the Enzoic for Active Directory Delegate server in your domain must be upgraded to the new version first. The installer will not allow you to proceed with the upgrade on other DC’s until the Delegate has been upgraded. If you are unsure which Domain Controller in your environment is acting as the Delegate, you may determine this by running the Enzoic Console, going to Settings and clicking on the “Other Settings” tab. The current Delegate will be displayed there. ## **Installing the Upgrade** Run the new installer on each DC in the monitored domain in order to upgrade it. As noted in the section above, you must run the upgrade on the Delegate server in your domain first. After the upgrade is complete, run the Enzoic Console and verify there are no issues displayed on the Dashboard or in System Health. # Automated Deployments Enzoic for Active Directory v3.2 ## **Setup with a Configuration File** Starting with version 2.9, Enzoic for Active Directory can be installed and configured headlessly using a YAML configuration file. All of the Enzoic for AD settings can be specified via settings in this file. To get started, download the sample enzoic-config.yml file below and open in a text editor. The settings in the file are documented with comments, but we recommend familiarizing yourself with the product in a test environment first to better understand the various options. Download the sample configuration file: [enzoic-config.yml](https://cdn.enzoic.com/files/enzoic-config-3.2.yml) To specify the configuration file during installation, use the MSI version of the installer and pass in two properties: ENZ\_IMPORT\_CONFIG\_FILE – the full path to your YAML configuration file\ ENZ\_PRODUCT\_KEY – your Enzoic for Active Directory product key Sample MSI command line: ``` msiexec.exe /i "c:\EnzoicForAD.msi" ENZ_IMPORT_CONFIG_FILE="c:\path\to\enzoic-config.yml" ENZ_PRODUCT_KEY=”your-product-key” ``` ## **Deploying Enzoic for Active Directory via GPO** You can use GPO push installs to easily install Enzoic for Active Directory across multiple domain controllers in your environment. Note that Enzoic for Active Directory requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. If you do not already have the .NET Framework 4.5 on your servers prior to deploying Enzoic for Active Directory, you will need to deploy that first.
Step 1 - Create an MST file with your product key and YML config path embedded *(Note this step is optional – if you wish, you may instead install Enzoic for Active Directory on the first domain controller in your environment, configure it as you wish and then push the installer to your other domain controllers via GPO, without needing to use a YML configuration file. In this case, the other domain controllers will pick up the shared configuration directly from Active Directory.)* 1. Download Microsoft’s Windows Installer SDK – [Download](http://download.microsoft.com/download/7/c/4/7c426dfc-46e2-4ded-bab4-3b33600ad7d1/msi45sdk.msi) 2. Install the SDK, Find and Run the Orca install (installs to `C:\Program Files (x86)\Windows Installer 4.5 SDK\TOOLS` by default) 3. Run Orca 4. Open the Enzoic for AD MSI in Orca 5. Open the Transform menu and select “New Transform” 6. Navigate to the Property table in the left pane and edit the values for the following properties in the right hand pane: * ENZ\_IMPORT\_CONFIG\_FILE – enter the UNC network path to your enzoic-config.yml file (this will be the network share distribution point for the GPO) * ENZ\_PRODUCT\_KEY – enter your product key 7. Open the Transform menu and select “Generate Transform”, save the MST file 8. Copy the MSI, MST and YML file to your distribution point in the next step.
Step 2 - Create a Distribution Point 1. Log on to a server in the target domain as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Controllers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForAD.msi` (and optionally the MST and YML file from step 1 above) into the distribution point 5. Give the `Domain Controllers` security group read access to the `EnzoicForAD.msi`file in the distribution point. 6. Click Finish.
Step 3 - Create a Group Policy Object 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click the `Domain Controllers` OU in the left pane, and then click Create a GPO in this domain, and Link it here… 4. Type `Enzoic for Active Directory` and then press ENTER.
Step 4 - Prepare the Group Policy Object 1. Right-click the `Enzoic for Active Directory` GPO, and then click Edit… 2. Expand the Computer Configuration, Policies, and Software Settings 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForAD.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\file server\distribution point share\EnzoicForAD.msi` 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 5 - Complete the Installation Windows installs Enzoic for Active Directory during startup, and then immediately requires a manual restart to load the Password Filter. Restart each Domain Controller to complete the installation.
# Enzoic Product Console Enzoic for Active Directory v3.2 The Enzoic Product Console allows you to configure and monitor the function of the Enzoic for Active Directory installation on a single domain. It is installed by the Enzoic for Active Directory installer. It is necessary to run the Enzoic Console application from a Domain Administrator account on a computer joined to the domain you wish to configure. It is possible to install the Enzoic Console standalone on any version of Windows using the Enzoic for Active Directory installer – it is not necessary to run it from a server. ## **Using the Console** [Dashboard](/enzoic-for-active-directory/v3.2/product-usage/enzoic-product-console/dashboard)\ [System Health](/enzoic-for-active-directory/v3.2/product-usage/enzoic-product-console/system-health)\ [Monitoring Policies](/enzoic-for-active-directory/v3.2/product-usage/enzoic-product-console/monitoring-policies)\ [Settings](/enzoic-for-active-directory/v3.2/product-usage/enzoic-product-console/settings)\ [Reporting](/enzoic-for-active-directory/v3.2/product-usage/enzoic-product-console/reporting)\ [License](/enzoic-for-active-directory/v3.2/product-usage/enzoic-product-console/license) # Dashboard Enzoic for Active Directory v3.2
* Product upgrade notifications when new versions are available * Overall monitoring status, along with which groups are being monitored * A list of users who have compromised passwords * A list of users who have compromised credentials * NIST 800.63b compliance status, if the 1-click NIST Compliance feature is enabled * Current license status # System Health Enzoic for Active Directory v3.2
The System Health page will alert you to any error conditions that have been detected in your Enzoic for Active Directory installation. A list of all the DC’s that are running Enzoic in your domain will appear, along with reachability status, version information and any errors detected on each. # Monitoring Policies Enzoic for Active Directory v3.2

Monitoring Policies Page

The Monitoring Policies page of the Enzoic Console allows you to add, edit, and delete new Monitoring Policies. Note that if you are on a Business level license, you will be limited to a single policy named “Primary”, but for other license levels you will be able to define multiple monitoring policies to target different groups and OU’s with different monitoring settings. ## **Adding or Removing Policies** Adding or Removing policies can be done from the left hand pane, titled Policies, by using the Add and Remove buttons at the bottom of the list view. Note that it is not possible to remove the default policy. To add a new policy, click Add, select whether you want to copy the settings from an existing policy or start blank, and click OK. The new policy will appear on the right hand pane and you may edit from there. Remember to click “Update Configuration” when finished. It is necessary to select at least one OU/group/user to monitor on the Monitored Entities page in order to save the new policy. See the Policy Settings section below for more details about the various settings available. ## **Policy Precedence** Enzoic does not prevent you from including the same user under multiple policies, since it’s possible a user could end up under multiple policies later as group, OU or container memberships change. Instead policies are applied in order of precedence. If a user is included under multiple policies, the first matching policy in precedence order would be used, as follows: the (Default) policy will be checked first, then remaining policies in alphabetical order. If you are in doubt which policy is being applied to a specific user, you can enter their username on the Test Page to check which policy is being used. You can also view which policy they are falling under with the Monitored Users Report under Reporting. ## **Policy Settings** The following settings are available on each policy, grouped by tab title:
Monitored Entities Monitored Entities Tab Specifies which Active Directory accounts to protect with this policy. You can select any combination of individual users, groups, or containers/OUs.For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Password Changes Password Changes Tab Specifies whether you want Enzoic to screen user password changes for users covered by this policy. When enabled, users will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password.You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however.The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
Password Monitoring Password Monitoring Tab User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email.
Credentials Monitoring Credentials Monitoring Tab When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs.The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from the email customization settings that may be configured for Password Monitoring, so you can use different text specific to credentials alerts here if you prefer.
Password Policies Password Policies Tab This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. #### **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. #### **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking. Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
# Settings Enzoic for Active Directory v3.2 The Settings page of the Enzoic Console allows you to modify settings that aren’t specific to a monitoring policy, such as the local DC’s proxy server settings, your organization’s Custom Password Dictionary, Administrative Notification settings, Enzoic Client settings, the DC used as the Delegate Server, and the 1-click NIST Compliance feature. ## **Network Settings**

Network Settings Tab

This tab contains settings for the password change check timeout and the local DC’s proxy server settings. * **Password Check Timeout**\ This setting controls the timeout when making calls to the Enzoic API during user password change operations. If this timeout is exceeded while waiting for a response from the Enzoic API, the operation will fail and the password change will be allowed through. * **Proxy Server Settings**\ These are the proxy server settings in use for the DC that you are running the console on. Proxy server settings are stored locally to each DC and must be edited from the local Enzoic Console on that system. ## **Custom Password Dictionary**

Custom Password Dictionary Tab

The Custom Password Dictionary allows you to add words or terms you wish to block from inclusion in user passwords. These can be words specific to your business or your location, e.g. local sports teams, your city name, etc. If a user password contains one of these words, it will be rejected. ## **Admin Notifications**

Admin Notifications Tab

This is the list of Administrator email addresses to be notified for administrative events. These events include: * Detection of new user password compromise * Summary of all users’ compromise status * Alert about any service operation errors An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly. The Periodic Summary contains a digest of the activity for the time period covered: users with compromised passwords, users with compromised credentials, remediation actions being taken and their current status, etc. ## **Client Settings**

Client Settings Tab

These are settings specific to the Enzoic Client, which is installed on user Windows systems. The Enzoic Client provides additional information to users on the Windows password change screen, including what the policy requirements are for a new password and the reasons a password was rejected. For more information on deploying the Enzoic Client, see [Client Setup](/enzoic-for-active-directory/v3.2/installation-and-setup/client-setup-instructions). The settings on this page control the following: * **Disable Enzoic Password Credential Provider**\ This can be used as a bailout if for some reason a problem with the Enzoic Client is blocking a user from being able to sign into their system. Checking this allows you to temporarily disable the Enzoic Clients throughout this domain. * **Disable System Password Credential Provider**\ This setting instructs the Enzoic Client to disable the default Windows system credential provider. This is a necessary step for the Enzoic provider to work properly and is generally recommended to leave on. If you have a 3rd party credential provider installed on Windows clients in your organization, you might want to disable this setting in order to disable the other credential providers in a different way. ## **Other Settings**

Other Settings Tab

This page is where the 1-click NIST Compliance feature can be enabled or disabled and where you may change the DC currently set as your Delegate Server. * **1-Click NIST Compliance**\ Enabling this setting will enable a new widget on your Enzoic Console Dashboard, showing you your current NIST 800.63b compliance status. Any settings which are currently out of compliance will be called out there. * **Delegate Server**\ The Delegate Server is the DC in your organization which performs the Password and Credentials Monitoring scans. These scans occur in an evenly spaced out manner over the course of the day and are generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems. # Reporting Enzoic for Active Directory v3.2 The Reporting page of the Enzoic Console allows you to see statistics about how many password change operations Enzoic has checked for your organization, how many were matched, as well as how many password/credentials have been checked by your continuous monitoring features. This is also where you’ll find the Monitored Users report, which contains a detailed breakdown of which users in your organization are currently being monitored by Enzoic for Active Directory and what the current status of their password security is. The dropdown menu in the upper right of this page allows you to select which report you’d like to view. ## **Password Change Report**

Sample Password Change Report

This report shows you a statistical view over time of how many user password change operations have been checked by Enzoic and how many of those ended up being matches with a compromised or weak password (i.e. the new password was rejected). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). ## **Continuous Monitoring Report**

Sample Continuous Monitoring Report

This report shows you a statistical view over time of how many user passwords and credentials were scanned by the continuous monitoring functions (User Password Monitoring and User Credentials Monitoring). It also indicates how many of those checks ended up being matches with a compromised or weak password or credentials (i.e. the user’s password or credentials were flagged as compromised). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). ## **Monitored Users Report**

Sample Monitored Users Report

This report shows you a list of all the users currently being monitored by Enzoic for Active Directory, along with a Compromised status for each user. For each user, you can also see what the current status is for Password Monitoring and Credentials Monitoring. The filter dropdown at the top right allows you to further filter the report, so you can, for instance, just see users with currently compromised passwords.The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Monitored Users Report Fields**
FieldDescription
PolicyThe current effective monitoring policy for this user.
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
Password MonitoringIndicates whether Password Monitoring is active for this user. Possible values are Yes, No, or Limited. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks and indicate only an exact match with the user’s current password would be caught (i.e. things like fuzzy matching won’t work). Force a password change for this user to rectify this condition.
Credentials MonitoringIndicates whether Credentials Monitoring is active for this user. Possible values are Yes, No, or Pending. Pending indicates Enzoic has not observed a password change for this user to cache their current password. Until then, we will not be able to monitor this user’s credentials for compromise. Force a password change for this user to rectify this condition.
CompromisedThe user’s current compromise status. See possible status values in the section below.
#### **Compromise Status Values** The potential values for the Compromised column are as follows:
ValueDescription
Password CompromisedIndicates this user’s password was found to be compromised during a Password Monitoring scan.
Credentials CompromisedIndicates this user’s credentials (exact email/password combination) were found to be compromised during a Credentials Monitoring scan.
No (Limited Check)Indicates that while the user’s current password and credentials are not known to be compromised, currently a limited check is being used. A limited check indicates that we do not have the exact password cached, so only an exact match with a compromised password would be flagged. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks. Once this user changes their password, the Limited restriciton will be removed.
NoIndicates the user’s password and/or credentials are being checked completely and no compromise has been identified.
# License Enzoic for Active Directory v3.2
The License page of the Enzoic Console allows you to check your license status, verify license details, and, if necessary, switch to a different product key. # Test Page Enzoic for Active Directory v3.2
The Test Page of the Enzoic Console allows you to test that your settings are working as expected and that the Enzoic API Servers are reachable from your environment.Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.2/product-usage/troubleshooting). # Logging and SIEM Integration Enzoic for Active Directory v3.2 ## **Log Files** By default, Enzoic for Active Directory stores logs in the following location:\ **`C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs`** The following log files are available:
LogTypeFilename(s)Format(s)Description
ConsoleEnzoicConsole_{logDate}.json
EnzoicConsole_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic console UI.
ServiceEnzoicService_{logDate}.json
EnzoicService_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic service. These tend to be the most useful for troubleshooting and contain details for when a compromised password is found for a user by Compromised Password Protection as well as when a password change is blocked.
FilterEnzoicFilter.txtTXTThese are logs generated by the Enzoic password filter DLL.
Logs rollover and are only stored for the last 7 days. ## **SIEM Integration** Enzoic for Active Directory logs important events to a JSON format log file which can be used for ingestion into SIEM systems. The following describes the information contained in these log entries. Logs files are stored at:\ `C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs` ### **1.1 Log Entry Fields / Structure** Each JSON log entry has the following structure.
FieldDescription
timeTimestamp at which the event occurred.
threadIdThe managed .NET thread ID which was running.
levelLevel of event severity. This can be one of the following: INFO, WARN, ERROR.
eventDataA JSON object containing additional details, specific to the event. The object has one field, “data” containing an object with the actual details.
eventThis is either a message or an enum value indicating the event kind. (see the eventKind field in table 1.2)
### **1.2 Event Data Fields – Common to All Events** The content of eventData varies per the type of logged event, but the following fields are always present.
FieldDescription
eventKindIndicates the nature of the event. See table 1.3 for possible values.
detailsEither a free-form complex object or extended message. Can be null.
### **1.3 Event Kinds**
NameDescription
InfoGeneral informational message.
WarningA recoverable problem or unusual event has occurred.
ErrorA (possibly unrecoverable) problem has occurred, and may require user intervention or investigation.
PasswordChangedUser account password was changed.
PasswordChangeRejectedUser account password change was attempted, but the password did not pass the integrity checks.
CompromiseDetectedDelayedRemediationScheduledA compromised password was detected, and was either remediated, or scheduled for remediation after a delay.
DelayedRemediationActionTakenA previously scheduled remediation was applied.
## **Log Entry Details for Each Event Kind** ### **1.4 Info** Recorded when there is a general informational message. Example: ```json { "time": "2019-08-07 16:24:57.2758", "threadId": "22", "level": "INFO", "event": "Service shutdown.", "eventData": { "data": { "eventKind": "Info", "details": null } } } ``` ### **1.5 Warning** Recorded when a recoverable problem or unusual event has occurred. Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "WARN", "event": "The user tu1 no longer exists. Cleaning up artifacts related to this user.", "eventData": { "data": { "eventKind": "Warning", "details": null } } } ``` ### **1.6 Error** Recorded when a problem has occurred that may require user intervention or investigation. The eventData payload contains the exception details and can be helpful to support for further investigation.
FieldDescription
exceptionClassThe name of the .NET exception class, if there is an exception.
exceptionMessageThe exception message, if there is an exception.
Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "ERROR", "event": "Something bad happened..", "eventData": { "data": { "eventKind": "Error", "details": null, "exceptionClass": "Exception", "exceptionMessage": "Exception text" } } } ``` ### **1.7 PasswordChanged** Recorded when a user password was successfully changed.
FieldDescription
userThe SAM account name of the account that was updated.
Example: ```json { "time": "2019-08-07 15:00:59.9008", "threadId": "16", "level": "INFO", "event": "PasswordChanged", "eventData": { "data": { "user": "tu1", "eventKind": "PasswordChanged", "details": null } } } ``` ### **1.8 PasswordChangeRejected** Recorded when a user password change was rejected by Enzoic due to policy settings.
FieldDescription
userThe SAM account name of the account on which the password change was attempted.
detection methodsEnzoicApi,
LocalDictionary,
PasswordSimilarity,
UserDisplayName,
UserName,
UserEmail
match typesExactMatch,
FuzzyMatch,
RootPasswordMatch
Example: ```json { "time":"2020-09-02 14:15:08.5068", "threadId": "4", "level": "INFO", "event": "The password is compromised and cannot be used. Detected by EnzoicApi and matched on RootPasswordMatch", "eventData": { "data": { "user": "testfosmo", "detectionMethod":"EnzoicApi", "matchTypes":[ "RootPasswordMatch" ], "eventKind": "PasswordChangeRejected", "details": null } } } ``` ### **1.9 CompromiseDetectedDelayedRemediationScheduled** Recorded by User Password Monitoring when a user password was detected as compromised and a delayed remediation was scheduled (e.g. force password change after 24 hours)
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenIndicates the action that was taken in response to the compromise. See table 1.11 for possible values.
actionDelayHoursThe number of hours before the delayed remediation will take effect . This only applies when actionTaken is ForcePasswordChangeOnLoginDelayed or DisableAccountDelayed
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "CompromiseDetectedDelayedRemediationScheduled", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLoginDelayed", "actionDelayHours": 1, "eventKind": "CompromiseDetectedDelayedRemediationScheduled", "details": null } } } ``` ### **1.10 DelayedRemediationActionTaken** Recorded by User Password Monitoring when a previously scheduled delayed remediation was taken. For example, if a user was scheduled to force a password change after 24 hours, this event gets logged when the user is set to Force Password Change on Next Logon in AD.
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenPossible values: ForcePasswordChangeOnLogin, DisableAccount
actionDelayHoursAlways zero.
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "DelayedRemediationActionTaken", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLogin", "actionDelayHours": 0, "eventKind": "DelayedRemediationActionTaken", "details": null } } } ``` ### **1.11 Remediation Actions** The possible remediation action values for log events are listed below.
NameDescription
ForcePasswordChangeOnLoginThe affected user account is updated to require the password to be changed on the next login attempt.
ForcePasswordChangeOnLoginDelayedThe affected user account is updated to require the password to be changed on the next login attempt. This action is delayed by the number of configured hours.
DisableAccountThe affected user account is disabled.
DisableAccountDelayedThe affected user account is disabled. This action is delayed by the number of configured hours.
NotifyOnlyAn email notification is sent to the configured recipients. No further remediation is taken.

# Backup Considerations Enzoic for Active Directory v3.2 If you are routinely backing up Active Directory in your environment, you may wish to exclude certain volatile Enzoic entries. Enzoic stores its configuration data in Active Directory, as well as some transitory data under the Enzoic container in AD’s System container. Excluding the Enzoic containers which represent this transitory data can prevent exceptions in your backup software, where backups fail due to items getting created and deleted while the backup is running. A list of the AD containers we recommend excluding from your backups is below: ``` System\Enzoic System\DEL-EnzoicTest* ``` # Troubleshooting Enzoic for Active Directory v3.2 You can use the following checks to verify the installation completed as expected. * Check windows\system32 and confirm the presence of EnzoicFilter.dll * Check the registry HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa for the presence of Enzoic in the notifications packages value * Check the Event viewer system logs after reboot to confirm there are no errors about indicating a failure to load the EnzoicFilter.dll * Check the product logs at ..\ProgramData\Enzoic\Enzoic. Log files should typically be retrieved from the DC configured as the Delegate Server. You can check which server is the Delegate from the Enzoic Console | Monitoring Settings | Continuous Password Protection area. ## **Network Reachability** If you are seeing problems reaching the Enzoic servers, please review your proxy server settings as well as the [Firewall Requirements section of Install Prerequisites](/enzoic-for-active-directory/v3.2/installation-and-setup/installation-prerequisites#firewall-requirements). ## **Email Notifications Not Being Received** If emails notifications aren’t being received, add **enzoic.com** to your approved senders. If your spam filter requires you to whitelist the Enzoic SMTP servers by IP address, you can determine the current IP address list with the following commands: #### Windows: ``` C:>nslookup -type=TXT amazonses.com | find "v=spf1" ``` #### Linux/OSX: ``` $ dig TXT amazonses.com +short| grep 'v=spf1' ``` This will return the SPF record in use, which will change over time. Example: ``` "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ~all" ``` ## **Enzoic Local Port** Enzoic for Active Directory uses a local port for communications between the password filter and its service. The default port is 6164. If necessary, the port can be changed using a registry setting: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` ## **Antivirus Whitelisting** Some heuristics based antivirus software may trip on Enzoic. To ensure smooth operation, we recommend whitelisting the Enzoic processes and files under: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` # Overview Enzoic for Active Directory v3.3 Enzoic for Active Directory is a tool that integrates into Active Directory and enforces additional password rules to prevent users from using compromised credentials. Unlike products that only check passwords after they are saved, thus requiring subsequent reset by the user, Enzoic validates the password at the time it is being selected. Passwords are then continuously monitored to detect if they become compromised – with automated remediation and alerts. It helps organizations with NIST Password Guideline compliance in Active Directory. Learn more in our [technical FAQ](https://support.enzoic.com/support/solutions/70000125966) on Enzoic for Active Directory Find out what’s new in the latest product release [here](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Getting Started** To get started with Enzoic for Active Directory, we recommend you review the [Installation Prerequisites](/enzoic-for-active-directory/v3.3/installation-and-setup/installation-prerequisites) page to ensure your environment is ready. Then follow the instructions in [Setup Instructions](/enzoic-for-active-directory/v3.3/installation-and-setup/setup-instructions) to get the product up and running in your environment. For deployment in larger environments with many domain controllers, you may wish to review our [Automated Deployments](/enzoic-for-active-directory/v3.3/installation-and-setup/automated-deployments) page. If you would like to evaluate the product in a test setting first, we recommend installing it on a Windows Server virtual machine using a product such as VMWare or one of the cloud hosting providers (AWS EC2, Azure VMs, or GCP Compute Engine). Getting up and running in a simple environment like this takes just a few minutes. The Enzoic Client is an optional component which gives your Windows users better information about what is required to select a good password, as well as feedback as to why a selected password may have been rejected if they are changing their password from the Windows Change Password screen. If you’re interested in deploying the Enzoic Client, you can find instructions for how to do so on the [Client Setup Instructions](/enzoic-for-active-directory/v3.3/installation-and-setup/client-setup-instructions) page. If you have backup software that backs up your Active Directory, you’ll want to exclude some of the volatile keys that Enzoic uses. See the [Backup Considerations](/enzoic-for-active-directory/v3.3/product-usage/backup-considerations) page for more information. Finally, if you have a SIEM system and wish to feed information from Enzoic for Active Directory into it, you can take a look at the [Logging and SIEM Integration](/enzoic-for-active-directory/v3.3/product-usage/logging-and-siem-integration) page. # Installation Prerequisites Enzoic for Active Directory v3.3 ## **System Requirements** Enzoic for Active Directory supports any Windows Server 2012 or later for Forest and Domain functional level. Microsoft .NET Framework 4.5.1 or newer is required. Enzoic for Active Directory requires an active Internet connection. You can specify a proxy server if you do not want Enzoic for Active Directory communicating directly over the Internet. Please see Firewall Requirements below for the required IP whitelist. ## **Firewall Requirements** Enzoic for Active Directory must be able to contact its servers to look up the compromised status for passwords. If your firewall supports whitelisting by FQDN, whitelist the following FQDNs for outbound communications over TCP port 443 from your domain controllers: ``` api.enzoic.com app-api.enzoic.com cdn.enzoic.com ``` If your firewall cannot whitelist by FQDN, the IP addresses below should be whitelisted for outbound communications over TCP port 443 from your domain controllers. ``` 13.235.194.196 13.48.121.56 13.48.96.148 15.206.40.21 18.196.181.48 3.10.99.236 3.124.25.136 3.231.37.171 3.24.50.155 3.24.93.121 3.9.236.117 34.214.110.33 35.153.27.185 35.163.59.86 35.168.85.109 35.180.249.238 35.181.124.196 52.192.30.99 52.199.52.28 52.212.218.163 52.48.142.122 52.51.10.65 52.79.68.108 52.89.197.157 54.172.238.226 54.180.42.79 54.233.211.111 54.233.236.93 75.2.9.104 99.83.177.145 ``` ## **Antivirus Whitelisting** If you are running any type of heuristics based antivirus software, for example CrowdStrike, you must whitelist the Enzoic processes and files in the following locations: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` Heuristics-based antivirus applications will often interfere with Enzoic’s ability to read and write from Active Directory. ## **Ensure Enzoic Port is Available** Enzoic for Active Directory uses a local port for communications between its processes on each Domain Controller where it is running. The default port is 6164. If this port is being used by other software on the system, unexpected behaviors may result. If necessary, the port can be changed using the following registry setting after install: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` # Setup Instructions Enzoic for Active Directory v3.3 Please ensure you’ve reviewed the information on the [Installation Prerequisites](/enzoic-for-active-directory/v3.3/installation-and-setup/installation-prerequisites) page prior to proceeding. ## **Download the Installer** Links to download the most current version (Domain Controllers must all run the same version): [!!! THESE INSTALLERS ARE FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLERS !!!](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/setup-instructions) **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: a65eed146401455de5cf18eb2e4ff0a3 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.3/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: cfb3522304aea036f616e382f53f2585 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Multiple Domain Controllers** Enzoic for Active Directory needs to be installed on every writable domain controller in the target domain – it is not necessary to install it on read only domain controllers. Note that Enzoic for Active Directory stores its configuration settings in Active Directory, so once it is configured on one domain controller, the configuration settings will replicate to all the domain controllers in the domain. ## **Multiple Domain Environments** Enzoic for Active Directory runs at the domain level and does not support interacting with multiple domains. Its configuration and state are all stored at the domain level. If you have an environment with a multi-domain forest or parent-child domain relationships, Enzoic for Active Directory must be installed and managed separately on each domain in your environment. After installing Enzoic for Active Directory on the first DC in each domain, you will need to run the console application as a domain admin on that domain and go through first time configuration. ## **Setup Wizard Installation** Run the installer, and then reboot the domain controller when prompted. Future upgrades will not generally require a reboot, but the initial install does. Enzoic for Active Directory needs to run on each domain controller; however, it only needs to be configured once. All configuration settings (with the exception of the optional proxy server settings) are stored in Active Directory and automatically shared with all instances of that domain. After the initial reboot, the Setup Wizard will walk you through the configuration process with the following steps. All settings can be modified through the console after initial set-up:
Step 1 - Network Settings Adjust the API timeout duration. This controls how long a user password change will be held waiting for a response from the Enzoic API. If the timeout is reached, the password change will be allowed to go through without checking the user password for compromise. The compromise status will be detected subsequently if Continuous Password Protection is enabled. Although it is completely dependent on your Internet connection, typical response times for the Enzoic API from most locations are less than 500 milliseconds. OPTIONAL: Specify an HTTP proxy server to use if your DC does not have direct Internet access. This setting will need to be configured separately on each Domain Controller.
Step 2 - License Enter the Enzoic License Key provided for your account. You can [register](https://www.enzoic.com/free-trial-2) to obtain a free key
Step 3 - Monitored Entities Specify which Active Directory accounts to protect. You can select any combination of individual users, groups, or containers/OUs. For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Step 4 - One-Click NIST Compliance Choose if you’d like to accept the default settings recommended for NIST 800-63b compliance: * Custom dictionary for context-sensitive words for your business * Common passwords found in cracking dictionaries * Fuzzy matching for common password patterns and substitutions * Continuous monitoring to detect when existing user passwords become vulnerable If you choose NIST 800-63b compliance mode, these settings will be automatically applied and you will get an overall status on the Enzoic Console dashboard indicating whether your current settings in compliance. If you’re unfamiliar with the new NIST 800-63b standard, a quick rundown is [here](https://www.enzoic.com/surprising-new-password-guidelines-nist/) and the full standard can be found [here](https://pages.nist.gov/800-63-3/sp800-63b.html).
Step 5 - Custom Dictionary (only shown when NIST Compliance chosen) **Add Words Specific to Your Business to the Custom Dictionary**\ **(only shown when One-Click NIST Compliance is selected)** If you choose NIST 800-63b compliance mode, you should add words specific to your business and office locations. Add product name(s), your business name(s), names of cities your offices are in, local sports teams, etc. These will be added to the local dictionary and used to prevent passwords containing these terms. Make sure not to include words that are too short or generic, as this will prevent any passwords containing these strings from being used.
Step 6 - Password Change Screening (not shown when NIST Compliance chosen) **(not shown when One-Click NIST Compliance is selected)** Select whether you want Enzoic to screen user password changes. When enabled, users who are in one of the monitored groups or OU’s will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password. You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however. The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
Step 7 - User Password Monitoring User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 8) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Lastly, you can select the Delegate Server used to run User Password Monitoring scans. This is the DC in your organization which will do the work of checking user passwords for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 8 - User Credentials Monitoring (if licensed) Note that this page will be omitted if your license isn’t enabled for User Credentials Monitoring. When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs. The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 7) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from those used for Password Monitoring, so you can use different text specific to this alert type if you prefer. Lastly, you can select the Delegate Server used to run User Credentials Monitoring scans. This is the DC in your organization which will do the work of checking user credentials for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 9 - Password Policies (not shown when NIST Compliance chosen) **(only shown when One-Click NIST Compliance is selected)** This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking.Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
Step 10 - Administrative Notifications Include one or more email addresses to be notified for administrative events. These events include: 1. Detection of new user password compromise 2. Summary of all users’ compromise status 3. Alert about any service operation errors. An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly.
Step 11 - Test Settings The Test Page allows you to test your settings are working as expected and that the Enzoic API Servers are reachable from your environment. Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.3/product-usage/troubleshooting).
## **Completing Setup** After you have finished the Setup Wizard, you will be placed on the Enzoic Console Dashboard. You will receive a prompt asking if you’d like to run an initial scan of your domain for users with compromised passwords. If you are familiar with the Enzoic AD Lite product, this is essentially the same scan. Proceeding will scan all user passwords in your Active Directory domain to see if the exact password is present in Enzoic’s database of bad passwords (note this scan can take some time for very large domains). At the end of the scan, you will see a dialog with a report showing which users had weak or compromised passwords. From the report, you can select users to perform remediations such as disabling their account or forcing a password change on next login. You may also export the results to a CSV for reference. Completing the setup process above will get you started with a single default monitoring policy and some initial settings. You can always tweak the settings from the Console Settings or Monitoring Policies area. # Client Setup Instructions Enzoic for Active Directory v3.3

Sample policy display with Enzoic Client installed

Sample password rejection message with Enzoic Client installed

Enzoic for Active Directory includes an optional Windows client application that can be deployed to domain-joined Windows workstations in your organization to provide users with better feedback and assistance when selecting a new password. The Windows client application augments the built-in Windows password change screen by adding text to indicate what your password requirements are and in the case of a rejected password change, additional details as to the reasons. For example, if a user’s password is rejected due to being a known compromised password, they will be informed of this fact and asked to select a different password. ## **Compatibility with 3rd Party Authentication Products** 3rd party authentication products which add additional capabilities such as multi-factor authentication typically integrate with the Windows winlogon system using a credential provider. Windows is capable of supporting multiple credential providers, including the default set that ships with the OS. A vanilla Windows installation will have the default system credential provider active, which processes user password-based logins and handles user password changes. The Enzoic Client functions by installing as another credential provider. It wraps and disables the Windows system credential provider. This is necessary for Enzoic to provide the user with feedback. As previously mentioned, in some environments other credential providers, such as Windows Hello for Business or 3rd party credential providers which provide multi-factor or biometric authentication such as DUO, may be present and may be the default provider. To work alongside these providers, the Enzoic Client will need some additional configuration and you will likely need to whitelist the Enzoic Client's credential provider in your product. See the [Client Settings](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/settings#client-settings) section of the Enzoic Console documentation for more information on the settings available and how to configure Enzoic to wrap a 3rd party credential provider.\ \ See the [Setup Instructions for Specific Alternate Credentials Providers](#setup-instructions-for-specific-alternate-credentials-providers) for instructions specific to selected providers. ## **Download the Client Installer** The installer is available as an MSI to ease deployment via GPO. Microsoft .NET Framework 4.5 is required. Links to download the most current version (Domain Controllers must all run the same version): [THIS INSTALLER IS FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLER](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/client-setup-instructions) \ MD5: cfb3522304aea036f616e382f53f2585 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Automated Deployment to Multiple Workstations via GPO** You can use GPO push installs to easily install the Enzoic for Active Directory Client to multiple user workstations. Note that the Enzoic Client requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. ### **Steps for Pushing the Enzoic Client via GPO**
Step 1 - Create a Distribution Point 1. Log on to the server you wish to use as a distribution host as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Computers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForADClient.msi` into the distribution point 5. Give the `Domain Computers` security group read access to the `EnzoicForADClient.msi` file in the distribution point. 6. Click Finish.
Step 2 - Create a Group Policy Object (GPO) 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click your domain in the left pane, and then click Create a GPO in this domain, and Link it here…. Note that by default this will deploy the Enzoic Client to all workstations in your domain. If you wish to deploy to a subset, you should apply the GPO to the desired OU or Group. 4. Type `Enzoic Client Distribution` or a name of your choosing, leave Source Starter GPOset to (none), and then click OK.
Step 3 - Prepare the Group Policy Object 1. Right-click the newly created `Enzoic Client Distribution` GPO, and then click Edit… 2. Expand the Computer Configuration, then Policies, then Software Settings nodes in the left pane. 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForADClient.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\server\distribution point share\EnzoicForADClient.msi`. Do not just navigate to the file and select it. 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 4 - Complete the Installation Windows will now install the Enzoic for Active Directory Client on the targeted systems the next time they are restarted.
### **Troubleshooting GPO Deployments** If the client is failing to deploy via GPO, check the following: **Does the GPO apply to the affected system?**\ Check the Scope tab on the GPO in the Group Policy Management Console to ensure the affected workstation(s) are covered by the GPO. **Have the affected workstation(s) been restarted?**\ In some cases it may take two reboot cycles before the GPO gets deployed. **Is the distribution point share and MSI accessible by the affected system(s)?**\ Check that they can access the share and MSI. **Do the affected system(s) have at least .NET Framework 4.5 installed?**\ The MSI will not handle installing this, so you will need to ensure that all target systems have at least .NET Framework 4.5 before pushing the Enzoic Client. **Check the Event Log on the affected system for GPO or install failures occurring after the reboot.** \ If the installer is failing, there should be some indication here. ## Setup Instructions for 3rd Party Credentials Providers If you don't see instructions for your specific provider below, you can try the instructions in the Other section. #### DUO If you are using DUO for MFA, you can setup Enzoic to wrap it as follows: 1. Prior to installing the Enzoic Client, open the Enzoic Console and paste the DUO credential provider GUID into the *Settings | Client Settings | Alternate Credential Provider* *GUID* field: \ 44E2ED41-48C7-4712-A3C3-250C5E6D5D84\ Click Update Configuration 2. In the registry on machines that will run the Enzoic Client, add the following values:\ Key path: HKEY\_LOCAL\_MACHINE\SOFTWARE\Duo Security\DuoCredProv \ Value name: ProvidersWhitelist \ Value type: REG\_MULTI\_SZ \ Value data: {C6522CF0-8F6E-4E5A-BC65-9D3B7E8390C2} 3. Finally, install the Enzoic Client and verify that DUO and Enzoic are working as expected. You should see Enzoic's password change policies on the password change screen and be prompted to validate with DUO when you attempt to save a new password. #### Other If you don't see specific instructions for your product, try the following: 1. Locate the credential provider GUID for your product. This can generally be found at the following registry key on a workstation that was used to login with that product:\ *HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnProvider* 2. Prior to installing the Enzoic Client, open the Enzoic Console and paste the found credential provider GUID into the *Settings | Client Settings | Alternate Credential Provider* *GUID* field. Then click Update Configuration 3. Determine if it is necessary and if so how to whitelist the Enzoic Client's credential provider with the 3rd party product. This will often be accomplished via a registry entry on the target systems. You may need to contact support for the product to get assistance with this. 4. Finally, install the Enzoic Client and verify that the 3rd party product and Enzoic are working as expected. You should see Enzoic's password change policies on the password change screen. # Upgrade Instructions Enzoic for Active Directory v3.3 Upgrading from an older version to the current release is straightforward and only involves running the installer for the current release on each domain controller in the monitored domain. A reboot will not be required after upgrading, unless upgrading from a version older than 2.0. It is safe to upgrade from any previous version to the current release. ## **Download the Installers for the Latest Release** Links to download the most current version (Domain Controllers must all run the same version): [THESE INSTALLERS ARE FOR A PRIOR RELEASE – CLICK HERE FOR THE CURRENT RELEASE INSTALLERS](https://docs.enzoic.com/enzoic-for-active-directory/installation-and-setup/upgrade-instructions) **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: a65eed146401455de5cf18eb2e4ff0a3 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.3/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: cfb3522304aea036f616e382f53f2585 Review the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Upgrades in Environments with Multiple Domain Controllers** Enzoic for Active Directory needs to be upgraded on every writable domain controller in the target domain. In organizations where upgrading all servers at once is not possible or permitted, rolling upgrades over longer periods of time are supported. The only restriction is that the server designated as the Enzoic for Active Directory Delegate server in your domain must be upgraded to the new version first. The installer will not allow you to proceed with the upgrade on other DC’s until the Delegate has been upgraded. If you are unsure which Domain Controller in your environment is acting as the Delegate, you may determine this by running the Enzoic Console, going to Settings and clicking on the “Other Settings” tab. The current Delegate will be displayed there. ## **Installing the Upgrade** Run the new installer on each DC in the monitored domain in order to upgrade it. As noted in the section above, you must run the upgrade on the Delegate server in your domain first. After the upgrade is complete, run the Enzoic Console and verify there are no issues displayed on the Dashboard or in System Health. # Automated Deployments Enzoic for Active Directory v3.3 ## **Setup with a Configuration File** Starting with version 2.9, Enzoic for Active Directory can be installed and configured headlessly using a YAML configuration file. All of the Enzoic for AD settings can be specified via settings in this file. To get started, download the sample enzoic-config.yml file below and open in a text editor. The settings in the file are documented with comments, but we recommend familiarizing yourself with the product in a test environment first to better understand the various options. Download the sample configuration file: [enzoic-config.yml](https://cdn.enzoic.com/files/enzoic-config-3.2.yml) To specify the configuration file during installation, use the MSI version of the installer and pass in two properties: ENZ\_IMPORT\_CONFIG\_FILE – the full path to your YAML configuration file\ ENZ\_PRODUCT\_KEY – your Enzoic for Active Directory product key Sample MSI command line: ``` msiexec.exe /i "c:\EnzoicForAD.msi" ENZ_IMPORT_CONFIG_FILE="c:\path\to\enzoic-config.yml" ENZ_PRODUCT_KEY=”your-product-key” ``` ## **Deploying Enzoic for Active Directory via GPO** You can use GPO push installs to easily install Enzoic for Active Directory across multiple domain controllers in your environment. Note that Enzoic for Active Directory requires .NET Framework 4.5.1, which does not get installed automatically when running the MSI installer. If you do not already have the .NET Framework 4.5.1 on your servers prior to deploying Enzoic for Active Directory, you will need to deploy that first.
Step 1 - Create an MST file with your product key and YML config path embedded *(Note this step is optional – if you wish, you may instead install Enzoic for Active Directory on the first domain controller in your environment, configure it as you wish and then push the installer to your other domain controllers via GPO, without needing to use a YML configuration file. In this case, the other domain controllers will pick up the shared configuration directly from Active Directory.)* 1. Download Microsoft’s Windows Installer SDK – [Download](http://download.microsoft.com/download/7/c/4/7c426dfc-46e2-4ded-bab4-3b33600ad7d1/msi45sdk.msi) 2. Install the SDK, Find and Run the Orca install (installs to `C:\Program Files (x86)\Windows Installer 4.5 SDK\TOOLS` by default) 3. Run Orca 4. Open the Enzoic for AD MSI in Orca 5. Open the Transform menu and select “New Transform” 6. Navigate to the Property table in the left pane and edit the values for the following properties in the right hand pane: * ENZ\_IMPORT\_CONFIG\_FILE – enter the UNC network path to your enzoic-config.yml file (this will be the network share distribution point for the GPO) * ENZ\_PRODUCT\_KEY – enter your product key 7. Open the Transform menu and select “Generate Transform”, save the MST file 8. Copy the MSI, MST and YML file to your distribution point in the next step.
Step 2 - Create a Distribution Point 1. Log on to a server in the target domain as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Controllers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForAD.msi` (and optionally the MST and YML file from step 1 above) into the distribution point 5. Give the `Domain Controllers` security group read access to the `EnzoicForAD.msi`file in the distribution point. 6. Click Finish.
Step 3 - Create a Group Policy Object 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click the `Domain Controllers` OU in the left pane, and then click Create a GPO in this domain, and Link it here… 4. Type `Enzoic for Active Directory` and then press ENTER.
Step 4 - Prepare the Group Policy Object 1. Right-click the `Enzoic for Active Directory` GPO, and then click Edit… 2. Expand the Computer Configuration, Policies, and Software Settings 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForAD.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\file server\distribution point share\EnzoicForAD.msi` 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 5 - Complete the Installation Windows installs Enzoic for Active Directory during startup, and then immediately requires a manual restart to load the Password Filter. Restart each Domain Controller to complete the installation.
# Enzoic Product Console Enzoic for Active Directory v3.3 The Enzoic Product Console allows you to configure and monitor the function of the Enzoic for Active Directory installation on a single domain. It is installed by the Enzoic for Active Directory installer. It is necessary to run the Enzoic Console application from a Domain Administrator account on a computer joined to the domain you wish to configure. It is possible to install the Enzoic Console standalone on any version of Windows using the Enzoic for Active Directory installer – it is not necessary to run it from a server. ## **Using the Console** [Dashboard](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/dashboard)\ [System Health](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/system-health)\ [Monitoring Policies](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/monitoring-policies)\ [Settings](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/settings)\ [Reporting](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/reporting)\ [License](/enzoic-for-active-directory/v3.3/product-usage/enzoic-product-console/license) # Dashboard Enzoic for Active Directory v3.3
* Product upgrade notifications when new versions are available * Overall monitoring status, along with which groups are being monitored * A list of users who have compromised passwords * A list of users who have compromised credentials * NIST 800.63b compliance status, if the 1-click NIST Compliance feature is enabled * Current license status # System Health Enzoic for Active Directory v3.3
The System Health page will alert you to any error conditions that have been detected in your Enzoic for Active Directory installation. A list of all the DC’s that are running Enzoic in your domain will appear, along with reachability status, version information and any errors detected on each. # Monitoring Policies Enzoic for Active Directory v3.3

Monitoring Policies Page

The Monitoring Policies page of the Enzoic Console allows you to add, edit, and delete new Monitoring Policies. Note that if you are on a Business level license, you will be limited to a single policy named “Primary”, but for other license levels you will be able to define multiple monitoring policies to target different groups and OU’s with different monitoring settings. ## **Adding or Removing Policies** Adding or Removing policies can be done from the left hand pane, titled Policies, by using the Add and Remove buttons at the bottom of the list view. Note that it is not possible to remove the default policy. To add a new policy, click Add, select whether you want to copy the settings from an existing policy or start blank, and click OK. The new policy will appear on the right hand pane and you may edit from there. Remember to click “Update Configuration” when finished. It is necessary to select at least one OU/group/user to monitor on the Monitored Entities page in order to save the new policy. See the Policy Settings section below for more details about the various settings available. ## **Policy Precedence** Enzoic does not prevent you from including the same user under multiple policies, since it’s possible a user could end up under multiple policies later as group, OU or container memberships change. Instead policies are applied in order of precedence. If a user is included under multiple policies, the first matching policy in precedence order would be used, as follows: the (Default) policy will be checked first, then remaining policies in alphabetical order. If you are in doubt which policy is being applied to a specific user, you can enter their username on the Test Page to check which policy is being used. You can also view which policy they are falling under with the Monitored Users Report under Reporting. ## **Policy Settings** The following settings are available on each policy, grouped by tab title:
Monitored Entities Monitored Entities Tab Specifies which Active Directory accounts to protect with this policy. You can select any combination of individual users, groups, or containers/OUs.For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Password Changes Password Changes Tab Specifies whether you want Enzoic to screen user password changes for users covered by this policy. When enabled, users will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password.You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however.The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
Password Monitoring Password Monitoring Tab User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that if you are using one of the “delayed” actions and later switch to a different option, any users whose passwords were already detected as compromised and are still in the delay period will process per the settings which were in effect at the time their password was detected as compromised. For example, if a monitored user’s password is detected as being compromised and the “Action to Take” at that time is *Disable Account (Delayed)* with a delay period of 48 hours, but the “Action to Take” setting is subsequently changed to *User Must Change Password on Next Login (Delayed)* with a delay period of 24 hours, that user’s account would still be disabled at the end of the original 48 hour period (provided they do not change their password prior to that time of course).
Credentials Monitoring Credentials Monitoring Tab When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs.The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from the email customization settings that may be configured for Password Monitoring, so you can use different text specific to credentials alerts here if you prefer. Note that delayed remediations for Credentials Monitoring have identical behavior as described in the last two paragraphs of the Password Monitoring section above.
Password Policies Password Policies Tab This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. #### **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. #### **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking. Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
# Settings Enzoic for Active Directory v3.3 The Settings page of the Enzoic Console allows you to modify settings that aren’t specific to a monitoring policy, such as the local DC’s proxy server settings, your organization’s Custom Password Dictionary, Administrative Notification settings, Enzoic Client settings, the DC used as the Delegate Server, and the 1-click NIST Compliance feature. ## **Network Settings**

Network Settings Tab

This tab contains settings for the password change check timeout and the local DC’s proxy server settings. * **Password Check Timeout**\ This setting controls the timeout when making calls to the Enzoic API during user password change operations. If this timeout is exceeded while waiting for a response from the Enzoic API, the operation will fail and the password change will be allowed through. * **Proxy Server Settings**\ These are the proxy server settings in use for the DC that you are running the console on. Proxy server settings are stored locally to each DC and must be edited from the local Enzoic Console on that system. ## **Custom Password Dictionary**

Custom Password Dictionary Tab

The Custom Password Dictionary allows you to add words or terms you wish to block from inclusion in user passwords. These can be words specific to your business or your location, e.g. local sports teams, your city name, etc. If a user password contains one of these words, it will be rejected. ## **Admin Notifications**

Admin Notifications Tab

This is the list of Administrator email addresses to be notified for administrative events. These events include: * Detection of new user password compromise * Summary of all users’ compromise status * Alert about any service operation errors An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly. The Periodic Summary contains a digest of the activity for the time period covered: users with compromised passwords, users with compromised credentials, remediation actions being taken and their current status, etc. ## **Client Settings**

Client Settings Tab

These are settings specific to the Enzoic Client, which is installed on user Windows systems. The Enzoic Client provides additional information to users on the Windows password change screen, including what the policy requirements are for a new password and the reasons a password was rejected. For more information on deploying the Enzoic Client, see [Client Setup](/enzoic-for-active-directory/v3.3/installation-and-setup/client-setup-instructions). The settings on this page control the following: * **Disable Enzoic Password Credential Provider**\ This can be used as a bailout if for some reason a problem with the Enzoic Client is blocking a user from being able to sign into their system. Checking this allows you to temporarily disable the Enzoic Clients throughout this domain. * **Alternate Credential Provider GUID**\ By default, the Enzoic Client will wrap the default Windows system credential provider (which just provides a password prompt for users). If your organization uses a different credential provider, to provide MFA services for instance, you will need to add the GUID for this provider in this field. This will instruct the Enzoic Client to wrap this provider instead.\ \ **Note that you will likely need to whitelist the Enzoic credential provider in the 3rd party product or it will typically disable the Enzoic provider. The Enzoic credential provider's GUID is C6522CF0-8F6E-4E5A-BC65-9D3B7E8390C2.** * **Credential Provider Whitelist GUIDs**\ By default, the Enzoic Client will disable other credential providers when it is installed. This reduces user confusion when there are multiple providers enabled. In the case where you wish for users to be able to use alternate credential providers in addition to the Enzoic provider, add the GUIDs for those providers to this whitelist. Doing this will ensure the Enzoic Client does not disable these other providers. ## **Other Settings**

Other Settings Tab

This page is where the 1-click NIST Compliance feature can be enabled or disabled and where you may change the DC currently set as your Delegate Server. * **1-Click NIST Compliance**\ Enabling this setting will enable a new widget on your Enzoic Console Dashboard, showing you your current NIST 800.63b compliance status. When the option is initially checked, it will automatically update all of your policy settings to compliant values. However, you can subsequently manually modify policy settings and break compliance. If you do this, the widget will warn you about which settings/policies are out of compliance.\ \ NIST Compliance ensures the following settings are enabled: * *Screen Password Changes* * *Screen Password Resets Performed by Administrators* * *Reject Common Passwords Found in Cracking Dictionaries* * *Use Fuzzy Password Matching* * *Continuous Password Monitoring* * *Action to Take* will be set to *User Must Change Password on Next Login*, with a 72 hour delay * *Notify Affected Users by Email When Their Password is Compromised* will be enabled * **Delegate Server**\ The Delegate Server is the DC in your organization which performs the Password and Credentials Monitoring scans. These scans occur in an evenly spaced out manner over the course of the day and are generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems. # Reporting Enzoic for Active Directory v3.3 The Reporting page of the Enzoic Console allows you to see statistics about how many password change operations Enzoic has checked for your organization, how many were matched, as well as how many password/credentials have been checked by your continuous monitoring features. This is also where you’ll find the Monitored Users report, which contains a detailed breakdown of which users in your organization are currently being monitored by Enzoic for Active Directory and what the current status of their password security is. The dropdown menu in the upper right of this page allows you to select which report you’d like to view. ## **Password Change Report**

Sample Password Change Report

This report shows you a statistical view over time of how many user password change operations have been checked by Enzoic and how many of those ended up being matches with a compromised or weak password (i.e. the new password was rejected). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). ## **Continuous Monitoring Report**

Sample Continuous Monitoring Report

This report shows you a statistical view over time of how many user passwords and credentials were scanned by the continuous monitoring functions (User Password Monitoring and User Credentials Monitoring). It also indicates how many of those checks ended up being matches with a compromised or weak password or credentials (i.e. the user’s password or credentials were flagged as compromised). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). ## **Monitored Users Report**

Sample Monitored Users Report

This report shows you a list of all the users currently being monitored by Enzoic for Active Directory, along with a Compromised status for each user. For each user, you can also see what the current status is for Password Monitoring and Credentials Monitoring. The filter dropdown at the top right allows you to further filter the report, so you can, for instance, just see users with currently compromised passwords.The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Monitored Users Report Fields**
FieldDescription
PolicyThe current effective monitoring policy for this user.
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
Password MonitoringIndicates whether Password Monitoring is active for this user. Possible values are Yes, No, or Limited. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks and indicate only an exact match with the user’s current password would be caught (i.e. things like fuzzy matching won’t work). Force a password change for this user to rectify this condition.
Credentials MonitoringIndicates whether Credentials Monitoring is active for this user. Possible values are Yes, No, or Pending. Pending indicates Enzoic has not observed a password change for this user to cache their current password. Until then, we will not be able to monitor this user’s credentials for compromise. Force a password change for this user to rectify this condition.
CompromisedThe user’s current compromise status. See possible status values in the section below.
#### **Compromise Status Values** The potential values for the Compromised column are as follows:
ValueDescription
Password CompromisedIndicates this user’s password was found to be compromised during a Password Monitoring scan.
Credentials CompromisedIndicates this user’s credentials (exact email/password combination) were found to be compromised during a Credentials Monitoring scan.
No (Limited Check)Indicates that while the user’s current password and credentials are not known to be compromised, currently a limited check is being used. A limited check indicates that we do not have the exact password cached, so only an exact match with a compromised password would be flagged. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks. Once this user changes their password, the Limited restriciton will be removed.
NoIndicates the user’s password and/or credentials are being checked completely and no compromise has been identified.
# License Enzoic for Active Directory v3.3
The License page of the Enzoic Console allows you to check your license status, verify license details, and, if necessary, switch to a different product key. # Test Page Enzoic for Active Directory v3.3
The Test Page of the Enzoic Console allows you to test that your settings are working as expected and that the Enzoic API Servers are reachable from your environment.Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.3/product-usage/troubleshooting). # Logging and SIEM Integration Enzoic for Active Directory v3.3 ## **Log Files** By default, Enzoic for Active Directory stores logs in the following location:\ **`C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs`** The following log files are available:
LogTypeFilename(s)Format(s)Description
ConsoleEnzoicConsole_{logDate}.json
EnzoicConsole_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic console UI.
ServiceEnzoicService_{logDate}.json
EnzoicService_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic service. These tend to be the most useful for troubleshooting and contain details for when a compromised password is found for a user by Compromised Password Protection as well as when a password change is blocked.
FilterEnzoicFilter.txtTXTThese are logs generated by the Enzoic password filter DLL.
Logs rollover and are only stored for the last 7 days. ## **SIEM Integration** Enzoic for Active Directory logs important events to a JSON format log file which can be used for ingestion into SIEM systems. The following describes the information contained in these log entries. Logs files are stored at:\ `C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs` ### **1.1 Log Entry Fields / Structure** Each JSON log entry has the following structure.
FieldDescription
timeTimestamp at which the event occurred.
threadIdThe managed .NET thread ID which was running.
levelLevel of event severity. This can be one of the following: INFO, WARN, ERROR.
eventDataA JSON object containing additional details, specific to the event. The object has one field, “data” containing an object with the actual details.
eventThis is either a message or an enum value indicating the event kind. (see the eventKind field in table 1.2)
### **1.2 Event Data Fields – Common to All Events** The content of eventData varies per the type of logged event, but the following fields are always present.
FieldDescription
eventKindIndicates the nature of the event. See table 1.3 for possible values.
detailsEither a free-form complex object or extended message. Can be null.
### **1.3 Event Kinds**
NameDescription
InfoGeneral informational message.
WarningA recoverable problem or unusual event has occurred.
ErrorA (possibly unrecoverable) problem has occurred, and may require user intervention or investigation.
PasswordChangedUser account password was changed.
PasswordChangeRejectedUser account password change was attempted, but the password did not pass the integrity checks.
CompromiseDetectedDelayedRemediationScheduledA compromised password was detected, and was either remediated, or scheduled for remediation after a delay.
DelayedRemediationActionTakenA previously scheduled remediation was applied.
## **Log Entry Details for Each Event Kind** ### **1.4 Info** Recorded when there is a general informational message. Example: ```json { "time": "2019-08-07 16:24:57.2758", "threadId": "22", "level": "INFO", "event": "Service shutdown.", "eventData": { "data": { "eventKind": "Info", "details": null } } } ``` ### **1.5 Warning** Recorded when a recoverable problem or unusual event has occurred. Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "WARN", "event": "The user tu1 no longer exists. Cleaning up artifacts related to this user.", "eventData": { "data": { "eventKind": "Warning", "details": null } } } ``` ### **1.6 Error** Recorded when a problem has occurred that may require user intervention or investigation. The eventData payload contains the exception details and can be helpful to support for further investigation.
FieldDescription
exceptionClassThe name of the .NET exception class, if there is an exception.
exceptionMessageThe exception message, if there is an exception.
Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "ERROR", "event": "Something bad happened..", "eventData": { "data": { "eventKind": "Error", "details": null, "exceptionClass": "Exception", "exceptionMessage": "Exception text" } } } ``` ### **1.7 PasswordChanged** Recorded when a user password was successfully changed.
FieldDescription
userThe SAM account name of the account that was updated.
Example: ```json { "time": "2019-08-07 15:00:59.9008", "threadId": "16", "level": "INFO", "event": "PasswordChanged", "eventData": { "data": { "user": "tu1", "eventKind": "PasswordChanged", "details": null } } } ``` ### **1.8 PasswordChangeRejected** Recorded when a user password change was rejected by Enzoic due to policy settings.
FieldDescription
userThe SAM account name of the account on which the password change was attempted.
detection methodsEnzoicApi,
LocalDictionary,
PasswordSimilarity,
UserDisplayName,
UserName,
UserEmail
match typesExactMatch,
FuzzyMatch,
RootPasswordMatch
Example: ```json { "time":"2020-09-02 14:15:08.5068", "threadId": "4", "level": "INFO", "event": "The password is compromised and cannot be used. Detected by EnzoicApi and matched on RootPasswordMatch", "eventData": { "data": { "user": "testfosmo", "detectionMethod":"EnzoicApi", "matchTypes":[ "RootPasswordMatch" ], "eventKind": "PasswordChangeRejected", "details": null } } } ``` ### **1.9 CompromiseDetectedDelayedRemediationScheduled** Recorded by User Password Monitoring when a user password was detected as compromised and a delayed remediation was scheduled (e.g. force password change after 24 hours)
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenIndicates the action that was taken in response to the compromise. See table 1.11 for possible values.
actionDelayHoursThe number of hours before the delayed remediation will take effect . This only applies when actionTaken is ForcePasswordChangeOnLoginDelayed or DisableAccountDelayed
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "CompromiseDetectedDelayedRemediationScheduled", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLoginDelayed", "actionDelayHours": 1, "eventKind": "CompromiseDetectedDelayedRemediationScheduled", "details": null } } } ``` ### **1.10 DelayedRemediationActionTaken** Recorded by User Password Monitoring when a previously scheduled delayed remediation was taken. For example, if a user was scheduled to force a password change after 24 hours, this event gets logged when the user is set to Force Password Change on Next Logon in AD.
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenPossible values: ForcePasswordChangeOnLogin, DisableAccount
actionDelayHoursAlways zero.
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "DelayedRemediationActionTaken", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLogin", "actionDelayHours": 0, "eventKind": "DelayedRemediationActionTaken", "details": null } } } ``` ### **1.11 Remediation Actions** The possible remediation action values for log events are listed below.
NameDescription
ForcePasswordChangeOnLoginThe affected user account is updated to require the password to be changed on the next login attempt.
ForcePasswordChangeOnLoginDelayedThe affected user account is updated to require the password to be changed on the next login attempt. This action is delayed by the number of configured hours.
DisableAccountThe affected user account is disabled.
DisableAccountDelayedThe affected user account is disabled. This action is delayed by the number of configured hours.
NotifyOnlyAn email notification is sent to the configured recipients. No further remediation is taken.

# Backup Considerations Enzoic for Active Directory v3.3 If you are routinely backing up Active Directory in your environment, you may wish to exclude certain volatile Enzoic entries. Enzoic stores its configuration data in Active Directory, as well as some transitory data under the Enzoic container in AD’s System container. Excluding the Enzoic containers which represent this transitory data can prevent exceptions in your backup software, where backups fail due to items getting created and deleted while the backup is running. A list of the AD containers we recommend excluding from your backups is below: ``` System\Enzoic System\DEL-EnzoicTest* ``` # Troubleshooting Enzoic for Active Directory v3.3 You can use the following checks to verify the installation completed as expected. * Check windows\system32 and confirm the presence of EnzoicFilter.dll * Check the registry HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa for the presence of Enzoic in the notifications packages value * Check the Event viewer system logs after reboot to confirm there are no errors about indicating a failure to load the EnzoicFilter.dll * Check the product logs at ..\ProgramData\Enzoic\Enzoic. Log files should typically be retrieved from the DC configured as the Delegate Server. You can check which server is the Delegate from the Enzoic Console | Monitoring Settings | Continuous Password Protection area. ## **Network Reachability** If you are seeing problems reaching the Enzoic servers, please review your proxy server settings as well as the [Firewall Requirements section of Install Prerequisites](/enzoic-for-active-directory/v3.3/installation-and-setup/installation-prerequisites#firewall-requirements). ## **Email Notifications Not Being Received** If emails notifications aren’t being received, add **enzoic.com** to your approved senders. If your spam filter requires you to whitelist the Enzoic SMTP servers by IP address, you can determine the current IP address list with the following commands: #### Windows: ``` C:>nslookup -type=TXT amazonses.com | find "v=spf1" ``` #### Linux/OSX: ``` $ dig TXT amazonses.com +short| grep 'v=spf1' ``` This will return the SPF record in use, which will change over time. Example: ``` "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ~all" ``` ## **Enzoic Local Port** Enzoic for Active Directory uses a local port for communications between the password filter and its service. The default port is 6164. If necessary, the port can be changed using a registry setting: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` ## **Antivirus Whitelisting** Some heuristics based antivirus software may trip on Enzoic. To ensure smooth operation, we recommend whitelisting the Enzoic processes and files under: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` # Overview Enzoic for Active Directory v3.5 Enzoic for Active Directory is a tool that integrates into Active Directory and enforces additional password rules to prevent users from using compromised credentials. Unlike products that only check passwords after they are saved, thus requiring subsequent reset by the user, Enzoic validates the password at the time it is being selected. Passwords are then continuously monitored to detect if they become compromised – with automated remediation and alerts. It helps organizations with NIST Password Guideline compliance in Active Directory. Learn more in our [technical FAQ](https://support.enzoic.com/support/solutions/70000125966) on Enzoic for Active Directory Find out what’s new in the latest product release [here](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Getting Started** To get started with Enzoic for Active Directory, we recommend you review the [Installation Prerequisites](/enzoic-for-active-directory/v3.5/installation-and-setup/installation-prerequisites) page to ensure your environment is ready. Then follow the instructions in [Setup Instructions](/enzoic-for-active-directory/v3.5/installation-and-setup/setup-instructions) to get the product up and running in your environment. For deployment in larger environments with many domain controllers, you may wish to review our [Automated Deployments](/enzoic-for-active-directory/v3.5/installation-and-setup/automated-deployments) page. If you would like to evaluate the product in a test setting first, we recommend installing it on a Windows Server virtual machine using a product such as VMWare or one of the cloud hosting providers (AWS EC2, Azure VMs, or GCP Compute Engine). Getting up and running in a simple environment like this takes just a few minutes. The Enzoic Client is an optional component which gives your Windows users better information about what is required to select a good password, as well as feedback as to why a selected password may have been rejected if they are changing their password from the Windows Change Password screen. If you’re interested in deploying the Enzoic Client, you can find instructions for how to do so on the [Client Setup Instructions](/enzoic-for-active-directory/v3.5/installation-and-setup/client-setup-instructions) page. If you have backup software that backs up your Active Directory, you’ll want to exclude some of the volatile keys that Enzoic uses. See the [Backup Considerations](/enzoic-for-active-directory/v3.5/product-usage/backup-considerations) page for more information. Finally, if you have a SIEM system and wish to feed information from Enzoic for Active Directory into it, you can take a look at the [Logging and SIEM Integration](/enzoic-for-active-directory/v3.5/product-usage/logging-and-siem-integration) page. # Installation Prerequisites Enzoic for Active Directory v3.5 ## **System Requirements** Enzoic for Active Directory supports any Windows Server 2012 or later for Forest and Domain functional level. Microsoft .NET Framework 4.5.1 or newer is required. Enzoic for Active Directory requires an active Internet connection. You can specify a proxy server if you do not want Enzoic for Active Directory communicating directly over the Internet. Please see Firewall Requirements below for the required IP whitelist. ## **Firewall Requirements** Enzoic for Active Directory must be able to contact its servers to look up the compromised status for passwords. If your firewall supports whitelisting by FQDN, whitelist the following FQDNs for outbound communications over TCP port 443 from your domain controllers: ``` api.enzoic.com app-api.enzoic.com cdn.enzoic.com ``` If your firewall cannot whitelist by FQDN, the IP addresses below should be whitelisted for outbound communications over TCP port 443 from your domain controllers. ``` 13.235.194.196 13.48.121.56 13.48.96.148 15.206.40.21 18.196.181.48 3.10.99.236 3.124.25.136 3.231.37.171 3.24.50.155 3.24.93.121 3.9.236.117 34.214.110.33 35.153.27.185 35.163.59.86 35.168.85.109 35.180.249.238 35.181.124.196 52.192.30.99 52.199.52.28 52.212.218.163 52.48.142.122 52.51.10.65 52.79.68.108 52.89.197.157 54.172.238.226 54.180.42.79 54.233.211.111 54.233.236.93 75.2.9.104 99.83.177.145 ``` ## **Antivirus Whitelisting** If you are running any type of heuristics based antivirus software, for example CrowdStrike, you must whitelist the Enzoic processes and files in the following locations: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` Heuristics-based antivirus applications will often interfere with Enzoic’s ability to read and write from Active Directory. ## **Ensure Enzoic Port is Available** Enzoic for Active Directory uses a local port for communications between its processes on each Domain Controller where it is running. The default port is 6164. If this port is being used by other software on the system, unexpected behaviors may result. If necessary, the port can be changed using the following registry setting after install: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` # Setup Instructions Enzoic for Active Directory v3.5 Please ensure you’ve reviewed the information on the [Installation Prerequisites](/enzoic-for-active-directory/v3.5/installation-and-setup/installation-prerequisites) page prior to proceeding. ## **Download the Installer** Links to download the most current version (Domain Controllers must all run the same version): **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: 5a8826f81f2a6d194fa35d6e045d2e89 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.5/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: e5a6008de623a837995d18df14e7a61d Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Multiple Domain Controllers** Enzoic for Active Directory needs to be installed on every writable domain controller in the target domain – it is not necessary to install it on read only domain controllers. Note that Enzoic for Active Directory stores its configuration settings in Active Directory, so once it is configured on one domain controller, the configuration settings will replicate to all the domain controllers in the domain. ## **Multiple Domain Environments** Enzoic for Active Directory runs at the domain level and does not support interacting with multiple domains. Its configuration and state are all stored at the domain level. If you have an environment with a multi-domain forest or parent-child domain relationships, Enzoic for Active Directory must be installed and managed separately on each domain in your environment. After installing Enzoic for Active Directory on the first DC in each domain, you will need to run the console application as a domain admin on that domain and go through first time configuration. ## **Setup Wizard Installation** Run the installer, and then reboot the domain controller when prompted. Future upgrades will not generally require a reboot, but the initial install does. Enzoic for Active Directory needs to run on each domain controller; however, it only needs to be configured once. All configuration settings (with the exception of the optional proxy server settings) are stored in Active Directory and automatically shared with all instances of that domain. After the initial reboot, the Setup Wizard will walk you through the configuration process with the following steps. All settings can be modified through the console after initial set-up:
Step 1 - Network Settings Adjust the API timeout duration. This controls how long a user password change will be held waiting for a response from the Enzoic API. If the timeout is reached, the password change will be allowed to go through without checking the user password for compromise. The compromise status will be detected subsequently if Continuous Password Protection is enabled. Although it is completely dependent on your Internet connection, typical response times for the Enzoic API from most locations are less than 500 milliseconds. OPTIONAL: Specify an HTTP proxy server to use if your DC does not have direct Internet access. This setting will need to be configured separately on each Domain Controller.
Step 2 - License Enter the Enzoic License Key provided for your account. You can [register](https://www.enzoic.com/free-trial-2) to obtain a free key
Step 3 - Monitored Entities Specify which Active Directory accounts to protect. You can select any combination of individual users, groups, or containers/OUs. For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Step 4 - One-Click NIST Compliance Choose if you’d like to accept the default settings recommended for NIST 800-63b compliance: * Custom dictionary for context-sensitive words for your business * Common passwords found in cracking dictionaries * Fuzzy matching for common password patterns and substitutions * Continuous monitoring to detect when existing user passwords become vulnerable If you choose NIST 800-63b compliance mode, these settings will be automatically applied and you will get an overall status on the Enzoic Console dashboard indicating whether your current settings in compliance. If you’re unfamiliar with the new NIST 800-63b standard, a quick rundown is [here](https://www.enzoic.com/surprising-new-password-guidelines-nist/) and the full standard can be found [here](https://pages.nist.gov/800-63-3/sp800-63b.html).
Step 5 - Custom Dictionary (only shown when NIST Compliance chosen) **Add Words Specific to Your Business to the Custom Dictionary**\ **(only shown when One-Click NIST Compliance is selected)** If you choose NIST 800-63b compliance mode, you should add words specific to your business and office locations. Add product name(s), your business name(s), names of cities your offices are in, local sports teams, etc. These will be added to the local dictionary and used to prevent passwords containing these terms. Make sure not to include words that are too short or generic, as this will prevent any passwords containing these strings from being used.
Step 6 - Password Change Screening (not shown when NIST Compliance chosen) **(not shown when One-Click NIST Compliance is selected)** Select whether you want Enzoic to screen user password changes. When enabled, users who are in one of the monitored groups or OU’s will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password. You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however. The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
Step 7 - User Password Monitoring User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 8) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Lastly, you can select the Delegate Server used to run User Password Monitoring scans. This is the DC in your organization which will do the work of checking user passwords for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 8 - User Credentials Monitoring (if licensed) Note that this page will be omitted if your license isn’t enabled for User Credentials Monitoring. When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs. The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 7) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from those used for Password Monitoring, so you can use different text specific to this alert type if you prefer. Lastly, you can select the Delegate Server used to run User Credentials Monitoring scans. This is the DC in your organization which will do the work of checking user credentials for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 9 - Password Policies (not shown when NIST Compliance chosen) **(only shown when One-Click NIST Compliance is selected)** This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking.Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
Step 10 - Administrative Notifications Include one or more email addresses to be notified for administrative events. These events include: 1. Detection of new user password compromise 2. Summary of all users’ compromise status 3. Alert about any service operation errors. An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly.
Step 11 - Test Settings The Test Page allows you to test your settings are working as expected and that the Enzoic API Servers are reachable from your environment. Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.5/product-usage/troubleshooting).
## **Completing Setup** After you have finished the Setup Wizard, you will be placed on the Enzoic Console Dashboard. You will receive a prompt asking if you’d like to run an initial scan of your domain for users with compromised passwords. If you are familiar with the Enzoic AD Lite product, this is essentially the same scan. Proceeding will scan all user passwords in your Active Directory domain to see if the exact password is present in Enzoic’s database of bad passwords (note this scan can take some time for very large domains). At the end of the scan, you will see a dialog with a report showing which users had weak or compromised passwords. From the report, you can select users to perform remediations such as disabling their account or forcing a password change on next login. You may also export the results to a CSV for reference. Completing the setup process above will get you started with a single default monitoring policy and some initial settings. You can always tweak the settings from the Console Settings or Monitoring Policies area. # Client Setup Instructions Enzoic for Active Directory v3.5

Sample policy display with Enzoic Client installed

Sample password rejection message with Enzoic Client installed

Enzoic for Active Directory includes an optional Windows client application that can be deployed to domain-joined Windows workstations in your organization to provide users with better feedback and assistance when selecting a new password. The Windows client application augments the built-in Windows password change screen by adding text to indicate what your password requirements are and in the case of a rejected password change, additional details as to the reasons. For example, if a user’s password is rejected due to being a known compromised password, they will be informed of this fact and asked to select a different password. ## **Compatibility with 3rd Party Authentication Products** 3rd party authentication products which add additional capabilities such as multi-factor authentication typically integrate with the Windows winlogon system using a credential provider. Windows is capable of supporting multiple credential providers, including the default set that ships with the OS. A vanilla Windows installation will have the default system credential provider active, which processes user password-based logins and handles user password changes. The Enzoic Client functions by installing as another credential provider. It wraps and disables the Windows system credential provider. This is necessary for Enzoic to provide the user with feedback. As previously mentioned, in some environments other credential providers, such as Windows Hello for Business or 3rd party credential providers which provide multi-factor or biometric authentication such as DUO, may be present and may be the default provider. To work alongside these providers, the Enzoic Client will need some additional configuration and you will likely need to whitelist the Enzoic Client's credential provider in your product. See the [Client Settings](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/settings#client-settings) section of the Enzoic Console documentation for more information on the settings available and how to configure Enzoic to wrap a 3rd party credential provider.\ \ See the [Setup Instructions for Specific Alternate Credentials Providers](#setup-instructions-for-specific-alternate-credentials-providers) for instructions specific to selected providers. ## **Download the Client Installer** The installer is available as an MSI to ease deployment via GPO. Microsoft .NET Framework 4.5 is required. Links to download the most current version (Domain Controllers must all run the same version): \ MD5: e5a6008de623a837995d18df14e7a61d Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Automated Deployment to Multiple Workstations via GPO** You can use GPO push installs to easily install the Enzoic for Active Directory Client to multiple user workstations. Note that the Enzoic Client requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. ### **Steps for Pushing the Enzoic Client via GPO**
Step 1 - Create a Distribution Point 1. Log on to the server you wish to use as a distribution host as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Computers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForADClient.msi` into the distribution point 5. Give the `Domain Computers` security group read access to the `EnzoicForADClient.msi` file in the distribution point. 6. Click Finish.
Step 2 - Create a Group Policy Object (GPO) 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click your domain in the left pane, and then click Create a GPO in this domain, and Link it here…. Note that by default this will deploy the Enzoic Client to all workstations in your domain. If you wish to deploy to a subset, you should apply the GPO to the desired OU or Group. 4. Type `Enzoic Client Distribution` or a name of your choosing, leave Source Starter GPOset to (none), and then click OK.
Step 3 - Prepare the Group Policy Object 1. Right-click the newly created `Enzoic Client Distribution` GPO, and then click Edit… 2. Expand the Computer Configuration, then Policies, then Software Settings nodes in the left pane. 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForADClient.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\server\distribution point share\EnzoicForADClient.msi`. Do not just navigate to the file and select it. 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 4 - Complete the Installation Windows will now install the Enzoic for Active Directory Client on the targeted systems the next time they are restarted.
### **Troubleshooting GPO Deployments** If the client is failing to deploy via GPO, check the following: **Does the GPO apply to the affected system?**\ Check the Scope tab on the GPO in the Group Policy Management Console to ensure the affected workstation(s) are covered by the GPO. **Have the affected workstation(s) been restarted?**\ In some cases it may take two reboot cycles before the GPO gets deployed. **Is the distribution point share and MSI accessible by the affected system(s)?**\ Check that they can access the share and MSI. **Do the affected system(s) have at least .NET Framework 4.5 installed?**\ The MSI will not handle installing this, so you will need to ensure that all target systems have at least .NET Framework 4.5 before pushing the Enzoic Client. **Check the Event Log on the affected system for GPO or install failures occurring after the reboot.** \ If the installer is failing, there should be some indication here. ## Setup Instructions for 3rd Party Credentials Providers If you don't see instructions for your specific provider below, you can try the instructions in the Other section. #### DUO If you are using DUO for MFA, you can setup Enzoic to wrap it as follows: 1. Prior to installing the Enzoic Client, open the Enzoic Console and paste the DUO credential provider GUID into the *Settings | Client Settings | Alternate Credential Provider* *GUID* field: \ 44E2ED41-48C7-4712-A3C3-250C5E6D5D84\ Click Update Configuration 2. In the registry on machines that will run the Enzoic Client, add the following values:\ Key path: HKEY\_LOCAL\_MACHINE\SOFTWARE\Duo Security\DuoCredProv \ Value name: ProvidersWhitelist \ Value type: REG\_MULTI\_SZ \ Value data: {C6522CF0-8F6E-4E5A-BC65-9D3B7E8390C2} 3. Finally, install the Enzoic Client and verify that DUO and Enzoic are working as expected. You should see Enzoic's password change policies on the password change screen and be prompted to validate with DUO when you attempt to save a new password. #### Other If you don't see specific instructions for your product, try the following: 1. Locate the credential provider GUID for your product. This can generally be found at the following registry key on a workstation that was used to login with that product:\ *HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnProvider* 2. Prior to installing the Enzoic Client, open the Enzoic Console and paste the found credential provider GUID into the *Settings | Client Settings | Alternate Credential Provider* *GUID* field. Then click Update Configuration 3. Determine if it is necessary and if so how to whitelist the Enzoic Client's credential provider with the 3rd party product. This will often be accomplished via a registry entry on the target systems. You may need to contact support for the product to get assistance with this. 4. Finally, install the Enzoic Client and verify that the 3rd party product and Enzoic are working as expected. You should see Enzoic's password change policies on the password change screen. # Upgrade Instructions Enzoic for Active Directory v3.5 Upgrading from an older version to the current release is straightforward and only involves running the installer for the current release on each domain controller in the monitored domain. A reboot will not be required after upgrading, unless upgrading from a version older than 2.0. It is safe to upgrade from any previous version to the current release. ## **Download the Installers for the Latest Release** Links to download the most current version (Domain Controllers must all run the same version): **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: 5a8826f81f2a6d194fa35d6e045d2e89 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/v3.5/installation-and-setup/client-setup-instructions) **for more details):**\ \ MD5: e5a6008de623a837995d18df14e7a61d Review the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Upgrades in Environments with Multiple Domain Controllers** Enzoic for Active Directory needs to be upgraded on every writable domain controller in the target domain. In organizations where upgrading all servers at once is not possible or permitted, rolling upgrades over longer periods of time are supported. The only restriction is that the server designated as the Enzoic for Active Directory Delegate server in your domain must be upgraded to the new version first. The installer will not allow you to proceed with the upgrade on other DC’s until the Delegate has been upgraded. If you are unsure which Domain Controller in your environment is acting as the Delegate, you may determine this by running the Enzoic Console, going to Settings and clicking on the “Other Settings” tab. The current Delegate will be displayed there. ## **Installing** the **Upgrade** Run the new installer on each DC in the monitored domain in order to upgrade it. As noted in the section above, you must run the upgrade on the Delegate server in your domain first. After the upgrade is complete, run the Enzoic Console and verify there are no issues displayed on the Dashboard or in System Health. # Automated Deployments Enzoic for Active Directory v3.5 ## **Setup with a Configuration File** Starting with version 2.9, Enzoic for Active Directory can be installed and configured headlessly using a YAML configuration file. All of the Enzoic for AD settings can be specified via settings in this file. To get started, download the sample enzoic-config.yml file below and open in a text editor. The settings in the file are documented with comments, but we recommend familiarizing yourself with the product in a test environment first to better understand the various options. Download the sample configuration file: [enzoic-config.yml](https://cdn.enzoic.com/files/enzoic-config-3.5.yml) To specify the configuration file during installation, use the MSI version of the installer and pass in two properties: ENZ\_IMPORT\_CONFIG\_FILE – the full path to your YAML configuration file\ ENZ\_PRODUCT\_KEY – your Enzoic for Active Directory product key Sample MSI command line: ``` msiexec.exe /i "c:\EnzoicForAD.msi" ENZ_IMPORT_CONFIG_FILE="c:\path\to\enzoic-config.yml" ENZ_PRODUCT_KEY=”your-product-key” ``` ## **Deploying Enzoic for Active Directory via GPO** You can use GPO push installs to easily install Enzoic for Active Directory across multiple domain controllers in your environment. Note that Enzoic for Active Directory requires .NET Framework 4.5.1, which does not get installed automatically when running the MSI installer. If you do not already have the .NET Framework 4.5.1 on your servers prior to deploying Enzoic for Active Directory, you will need to deploy that first.
Step 1 - Create an MST file with your product key and YML config path embedded *(Note this step is optional – if you wish, you may instead install Enzoic for Active Directory on the first domain controller in your environment, configure it as you wish and then push the installer to your other domain controllers via GPO, without needing to use a YML configuration file. In this case, the other domain controllers will pick up the shared configuration directly from Active Directory.)* 1. Download Microsoft’s Windows Installer SDK – [Download](http://download.microsoft.com/download/7/c/4/7c426dfc-46e2-4ded-bab4-3b33600ad7d1/msi45sdk.msi) 2. Install the SDK, Find and Run the Orca install (installs to `C:\Program Files (x86)\Windows Installer 4.5 SDK\TOOLS` by default) 3. Run Orca 4. Open the Enzoic for AD MSI in Orca 5. Open the Transform menu and select “New Transform” 6. Navigate to the Property table in the left pane and edit the values for the following properties in the right hand pane: * ENZ\_IMPORT\_CONFIG\_FILE – enter the UNC network path to your enzoic-config.yml file (this will be the network share distribution point for the GPO) * ENZ\_PRODUCT\_KEY – enter your product key 7. Open the Transform menu and select “Generate Transform”, save the MST file 8. Copy the MSI, MST and YML file to your distribution point in the next step.
Step 2 - Create a Distribution Point 1. Log on to a server in the target domain as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Controllers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForAD.msi` (and optionally the MST and YML file from step 1 above) into the distribution point 5. Give the `Domain Controllers` security group read access to the `EnzoicForAD.msi`file in the distribution point. 6. Click Finish.
Step 3 - Create a Group Policy Object 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click the `Domain Controllers` OU in the left pane, and then click Create a GPO in this domain, and Link it here… 4. Type `Enzoic for Active Directory` and then press ENTER.
Step 4 - Prepare the Group Policy Object 1. Right-click the `Enzoic for Active Directory` GPO, and then click Edit… 2. Expand the Computer Configuration, Policies, and Software Settings 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForAD.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\file server\distribution point share\EnzoicForAD.msi` 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 5 - Complete the Installation Windows installs Enzoic for Active Directory during startup, and then immediately requires a manual restart to load the Password Filter. Restart each Domain Controller to complete the installation.
# Enzoic Installed Product Console Enzoic for Active Directory v3.5 The locally installed Enzoic Product Console allows you to configure and monitor the function of the Enzoic for Active Directory installation on a single domain. It is installed by the Enzoic for Active Directory installer. {% hint style="info" %} **As of 3.5, Domain Admin access is no longer necessary to run the Enzoic Console. The new Enzoic Admins group (automatically created after install/upgrade) has only the required privileges needed to run the console, allowing you to ensure you are running with the least privileged access necessary.** {% endhint %} The Enzoic Console can be run either by a user who is a Domain Admin or a member of the Enzoic Admins group in Active Directory. It is necessary to run the Enzoic Console application from a computer joined to the domain you wish to configure. It is possible to install the Enzoic Console standalone on any version of Windows using the Enzoic for Active Directory installer – it is not necessary to run it from a server. ## **Using the Console** [Dashboard](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/dashboard)\ [System Health](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/system-health)\ [Monitoring Policies](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/monitoring-policies)\ [Settings](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/settings)\ [Reporting](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting)\ [License](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/license) # Dashboard Enzoic for Active Directory v3.5
* Product upgrade notifications when new versions are available * Overall monitoring status, along with which groups are being monitored * A list of users who have compromised passwords * A list of users who have compromised credentials * NIST 800.63b compliance status, if the 1-click NIST Compliance feature is enabled * Current license status # System Health Enzoic for Active Directory v3.5
The System Health page will alert you to any error conditions that have been detected in your Enzoic for Active Directory installation. A list of all the DC’s that are running Enzoic in your domain will appear, along with reachability status, version information and any errors detected on each. # Monitoring Policies Enzoic for Active Directory v3.5

Monitoring Policies Page

The Monitoring Policies page of the Enzoic Console allows you to add, edit, and delete new Monitoring Policies. Note that if you are on a Business level license, you will be limited to a single policy named “Primary”, but for other license levels you will be able to define multiple monitoring policies to target different groups and OU’s with different monitoring settings. ## **Adding or Removing Policies** Adding or Removing policies can be done from the left hand pane, titled Policies, by using the Add and Remove buttons at the bottom of the list view. Note that it is not possible to remove the default policy. To add a new policy, click Add, select whether you want to copy the settings from an existing policy or start blank, and click OK. The new policy will appear on the right hand pane and you may edit from there. Remember to click “Update Configuration” when finished. It is necessary to select at least one OU/group/user to monitor on the Monitored Entities page in order to save the new policy. See the Policy Settings section below for more details about the various settings available. ## **Policy Precedence** Enzoic does not prevent you from including the same user under multiple policies, since it’s possible a user could end up under multiple policies later as group, OU or container memberships change. Instead policies are applied in order of precedence. If a user is included under multiple policies, the first matching policy in precedence order would be used, as follows: the (Default) policy will be checked first, then remaining policies in alphabetical order. If you are in doubt which policy is being applied to a specific user, you can enter their username on the Test Page to check which policy is being used. You can also view which policy they are falling under with the Monitored Users Report under Reporting. ## **Policy Settings** The following settings are available on each policy, grouped by tab title:
Monitored Entities ![](https://897764204-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwTXtx4NLZKz80TdxYWPs%2Fuploads%2F5RuBl8mYC99LNJ4T5j8K%2Fimage.png?alt=media\&token=e84548c9-7221-4032-915e-9c7a9d89d896) Specifies which Active Directory accounts to protect with this policy. You can select any combination of individual users, groups, or containers/OUs.For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Password Changes ![](https://897764204-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwTXtx4NLZKz80TdxYWPs%2Fuploads%2FPwKgc5GYjHvXqdHEuVGF%2Fimage.png?alt=media\&token=21745007-eff8-4129-bafb-8a81f3a913d0) Specifies whether you want Enzoic to screen user password changes for users covered by this policy. When enabled, users will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected on this policy will be rejected and the user will be required to select a different password. You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however. The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools, such as ADUC.
Password Monitoring ![](https://897764204-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwTXtx4NLZKz80TdxYWPs%2Fuploads%2FKBD3ivnakHVMvdCpDbLm%2Fimage.png?alt=media\&token=6539e43b-2b16-44ab-941a-790215e44c1b) User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user. * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period. * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user. * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period. * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured under [Settings](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/settings#admin-notifications)) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” allows you to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that if you are using one of the “delayed” remediation actions and later switch to a different option, any users whose passwords were already detected as compromised but are still within the delay period will continue to process per the settings which were in effect at the time their password was detected as compromised. For example, if a monitored user’s password is detected as being compromised and the “Action to Take” at that time is *Disable Account (Delayed)* with a delay period of 48 hours, then the “Action to Take” setting is subsequently changed to *User Must Change Password on Next Login (Delayed)* with a delay period of 24 hours, that user’s account would still be disabled at the end of the original 48 hour period (provided they do not change their password prior to that time of course). If this needs to be modified, it can be manually changed from the "Compromised Users Report".
Credentials Monitoring ![](https://897764204-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwTXtx4NLZKz80TdxYWPs%2Fuploads%2FLcKLLvV6JEL4l7UN1CbU%2Fimage.png?alt=media\&token=1b28e71b-3404-4dc4-8f49-971c05b64b3b) When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs. The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” allows you to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from the email customization settings that may be configured for Password Monitoring, so you can use different text specific to credentials alerts here if you prefer. ![](https://897764204-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwTXtx4NLZKz80TdxYWPs%2Fuploads%2FRMyNn7x8qVTkCWkyUV1P%2Fimage.png?alt=media\&token=f8a2ad1c-60cc-43dd-8035-785730fa94d7) Note that delayed remediations for Credentials Monitoring have identical behavior as described in the last two paragraphs of the Password Monitoring section above.
Password Policies ![](https://897764204-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwTXtx4NLZKz80TdxYWPs%2Fuploads%2FDzoER9H6MvgEKChTNlHG%2Fimage.png?alt=media\&token=ea2ab653-21db-4fc9-a0f5-a6dac852e139) This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. #### **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. #### **Additional Password Policies** * **Reject passwords without at least one lowercase character** * **Reject passwords without at least one uppercase character** * **Reject passwords without at least one number** * **Reject passwords without at least one symbol** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking. Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function. * **Reject passwords less than a minimum length** * **Reject passwords more than a maximum length**
# Settings Enzoic for Active Directory v3.5 The Settings page of the Enzoic Console allows you to modify settings that aren’t specific to a monitoring policy, such as the local DC’s proxy server settings, your organization’s Custom Password Dictionary, Administrative Notification settings, Enzoic Client settings, the DC used as the Delegate Server, and the 1-click NIST Compliance feature. ## **Network Settings**

Network Settings Tab

This tab contains settings for the password change check timeout and the local DC’s proxy server settings. * **Password Check Timeout**\ This setting controls the timeout when making calls to the Enzoic API during user password change operations. If this timeout is exceeded while waiting for a response from the Enzoic API, the operation will fail and the password change will be allowed through. * **Proxy Server Settings**\ These are the proxy server settings in use for the DC that you are running the console on. Proxy server settings are stored locally to each DC and must be edited from the local Enzoic Console on that system. * **Enzoic API Connection**\ These settings enable you to specify an alternate endpoint to use for the Enzoic API, which is used to check passwords and credentials for compromise against Enzoic's cloud database of breached credentials. Generally it is not necessary to modify these. ## **Custom Password Dictionary**

Custom Password Dictionary Tab

The Custom Password Dictionary allows you to add words or terms you wish to block from inclusion in user passwords. These can be words specific to your business or your location, e.g. local sports teams, your city name, etc. If a user password contains one of these words, it will be rejected. ## **Admin Notifications**

Admin Notifications Tab

This is the list of Administrator email addresses to be notified for administrative events. These events include: * Detection of new user password compromise * Summary of all users’ compromise status * Alert about any service operation errors An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly. The Periodic Summary contains a digest of the activity for the time period covered: users with compromised passwords, users with compromised credentials, remediation actions being taken and their current status, etc. ## **Email Settings**

Email Settings Tab

The Email Settings tab lets you override the default Enzoic SMTP server used by Enzoic for sending emai notifications and alerts to administrators and users. You may choose to use your own SMTP server instead to minimize deliverability and security issues for your users. {% hint style="info" %} Since Enzoic sends email notifications and alerts from its cloud servers, the SMTP server you choose to use must be publicly routable on the Internet. If you need to source IP restrict access to this server, the source IP for Enzoic SMTP traffic is 44.225.15.204. {% endhint %} ## **Client Settings**

Client Settings Tab

These are settings specific to the Enzoic Client, which is installed on user Windows systems. The Enzoic Client provides additional information to users on the Windows password change screen, including what the policy requirements are for a new password and the reasons a password was rejected. For more information on deploying the Enzoic Client, see [Client Setup](/enzoic-for-active-directory/v3.5/installation-and-setup/client-setup-instructions). The settings on this page control the following: * **Disable Enzoic Password Credential Provider**\ This can be used as a bailout if for some reason a problem with the Enzoic Client is blocking a user from being able to sign into their system. Checking this allows you to temporarily disable the Enzoic Clients throughout this domain. * **Alternate Credential Provider GUID**\ By default, the Enzoic Client will wrap the default Windows system credential provider (which just provides a password prompt for users). If your organization uses a different credential provider, to provide MFA services for instance, you will need to add the GUID for this provider in this field. This will instruct the Enzoic Client to wrap this provider instead.\ \ **Note that you will likely need to whitelist the Enzoic credential provider in the 3rd party product or it will typically disable the Enzoic provider. The Enzoic credential provider's GUID is C6522CF0-8F6E-4E5A-BC65-9D3B7E8390C2.** * **Credential Provider Whitelist GUIDs**\ By default, the Enzoic Client will disable other credential providers when it is installed. This reduces user confusion when there are multiple providers enabled. In the case where you wish for users to be able to use alternate credential providers in addition to the Enzoic provider, add the GUIDs for those providers to this whitelist. Doing this will ensure the Enzoic Client does not disable these other providers. ## **Other Settings**

Other Settings Tab

This page is where the 1-click NIST Compliance feature can be enabled or disabled and where you may change the DC currently set as your Delegate Server. * **1-Click NIST Compliance**\ Enabling this setting will enable a new widget on your Enzoic Console Dashboard, showing you your current NIST 800.63b compliance status. When the option is initially checked, it will automatically update all of your policy settings to compliant values. However, you can subsequently manually modify policy settings and break compliance. If you do this, the widget will warn you about which settings/policies are out of compliance.\ \ NIST Compliance ensures the following settings are enabled: * *Screen Password Changes* * *Screen Password Resets Performed by Administrators* * *Reject Common Passwords Found in Cracking Dictionaries* * *Use Fuzzy Password Matching* * *Continuous Password Monitoring* * *Action to Take* will be set to *User Must Change Password on Next Login*, with a 72 hour delay * *Notify Affected Users by Email When Their Password is Compromised* will be enabled * **Delegate Server**\ The Delegate Server is the DC in your organization which performs the Password and Credentials Monitoring scans. These scans occur in an evenly spaced out manner over the course of the day and are generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems. * **Enzoic Console and Service Log Verbosity**\ This setting is used to adjust the detail level of logging that the Enzoic Console and Service processes use to record diagnostic and activity messages to the local log file. The verbosity can be increased to assist Enzoic support with troubleshooting, but will generate a much larger volume of log data if increased. # Reporting Enzoic for Active Directory v3.5 The Reporting page of the Enzoic Console allows you to see statistics about how many password change operations Enzoic has checked for your organization, how many were matched, as well as how many password/credentials have been checked by your continuous monitoring features. This is also where you’ll find the Monitored Users report, which contains a detailed breakdown of which users in your organization are currently being monitored by Enzoic for Active Directory and what the current status of their password security is. The dropdown menu in the upper right of this page allows you to select which report you’d like to view. Reports: {% content-ref url="/pages/jViWYRbXf3P0phgJuNZI" %} [Password Change Report](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/password-change-report) {% endcontent-ref %} {% content-ref url="/pages/6J1lHYSYeJjuHN5DyorA" %} [Continuous Monitoring Report](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/continuous-monitoring-report) {% endcontent-ref %} {% content-ref url="/pages/eefA4JdpRkIonhVdmglv" %} [Monitored Users Report](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/monitored-users-report) {% endcontent-ref %} {% content-ref url="/pages/sQ42Lp29mK5owmn4omhT" %} [Compromised Users Report](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/compromised-users-report) {% endcontent-ref %} {% content-ref url="/pages/XQ8tNS2QleWTkW5MXl3g" %} [Users Sharing Passwords](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/users-sharing-passwords) {% endcontent-ref %} {% content-ref url="/pages/w2pN4ctjxen3TFYqnbUW" %} [Users with Passwords Set to Never Expire](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/users-with-passwords-set-to-never-expire) {% endcontent-ref %} {% content-ref url="/pages/QmH2hQdfLZGCK9WQkVxQ" %} [Users with No Password Set](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/users-with-no-password-set) {% endcontent-ref %} {% content-ref url="/pages/UK21yjCnrebNFI9gJ9hG" %} [Stale User Accounts](/enzoic-for-active-directory/v3.5/product-usage/enzoic-installed-product-console/reporting/stale-user-accounts) {% endcontent-ref %} # Password Change Report Enzoic for Active Directory v3.5

Sample Password Change Report

This report shows you a statistical view over time of how many user password change operations have been checked by Enzoic and how many of those ended up being matches with a compromised or weak password (i.e. the new password was rejected). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). # Continuous Monitoring Report Enzoic for Active Directory v3.5

Sample Continuous Monitoring Report

This report shows you a statistical view over time of how many user passwords and credentials were scanned by the continuous monitoring functions (User Password Monitoring and User Credentials Monitoring). It also indicates how many of those checks ended up being matches with a compromised or weak password or credentials (i.e. the user’s password or credentials were flagged as compromised). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). # Monitored Users Report Enzoic for Active Directory v3.5

Sample Monitored Users Report

This report shows you a list of all the users currently being monitored by Enzoic for Active Directory, along with a Compromised status for each user. For each user, you can also see what the current status is for Password Monitoring and Credentials Monitoring. The filter dropdown at the top right allows you to further filter the report, so you can, for instance, just see users with currently compromised passwords. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Monitored Users Report Fields**
FieldDescription
PolicyThe current effective monitoring policy for this user.
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
Password MonitoringIndicates whether Password Monitoring is active for this user. Possible values are Yes, No, or Limited. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks and indicate only an exact match with the user’s current password would be caught (i.e. things like fuzzy matching won’t work). Force a password change for this user to rectify this condition.
Credentials MonitoringIndicates whether Credentials Monitoring is active for this user. Possible values are Yes, No, or Pending. Pending indicates Enzoic has not observed a password change for this user to cache their current password. Until then, we will not be able to monitor this user’s credentials for compromise. Force a password change for this user to rectify this condition.
CompromisedThe user’s current compromise status. See possible status values in the section below.
#### **Compromise Status Values** The potential values for the Compromised column are as follows:
ValueDescription
Password CompromisedIndicates this user’s password was found to be compromised during a Password Monitoring scan.
Credentials CompromisedIndicates this user’s credentials (exact email/password combination) were found to be compromised during a Credentials Monitoring scan.
No (Limited Check)Indicates that while the user’s current password and credentials are not known to be compromised, currently a limited check is being used. A limited check indicates that we do not have the exact password cached, so only an exact match with a compromised password would be flagged. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks. Once this user changes their password, the Limited restriciton will be removed.
NoIndicates the user’s password and/or credentials are being checked completely and no compromise has been identified.
# Compromised Users Report Enzoic for Active Directory v3.5

Sample Compromised Users Report

This report shows you a list of all the users with out-of-policy passwords or compromised credentials. For each user, you can see when the compromised password was detected and what remediation action was taken in response, along with the current status of that remediation action. The *More Info* link next to each user will bring up a dialog with additional details. The *Monitoring Policy* filter dropdown at the top right allows you to further filter the report, so you can filter down to just the users under a specific monitoring policy. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Compromised Users Report Fields**
FieldDescription
UsernameThe user’s username in AD.
Compromised OnThe time the compromise was detected, in your local timezone
Policy AppliedThe monitoring policy the user was under at the time of the detection
Original Action TakenThe remediation action specified on the policy at the time of the compromise
Remediation Action StateThe current status of the remediation action. In the case of delayed remediation actions, this indicates whether the delay period has expired or not and whether the action was applied. In the case where an administrator has manually applied a remediation from this console, that will appear here as well.
You can use the checkboxes on the left side of each row to select one or more compromised users and manually apply one of the three remediation actions available by clicking the buttons at the bottom of the grid: | Action Button | Effect | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Force Password Change Now | Sets the account(s) to *Force Password Change on Next Login* in Active Directory | | Disable Account(s) Now | Disables the selected account(s) in Active Directory | | Notify User(s) by Email | Resends the email notification users receive letting them know they need to change their password. This will use the custom email content you have specified for the applied policy. | Clicking the *More Info...* link on a row brings up the Compromise Details dialog:

Sample of the Compromise Details dialog

This dialog contains more detailed info about the compromised password, including an Event Log of all events that have occurred from the time of detection. You can take the same manual remediation actions from this dialog. # Users Sharing Passwords Enzoic for Active Directory v3.5

Sample Users Sharing Password Report

This report shows you a list of all the users who have been detected as currently sharing a password. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Users Sharing Passwords Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# Users with Passwords Set to Never Expire Enzoic for Active Directory v3.5

Sample Users with Passwords Set to Never Expire Report

This report shows you a list of all the users who have been detected as having a password which never expires. Depending on your organization's policies, this may or may not be acceptable. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Users with Passwords Set to Never Expire Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# Users with No Password Set Enzoic for Active Directory v3.5

Sample Users with No Passwords Set Report

This report shows you a list of all the user accounts with no password set. This is generally problematic from a security standpoint. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Users with No Passwords Set Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# Stale User Accounts Enzoic for Active Directory v3.5

Sample Stale User Accounts Report

This report shows you a list of all the user accounts which have not been logged into in the last 6 months. Stale accounts can be a security risk since they could be used by an attacker or a former employee and may have old, insecure passwords. These inactive accounts also consume reclaimable database space in your Active Directory. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Stale User Accounts Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# License Enzoic for Active Directory v3.5
The License page of the Enzoic Console allows you to check your license status, verify license details, and, if necessary, switch to a different product key. # Test Page Enzoic for Active Directory v3.5
The Test Page of the Enzoic Console allows you to test that your settings are working as expected and that the Enzoic API Servers are reachable from your environment.Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/v3.5/product-usage/troubleshooting). # Enzoic Web Product Console Enzoic for Active Directory v3.5 The Enzoic Web Product Console allows you to monitor many aspects of the function of Enzoic for Active Directory from a browser. To access the Enzoic web-based product console, login to your Enzoic account at Access for additional users can be added from the console's User Management page at The console is only accessible for installations starting with Enzoic for Active Directory version 3.5. In this release, the console data is read only. ## **Using the Console** [Overview](/enzoic-for-active-directory/v3.5)\ [Alerts](/enzoic-for-active-directory/v3.5/product-usage/enzoic-web-product-console/alerts)\ [Activity History](/enzoic-for-active-directory/v3.5/product-usage/enzoic-web-product-console/activity-history)\ [Error Log](/enzoic-for-active-directory/v3.5/product-usage/enzoic-web-product-console/error-log)\ [Server Status](/enzoic-for-active-directory/v3.5/product-usage/enzoic-web-product-console/server-status)\ [Clients](/enzoic-for-active-directory/v3.5/product-usage/enzoic-web-product-console/clients)\ [Password Test](/enzoic-for-active-directory/v3.5/product-usage/enzoic-web-product-console/password-test)
# Overview Enzoic for Active Directory v3.5

Overview page

The Overview page provides a snapshot of activity in your monitored domain. There are two panels on this page: Alerts and Domain Stats for the Current Month. ## Alerts The Alerts panel lists out any outstanding compromised password or credentials alerts as well as any outstanding error alerts which should be reviewed. Clicking on an alert brings up a dialog with additional details. You may hide an alert by clicking the X in the top right of the alert row or clicking the Dismiss button in the alert popup dialog. Additional alert details can be found on the Alerts or Error Log pages for compromise alerts and error alerts, respectively. ## Domain Stats for the Current Month The Domain Stats panel gives you aggregate stats for your domain. It has collapsible sections for the following: * **Domain User Count**\ This section contains aggregate details about your domains' users, including total number of users in the domain, how many are protected by Enzoic, how many are currently sharing passwords, have no password set, etc. * **Monitored Domain Controllers**\ This section contains details about how many domain controllers have Enzoic installed along with online/offline status. * **Password Changes Screened**\ This section contains details related to Enzoic's password screening functionality. The stats are for the current calendar month and provide information about how many password change attempts Enzoic has screened and, if any attempts were blocked due to policy, stats on which policy rules were responsible for the rejections. * **Continuously Monitored Accounts**\ This section contains details related to Enzoic's Password Monitoring and Credentials Monitoring functionality. The stats are for the current calendar month and indicate how many user accounts have been identified with out-of-policy passwords or compromised credentials during that timeframe, as well as stats on which policy rules were violated by the out-of-policy passwords. Inline help popups next to each stat provides more details. # Alerts Enzoic for Active Directory v3.5
The Alerts page provides information about compromised passwords and credentials which have been detected by Enzoic's Password Monitoring and Credentials Monitoring functions. Any time an out-of-policy password or compromised credential is found for a monitored user, an open alert is created. This alert is not considered resolved until either the user's password has been changed or the account has been deleted. This page lets you view a detailed listing of all open and resolved alerts, as well as what activity has occurred for each alert. Clicking on an alert shows the Alert Details panel with more information. Inline help popovers provide details on each field. # Activity History Enzoic for Active Directory v3.5
The Activity History shows all activity Enzoic tracked in your domain that is related to user passwords: * Compromised Password Detections * Compromised Credentials Detections * Automated and Manual Remediation Actions Taken for Compromised Accounts * Compromised Password/Credentials Resolutions * User Password Changes * Rejected Password Change Attempts Clicking on a row shows the Activity Details panel with additional information about that activity. Inline help popovers provide details on each field. # Error Log Enzoic for Active Directory v3.5
The Error Log page displays any error conditions encountered by your Enzoic for Active Directory installation. It can be used to help troubleshoot and diagnose issues and to prevent errors that may be preventing proper operation of Enzoic from going undetected. There are three possible error statuses: * **Open**\ This is an open error condition that needs to be addressed. An example might be a misconfiguration preventing Enzoic from checking password changes. Once the error is corrected, the error status will change to Resolved. * **Resolved**\ This is an error condition that has been resolved. * **Transient Error**\ An error that occurred, but was not a persistent condition. These are typically just informational, but could potentially be a clue that there is a larger issue that should be investigated. An example might be a timeout while checking a password change. An isolated failure may not be meaningful, but if you are consistently seeing timeouts, this would need to be investigated further. Clicking on a row shows the Error Details panel with additional information about that error. Inline help popovers provide details on each field. # Server Status Enzoic for Active Directory v3.5
The Server Status page shows all domain controllers in your organization that have Enzoic for Active Directory installed. This allows you to easily identify servers where Enzoic is offline or having issues, and verify which version of the Enzoic software is installed on each. You can hide servers that are no longer in service, or show hidden servers if you need to see them again by seleting the *Hide/Show Server* option in the left hand side menu popup for each row. The *Show Hidden Servers* option in the grid header controls whether these hidden servers are displayed or not. Clicking on a row shows the Server Details page with additional details:
# Clients Enzoic for Active Directory v3.5
The Clients page is a listing of all Windows PCs in your organization that have the Enzoic Client installed. Click on a client to view more details:
# Password Test Enzoic for Active Directory v3.5
The Password Test page allows you to test passwords for acceptability with various policy settings applied. This can be used to help troubleshoot why a password is being rejected with a given set of policies in cases where the Enzoic Windows Client is not able to be used for this purpose. By selecting the same password policy settings as you have for a given Monitoring Policy and entering a user's information and candidate password, it is possible to get a listing of why the candidate password is being rejected. # Logging and SIEM Integration Enzoic for Active Directory v3.5 ## **Log Files** By default, Enzoic for Active Directory stores logs in the following location:\ **`C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs`** The following log files are available:
LogTypeFilename(s)Format(s)Description
ConsoleEnzoicConsole_{logDate}.json
EnzoicConsole_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic console UI.
ServiceEnzoicService_{logDate}.json
EnzoicService_{logDate}.log		JSON
TXT		These are logs generated by the Enzoic service. These tend to be the most useful for troubleshooting and contain details for when a compromised password is found for a user by Compromised Password Protection as well as when a password change is blocked.
FilterEnzoicFilter.txtTXTThese are logs generated by the Enzoic password filter DLL.
Logs rollover and are only stored for the last 7 days. ## **SIEM Integration** Enzoic for Active Directory logs important events to a JSON format log file which can be used for ingestion into SIEM systems. The following describes the information contained in these log entries. Logs files are stored at:\ `C:\ProgramData\Enzoic\Enzoic for Active Directory\Logs` ### **1.1 Log Entry Fields / Structure** Each JSON log entry has the following structure.
FieldDescription
timeTimestamp at which the event occurred.
threadIdThe managed .NET thread ID which was running.
levelLevel of event severity. This can be one of the following: INFO, WARN, ERROR.
eventDataA JSON object containing additional details, specific to the event. The object has one field, “data” containing an object with the actual details.
eventThis is either a message or an enum value indicating the event kind. (see the eventKind field in table 1.2)
### **1.2 Event Data Fields – Common to All Events** The content of eventData varies per the type of logged event, but the following fields are always present.
FieldDescription
eventKindIndicates the nature of the event. See table 1.3 for possible values.
detailsEither a free-form complex object or extended message. Can be null.
### **1.3 Event Kinds**
NameDescription
InfoGeneral informational message.
WarningA recoverable problem or unusual event has occurred.
ErrorA (possibly unrecoverable) problem has occurred, and may require user intervention or investigation.
PasswordChangedUser account password was changed.
PasswordChangeRejectedUser account password change was attempted, but the password did not pass the integrity checks.
CompromiseDetectedDelayedRemediationScheduledA compromised password was detected, and was either remediated, or scheduled for remediation after a delay.
DelayedRemediationActionTakenA previously scheduled remediation was applied.
## **Log Entry Details for Each Event Kind** ### **1.4 Info** Recorded when there is a general informational message. Example: ```json { "time": "2019-08-07 16:24:57.2758", "threadId": "22", "level": "INFO", "event": "Service shutdown.", "eventData": { "data": { "eventKind": "Info", "details": null } } } ``` ### **1.5 Warning** Recorded when a recoverable problem or unusual event has occurred. Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "WARN", "event": "The user tu1 no longer exists. Cleaning up artifacts related to this user.", "eventData": { "data": { "eventKind": "Warning", "details": null } } } ``` ### **1.6 Error** Recorded when a problem has occurred that may require user intervention or investigation. The eventData payload contains the exception details and can be helpful to support for further investigation.
FieldDescription
exceptionClassThe name of the .NET exception class, if there is an exception.
exceptionMessageThe exception message, if there is an exception.
Example: ```json { "time": "2019-08-07 15:02:37.3696", "threadId": "10", "level": "ERROR", "event": "Something bad happened..", "eventData": { "data": { "eventKind": "Error", "details": null, "exceptionClass": "Exception", "exceptionMessage": "Exception text" } } } ``` ### **1.7 PasswordChanged** Recorded when a user password was successfully changed.
FieldDescription
userThe SAM account name of the account that was updated.
Example: ```json { "time": "2019-08-07 15:00:59.9008", "threadId": "16", "level": "INFO", "event": "PasswordChanged", "eventData": { "data": { "user": "tu1", "eventKind": "PasswordChanged", "details": null } } } ``` ### **1.8 PasswordChangeRejected** Recorded when a user password change was rejected by Enzoic due to policy settings.
FieldDescription
userThe SAM account name of the account on which the password change was attempted.
detection methodsEnzoicApi,
LocalDictionary,
PasswordSimilarity,
UserDisplayName,
UserName,
UserEmail
match typesExactMatch,
FuzzyMatch,
RootPasswordMatch
Example: ```json { "time":"2020-09-02 14:15:08.5068", "threadId": "4", "level": "INFO", "event": "The password is compromised and cannot be used. Detected by EnzoicApi and matched on RootPasswordMatch", "eventData": { "data": { "user": "testfosmo", "detectionMethod":"EnzoicApi", "matchTypes":[ "RootPasswordMatch" ], "eventKind": "PasswordChangeRejected", "details": null } } } ``` ### **1.9 CompromiseDetectedDelayedRemediationScheduled** Recorded by User Password Monitoring when a user password was detected as compromised and a delayed remediation was scheduled (e.g. force password change after 24 hours)
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenIndicates the action that was taken in response to the compromise. See table 1.11 for possible values.
actionDelayHoursThe number of hours before the delayed remediation will take effect . This only applies when actionTaken is ForcePasswordChangeOnLoginDelayed or DisableAccountDelayed
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "CompromiseDetectedDelayedRemediationScheduled", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLoginDelayed", "actionDelayHours": 1, "eventKind": "CompromiseDetectedDelayedRemediationScheduled", "details": null } } } ``` ### **1.10 DelayedRemediationActionTaken** Recorded by User Password Monitoring when a previously scheduled delayed remediation was taken. For example, if a user was scheduled to force a password change after 24 hours, this event gets logged when the user is set to Force Password Change on Next Logon in AD.
FieldDescription
userThe SAM account name of the affected account.
detectionTimestampTimestamp of when the compromise was detected.
actionTakenPossible values: ForcePasswordChangeOnLogin, DisableAccount
actionDelayHoursAlways zero.
Example: ```json { "time": "2019-08-07 15:01:35.7445", "threadId": "10", "level": "INFO", "event": "DelayedRemediationActionTaken", "eventData": { "data": { "user": "tu1", "detectionTimestamp": "2019-08-07T15:01:35.7134337-04:00", "actionTaken": "ForcePasswordChangeOnLogin", "actionDelayHours": 0, "eventKind": "DelayedRemediationActionTaken", "details": null } } } ``` ### **1.11 Remediation Actions** The possible remediation action values for log events are listed below.
NameDescription
ForcePasswordChangeOnLoginThe affected user account is updated to require the password to be changed on the next login attempt.
ForcePasswordChangeOnLoginDelayedThe affected user account is updated to require the password to be changed on the next login attempt. This action is delayed by the number of configured hours.
DisableAccountThe affected user account is disabled.
DisableAccountDelayedThe affected user account is disabled. This action is delayed by the number of configured hours.
NotifyOnlyAn email notification is sent to the configured recipients. No further remediation is taken.

# Backup Considerations Enzoic for Active Directory v3.5 If you are routinely backing up Active Directory in your environment, you may wish to exclude certain volatile Enzoic entries. Enzoic stores its configuration data in Active Directory, as well as some transitory data under the Enzoic container in AD’s System container. Excluding the Enzoic containers which represent this transitory data can prevent exceptions in your backup software, where backups fail due to items getting created and deleted while the backup is running. A list of the AD containers we recommend excluding from your backups is below: ``` System\Enzoic System\DEL-EnzoicTest* ``` # Troubleshooting Enzoic for Active Directory v3.5 You can use the following checks to verify the installation completed as expected. * Check windows\system32 and confirm the presence of EnzoicFilter.dll * Check the registry HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa for the presence of Enzoic in the notifications packages value * Check the Event viewer system logs after reboot to confirm there are no errors about indicating a failure to load the EnzoicFilter.dll * Check the product logs at ..\ProgramData\Enzoic\Enzoic. Log files should typically be retrieved from the DC configured as the Delegate Server. You can check which server is the Delegate from the Enzoic Console | Monitoring Settings | Continuous Password Protection area. ## **Network Reachability** If you are seeing problems reaching the Enzoic servers, please review your proxy server settings as well as the [Firewall Requirements section of Install Prerequisites](/enzoic-for-active-directory/v3.5/installation-and-setup/installation-prerequisites#firewall-requirements). ## **Email Notifications Not Being Received** If emails notifications aren’t being received, add **enzoic.com** to your approved senders. If your spam filter requires you to whitelist the Enzoic SMTP servers by IP address, you can determine the current IP address list with the following commands: #### Windows: ``` C:>nslookup -type=TXT amazonses.com | find "v=spf1" ``` #### Linux/OSX: ``` $ dig TXT amazonses.com +short| grep 'v=spf1' ``` This will return the SPF record in use, which will change over time. Example: ``` "v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ~all" ``` ## **Enzoic Local Port** Enzoic for Active Directory uses a local port for communications between the password filter and its service. The default port is 6164. If necessary, the port can be changed using a registry setting: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` ## **Antivirus Whitelisting** Some heuristics based antivirus software may trip on Enzoic. To ensure smooth operation, we recommend whitelisting the Enzoic processes and files under: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` # Overview Enzoic for Active Directory v3.6 Enzoic for Active Directory is a tool that integrates into Active Directory and enforces additional password rules to prevent users from using compromised credentials. Unlike products that only check passwords after they are saved, thus requiring subsequent reset by the user, Enzoic validates the password at the time it is being selected. Passwords are then continuously monitored to detect if they become compromised – with automated remediation and alerts. It helps organizations with NIST Password Guideline compliance in Active Directory. Learn more in our [technical FAQ](https://support.enzoic.com/support/solutions/70000125966) on Enzoic for Active Directory. Find out what’s new in the latest product release [here](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Getting Started** To get started with Enzoic for Active Directory, we recommend you review the [Installation Prerequisites](/enzoic-for-active-directory/installation-and-setup/installation-prerequisites) page to ensure your environment is ready. Then follow the instructions in [Setup Instructions](/enzoic-for-active-directory/installation-and-setup/setup-instructions) to get the product up and running in your environment. For deployment in larger environments with many domain controllers, you may wish to review our [Automated Deployments](/enzoic-for-active-directory/installation-and-setup/automated-deployments) page. If you would like to evaluate the product in a test setting first, we recommend installing it on a Windows Server virtual machine using a product such as VMWare or one of the cloud hosting providers (AWS EC2, Azure VMs, or GCP Compute Engine). Getting up and running in a simple environment like this takes just a few minutes. The Enzoic Client is an optional component which gives your Windows users better information about what is required to select a good password, as well as feedback as to why a selected password may have been rejected if they are changing their password from the Windows Change Password screen. If you’re interested in deploying the Enzoic Client, you can find instructions for how to do so on the [Client Setup Instructions](/enzoic-for-active-directory/installation-and-setup/client-setup-instructions) page. If you have backup software that backs up your Active Directory, you’ll want to exclude some of the volatile keys that Enzoic uses. See the [Backup Considerations](/enzoic-for-active-directory/product-usage/backup-considerations) page for more information. Finally, if you have a SIEM system and wish to feed information from Enzoic for Active Directory into it, you can take a look at the [Logging and SIEM Integration](/enzoic-for-active-directory/product-usage/logging-and-siem-integration) page. # Installation Prerequisites Enzoic for Active Directory v3.6 ## **System Requirements** Enzoic for Active Directory supports any Windows Server 2012 or later for Forest and Domain functional level. Microsoft .NET Framework 4.5.1 or newer is required. Enzoic for Active Directory requires an active Internet connection. You can specify a proxy server if you do not want Enzoic for Active Directory communicating directly over the Internet. Please see Firewall Requirements below for the required IP whitelist. ## **Firewall Requirements** Enzoic for Active Directory must be able to contact its servers to look up the compromised status for passwords. If your firewall supports whitelisting by FQDN, whitelist the following FQDNs for outbound communications over TCP port 443 from your domain controllers: ``` api.enzoic.com app-api.enzoic.com cdn.enzoic.com ``` If your firewall cannot whitelist by FQDN, the IP addresses below should be whitelisted for outbound communications over TCP port 443 from your domain controllers. ``` 13.235.194.196 13.48.121.56 13.48.96.148 15.206.40.21 18.196.181.48 3.10.99.236 3.124.25.136 3.231.37.171 3.24.50.155 3.24.93.121 3.9.236.117 34.214.110.33 35.153.27.185 35.163.59.86 35.168.85.109 35.180.249.238 35.181.124.196 52.192.30.99 52.199.52.28 52.212.218.163 52.48.142.122 52.51.10.65 52.79.68.108 52.89.197.157 54.172.238.226 54.180.42.79 54.233.211.111 54.233.236.93 75.2.9.104 99.83.177.145 ``` ## **Antivirus Whitelisting** If you are running any type of heuristics based antivirus software, for example CrowdStrike, you must whitelist the Enzoic processes and files in the following locations: ``` C:\Program Files\Enzoic for Active Directory C:\Windows\System32\EnzoicFilter.dll ``` Heuristics-based antivirus applications will often interfere with Enzoic’s ability to read and write from Active Directory. ## **Ensure Enzoic Port is Available** Enzoic for Active Directory uses a local port for communications between its processes on each Domain Controller where it is running. The default port is 6164. If this port is being used by other software on the system, unexpected behaviors may result. If necessary, the port can be changed using the following registry setting after install: ``` Registry Key: "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Enzoic\Enzoic for Active Directory" Value Name: ServicePort Value Type: DWORD Value: (new port to use) ``` # Setup Instructions Enzoic for Active Directory v3.6 Please ensure you’ve reviewed the information on the [Installation Prerequisites](/enzoic-for-active-directory/installation-and-setup/installation-prerequisites) page prior to proceeding. ## **Download the Installer** Links to download the most current version (Domain Controllers must all run the same version): **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: d09e7575587b76bae2e2655c2b4b1ad4 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/installation-and-setup/client-setup-instructions) **for more details):**\ [**https://cdn.enzoic.com/files/EnzoicForADClient\_3.6.146.0.msi**](https://cdn.enzoic.com/files/EnzoicForADClient_3.6.146.0.msi)\ MD5: 8799f68a982b6341d83b112c47751158 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Multiple Domain Controllers** Enzoic for Active Directory needs to be installed on every writable domain controller in the target domain – it is not necessary to install it on read only domain controllers. Note that Enzoic for Active Directory stores its configuration settings in Active Directory, so once it is configured on one domain controller, the configuration settings will replicate to all the domain controllers in the domain. ## **Multiple Domain Environments** Enzoic for Active Directory runs at the domain level and does not support interacting with multiple domains. Its configuration and state are all stored at the domain level. If you have an environment with a multi-domain forest or parent-child domain relationships, Enzoic for Active Directory must be installed and managed separately on each domain in your environment. After installing Enzoic for Active Directory on the first DC in each domain, you will need to run the console application as a domain admin on that domain and go through first time configuration. ## **Setup Wizard Installation** Run the installer, and then reboot the domain controller when prompted. Future upgrades will not generally require a reboot, but the initial install does. Enzoic for Active Directory needs to run on each domain controller; however, it only needs to be configured once. All configuration settings (with the exception of the optional proxy server settings) are stored in Active Directory and automatically shared with all instances of that domain. After the initial reboot, the Setup Wizard will walk you through the configuration process with the following steps. All settings can be modified through the console after initial set-up:
Step 1 - Network Settings Adjust the API timeout duration. This controls how long a user password change will be held waiting for a response from the Enzoic API. If the timeout is reached, the password change will be allowed to go through without checking the user password for compromise. The compromise status will be detected subsequently if Continuous Password Protection is enabled. Although it is completely dependent on your Internet connection, typical response times for the Enzoic API from most locations are less than 500 milliseconds. OPTIONAL: Specify an HTTP proxy server to use if your DC does not have direct Internet access. This setting will need to be configured separately on each Domain Controller. The Enzoic API Connection section at the bottom lets you test connectivity to the Enzoic API and, optionally, override the endpoint used.
Step 2 - License Enter the Enzoic License Key provided for your account. You can [register](https://www.enzoic.com/free-trial-2) to obtain a free key
Step 3 - Monitored Entities Specify which Active Directory accounts to protect. You can select any combination of individual users, groups, or containers/OUs. For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Step 4 - One-Click NIST Compliance Choose if you’d like to accept the default settings recommended for NIST 800-63b compliance: * Custom dictionary for context-sensitive words for your business * Common passwords found in cracking dictionaries * Fuzzy matching for common password patterns and substitutions * Continuous monitoring to detect when existing user passwords become vulnerable If you choose NIST 800-63b compliance mode, these settings will be automatically applied and you will get an overall status on the Enzoic Console dashboard indicating whether your current settings in compliance. If you’re unfamiliar with the new NIST 800-63b standard, a quick rundown is [here](https://www.enzoic.com/surprising-new-password-guidelines-nist/) and the full standard can be found [here](https://pages.nist.gov/800-63-3/sp800-63b.html).
Step 5 - Custom Dictionary (only shown when NIST Compliance chosen) **Add Words Specific to Your Business to the Custom Dictionary**\ **(only shown when One-Click NIST Compliance is selected)** If you choose NIST 800-63b compliance mode, you should add words specific to your business and office locations. Add product name(s), your business name(s), names of cities your offices are in, local sports teams, etc. These will be added to the local dictionary and used to prevent passwords containing these terms. Make sure not to include words that are too short or generic, as this will prevent any passwords containing these strings from being used.
Step 6 - Password Change Screening (not shown when NIST Compliance chosen) **(not shown when One-Click NIST Compliance is selected)** Select whether you want Enzoic to screen user password changes. When enabled, users who are in one of the monitored groups or OU’s will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password. You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however. The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
Step 7 - User Password Monitoring User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 8) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Lastly, you can select the Delegate Server used to run User Password Monitoring scans. This is the DC in your organization which will do the work of checking user passwords for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 8 - User Credentials Monitoring (if licensed) Note that this page will be omitted if your license isn’t enabled for User Credentials Monitoring. When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs. The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the notify list (configured in step 7) as well as optionally the affected user will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from those used for Password Monitoring, so you can use different text specific to this alert type if you prefer. Lastly, you can select the Delegate Server used to run User Credentials Monitoring scans. This is the DC in your organization which will do the work of checking user credentials for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Step 9 - Password Policies (not shown when NIST Compliance chosen) **(only shown when One-Click NIST Compliance is selected)** This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. **Additional Password Policies** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking.Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.
Step 10 - Administrative Notifications Include one or more email addresses to be notified for administrative events. These events include: 1. Detection of new user password compromise 2. Summary of all users’ compromise status 3. Alert about any service operation errors. An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly.
Step 11 - Test Settings The Test Page allows you to test your settings are working as expected and that the Enzoic API Servers are reachable from your environment. Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/product-usage/troubleshooting).
## **Completing Setup** After you have finished the Setup Wizard, you will be placed on the Enzoic Console Dashboard. You will receive a prompt asking if you’d like to run an initial scan of your domain for users with compromised passwords. If you are familiar with the Enzoic AD Lite product, this is essentially the same scan. Proceeding will scan all user passwords in your Active Directory domain to see if the exact password is present in Enzoic’s database of bad passwords (note this scan can take some time for very large domains). At the end of the scan, you will see a dialog with a report showing which users had weak or compromised passwords. From the report, you can select users to perform remediations such as disabling their account or forcing a password change on next login. You may also export the results to a CSV for reference. Completing the setup process above will get you started with a single default monitoring policy and some initial settings. You can always tweak the settings from the Console Settings or Monitoring Policies area. # Client Setup Instructions Enzoic for Active Directory v3.6

Sample policy display with Enzoic Client installed

Sample password rejection message with Enzoic Client installed

Enzoic for Active Directory includes an optional Windows client application that can be deployed to domain-joined Windows workstations in your organization to provide users with better feedback and assistance when selecting a new password. The Windows client application augments the built-in Windows password change screen by adding text to indicate what your password requirements are and in the case of a rejected password change, additional details as to the reasons. For example, if a user’s password is rejected due to being a known compromised password, they will be informed of this fact and asked to select a different password. ## **Compatibility with 3rd Party Authentication Products** 3rd party authentication products which add additional capabilities such as multi-factor authentication typically integrate with the Windows winlogon system using a credential provider. Windows is capable of supporting multiple credential providers, including the default set that ships with the OS. A vanilla Windows installation will have the default system credential provider active, which processes user password-based logins and handles user password changes. The Enzoic Client functions by installing as another credential provider. It wraps and disables the Windows system credential provider. This is necessary for Enzoic to provide the user with feedback. As previously mentioned, in some environments other credential providers, such as Windows Hello for Business or 3rd party credential providers which provide multi-factor or biometric authentication such as DUO, may be present and may be the default provider. To work alongside these providers, the Enzoic Client will need some additional configuration and you will likely need to whitelist the Enzoic Client's credential provider in your product. See the [Client Settings](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/settings#client-settings) section of the Enzoic Console documentation for more information on the settings available and how to configure Enzoic to wrap a 3rd party credential provider.\ \ See the [Setup Instructions for Specific Alternate Credentials Providers](#setup-instructions-for-specific-alternate-credentials-providers) for instructions specific to selected providers. ## **Download the Client Installer** The installer is available as an MSI to ease deployment via GPO. Microsoft .NET Framework 4.5 is required. Links to download the most current version (Domain Controllers must all run the same version): [**https://cdn.enzoic.com/files/EnzoicForADClient\_3.6.146.0.msi**](https://cdn.enzoic.com/files/EnzoicForADClient_3.6.146.0.msi)\ MD5: 8799f68a982b6341d83b112c47751158 Read the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Automated Deployment to Multiple Workstations via GPO** You can use GPO push installs to easily install the Enzoic for Active Directory Client to multiple user workstations. Note that the Enzoic Client requires .NET Framework 4.5, which does not get installed automatically when running the MSI installer. ### **Steps for Pushing the Enzoic Client via GPO**
Step 1 - Create a Distribution Point 1. Log on to the server you wish to use as a distribution host as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Computers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForADClient.msi` into the distribution point 5. Give the `Domain Computers` security group read access to the `EnzoicForADClient.msi` file in the distribution point. 6. Click Finish.
Step 2 - Create a Group Policy Object (GPO) 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click your domain in the left pane, and then click Create a GPO in this domain, and Link it here…. Note that by default this will deploy the Enzoic Client to all workstations in your domain. If you wish to deploy to a subset, you should apply the GPO to the desired OU or Group. 4. Type `Enzoic Client Distribution` or a name of your choosing, leave Source Starter GPOset to (none), and then click OK.
Step 3 - Prepare the Group Policy Object 1. Right-click the newly created `Enzoic Client Distribution` GPO, and then click Edit… 2. Expand the Computer Configuration, then Policies, then Software Settings nodes in the left pane. 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForADClient.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\server\distribution point share\EnzoicForADClient.msi`. Do not just navigate to the file and select it. 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 4 - Complete the Installation Windows will now install the Enzoic for Active Directory Client on the targeted systems the next time they are restarted.
### **Troubleshooting GPO Deployments** If the client is failing to deploy via GPO, check the following: **Does the GPO apply to the affected system?**\ Check the Scope tab on the GPO in the Group Policy Management Console to ensure the affected workstation(s) are covered by the GPO. **Have the affected workstation(s) been restarted?**\ In some cases it may take two reboot cycles before the GPO gets deployed. **Is the distribution point share and MSI accessible by the affected system(s)?**\ Check that they can access the share and MSI. **Do the affected system(s) have at least .NET Framework 4.5 installed?**\ The MSI will not handle installing this, so you will need to ensure that all target systems have at least .NET Framework 4.5 before pushing the Enzoic Client. **Check the Event Log on the affected system for GPO or install failures occurring after the reboot.** \ If the installer is failing, there should be some indication here. ## Setup Instructions for 3rd Party Credentials Providers If you don't see instructions for your specific provider below, you can try the instructions in the Other section. #### DUO If you are using DUO for MFA, you can setup Enzoic to wrap it as follows: 1. Prior to installing the Enzoic Client, open the Enzoic Console and paste the DUO credential provider GUID into the *Settings | Client Settings | Alternate Credential Provider* *GUID* field: \ 44E2ED41-48C7-4712-A3C3-250C5E6D5D84\ Click Update Configuration 2. In the registry on machines that will run the Enzoic Client, add the following values:\ Key path: HKEY\_LOCAL\_MACHINE\SOFTWARE\Duo Security\DuoCredProv \ Value name: ProvidersWhitelist \ Value type: REG\_MULTI\_SZ \ Value data: {C6522CF0-8F6E-4E5A-BC65-9D3B7E8390C2} 3. Finally, install the Enzoic Client and verify that DUO and Enzoic are working as expected. You should see Enzoic's password change policies on the password change screen and be prompted to validate with DUO when you attempt to save a new password. #### **Windows Hello** If you are using Windows Hello for user sign-ins (i.e. facial recognition, PIN and/or fingerprint auth), you must whitelist these credential providers in the Enzoic Console. Failure to do so will cause workstations where the Enzoic Client is installed to lose access to these authentication mechanisms. 1. Prior to installing the Enzoic Client, open the Enzoic Console and add the following GUIDs into the *Settings / Client Settings / Credential Provider Whitelist GUIDs* list: \ 8AF662BF-65A0-4D0A-A540-A338A999D36F *(Biometric Facial Recognition Provider)* BEC09223-B018-416D-A0AC-523971B639F5 *(Fingerprint Authentication Provider)* D6886603-9D2F-4EB2-B667-1971041FA96B *(PIN-based Authentication Provider)*\ \ ![](https://2701385816-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqUvu5ROhAFk2o0pyF6lF%2Fuploads%2FfvdaRZET00bPpr91uiQs%2Fimage.png?alt=media\&token=e115dee8-acfb-4a60-879e-2066890b3f96) 2. Install the Enzoic Client on a test machine and verify that the Windows Hello authentication options are showing up as expected on the login screen and that password changes are receiving feedback from Enzoic on password policy requirements. #### Other If you don't see specific instructions for your product, try the following: 1. Locate the credential provider GUID for your product. This can generally be found at the following registry key on a workstation that was used to login with that product:\ *HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnProvider* 2. Prior to installing the Enzoic Client, open the Enzoic Console and paste the found credential provider GUID into the *Settings | Client Settings | Alternate Credential Provider* *GUID* field. Then click Update Configuration 3. Determine if it is necessary and if so how to whitelist the Enzoic Client's credential provider with the 3rd party product. This will often be accomplished via a registry entry on the target systems. You may need to contact support for the product to get assistance with this. 4. Finally, install the Enzoic Client and verify that the 3rd party product and Enzoic are working as expected. You should see Enzoic's password change policies on the password change screen. # Upgrade Instructions Enzoic for Active Directory v3.6 Upgrading from an older version to the current release is straightforward and only involves running the installer for the current release on each domain controller in the monitored domain. A reboot will not be required after upgrading, unless upgrading from a version older than 2.0. It is safe to upgrade from any previous version to the current release. ## **Download the Installers for the Latest Release** Links to download the most current version (Domain Controllers must all run the same version): **Server Installer for Domain Controllers (must be installed on all domain controllers):**\ \ MD5: d09e7575587b76bae2e2655c2b4b1ad4 **Client Installer (optional, see** [**Client Setup Instructions**](/enzoic-for-active-directory/installation-and-setup/client-setup-instructions) **for more details):**\ [**https://cdn.enzoic.com/files/EnzoicForADClient\_3.6.146.0.msi**](https://cdn.enzoic.com/files/EnzoicForADClient_3.6.146.0.msi)\ MD5: 8799f68a982b6341d83b112c47751158 Review the [current release notes](https://docs.enzoic.com/enzoic-for-active-directory-release-history). ## **Upgrades in Environments with Multiple Domain Controllers** Enzoic for Active Directory needs to be upgraded on every writable domain controller in the target domain. In organizations where upgrading all servers at once is not possible or permitted, rolling upgrades over longer periods of time are supported. The only restriction is that the server designated as the Enzoic for Active Directory Delegate server in your domain must be upgraded to the new version first. The installer will not allow you to proceed with the upgrade on other DC’s until the Delegate has been upgraded. If you are unsure which Domain Controller in your environment is acting as the Delegate, you may determine this by running the Enzoic Console, going to Settings and clicking on the “Other Settings” tab. The current Delegate will be displayed there. ## **Installing** the **Upgrade** Run the new installer on each DC in the monitored domain in order to upgrade it. As noted in the section above, you must run the upgrade on the Delegate server in your domain first. After the upgrade is complete, run the Enzoic Console and verify there are no issues displayed on the Dashboard or in System Health. # Automated Deployments Enzoic for Active Directory v3.6 ## **Setup with a Configuration File** Starting with version 2.9, Enzoic for Active Directory can be installed and configured headlessly using a YAML configuration file. All of the Enzoic for AD settings can be specified via settings in this file. To get started, download the sample enzoic-config.yml file below and open in a text editor. The settings in the file are documented with comments, but we recommend familiarizing yourself with the product in a test environment first to better understand the various options. Download the sample configuration file: [enzoic-config.yml](https://cdn.enzoic.com/files/enzoic-config-3.5.yml) To specify the configuration file during installation, use the MSI version of the installer and pass in two properties: ENZ\_IMPORT\_CONFIG\_FILE – the full path to your YAML configuration file\ ENZ\_PRODUCT\_KEY – your Enzoic for Active Directory product key Sample MSI command line: ``` msiexec.exe /i "c:\EnzoicForAD.msi" ENZ_IMPORT_CONFIG_FILE="c:\path\to\enzoic-config.yml" ENZ_PRODUCT_KEY=”your-product-key” ``` ## **Deploying Enzoic for Active Directory via GPO** You can use GPO push installs to easily install Enzoic for Active Directory across multiple domain controllers in your environment. Note that Enzoic for Active Directory requires .NET Framework 4.5.1, which does not get installed automatically when running the MSI installer. If you do not already have the .NET Framework 4.5.1 on your servers prior to deploying Enzoic for Active Directory, you will need to deploy that first.
Step 1 - Create an MST file with your product key and YML config path embedded *(Note this step is optional – if you wish, you may instead install Enzoic for Active Directory on the first domain controller in your environment, configure it as you wish and then push the installer to your other domain controllers via GPO, without needing to use a YML configuration file. In this case, the other domain controllers will pick up the shared configuration directly from Active Directory.)* 1. Download Microsoft’s Windows Installer SDK – [Download](http://download.microsoft.com/download/7/c/4/7c426dfc-46e2-4ded-bab4-3b33600ad7d1/msi45sdk.msi) 2. Install the SDK, Find and Run the Orca install (installs to `C:\Program Files (x86)\Windows Installer 4.5 SDK\TOOLS` by default) 3. Run Orca 4. Open the Enzoic for AD MSI in Orca 5. Open the Transform menu and select “New Transform” 6. Navigate to the Property table in the left pane and edit the values for the following properties in the right hand pane: * ENZ\_IMPORT\_CONFIG\_FILE – enter the UNC network path to your enzoic-config.yml file (this will be the network share distribution point for the GPO) * ENZ\_PRODUCT\_KEY – enter your product key 7. Open the Transform menu and select “Generate Transform”, save the MST file 8. Copy the MSI, MST and YML file to your distribution point in the next step.
Step 2 - Create a Distribution Point 1. Log on to a server in the target domain as an administrator. 2. Create a shared network folder to distribute the files from. 3. Give the `Domain Controllers` security group read access to the share, and limit write access to authorized personnel only. 4. Copy `EnzoicForAD.msi` (and optionally the MST and YML file from step 1 above) into the distribution point 5. Give the `Domain Controllers` security group read access to the `EnzoicForAD.msi`file in the distribution point. 6. Click Finish.
Step 3 - Create a Group Policy Object 1. Start the Group Policy Management Console (`gpmc.msc`). 2. Expand the forest and domain items in the left pane. 3. Right-click the `Domain Controllers` OU in the left pane, and then click Create a GPO in this domain, and Link it here… 4. Type `Enzoic for Active Directory` and then press ENTER.
Step 4 - Prepare the Group Policy Object 1. Right-click the `Enzoic for Active Directory` GPO, and then click Edit… 2. Expand the Computer Configuration, Policies, and Software Settings 3. Right-click the Software installation item, and then select New > Package… 4. Type the full UNC path to `EnzoicForAD.msi` in the Open dialog box. You must enter a UNC path so that other computers can access this file over the network. For example, `\\file server\distribution point share\EnzoicForAD.msi` 5. Click Open. 6. Select the Assigned deployment method, and then click OK. 7. Close the Group Policy Management Editor.
Step 5 - Complete the Installation Windows installs Enzoic for Active Directory during startup, and then immediately requires a manual restart to load the Password Filter. Restart each Domain Controller to complete the installation.
# Enzoic Installed Product Console Enzoic for Active Directory v3.6 The locally installed Enzoic Product Console allows you to configure and monitor the function of the Enzoic for Active Directory installation on a single domain. It is installed by the Enzoic for Active Directory installer. {% hint style="info" %} **As of 3.5, Domain Admin access is no longer necessary to run the Enzoic Console. The new Enzoic Admins group (automatically created after install/upgrade) has only the required privileges needed to run the console, allowing you to ensure you are running with the least privileged access necessary.** {% endhint %} The Enzoic Console can be run either by a user who is a Domain Admin or a member of the Enzoic Admins group in Active Directory. It is necessary to run the Enzoic Console application from a computer joined to the domain you wish to configure. It is possible to install the Enzoic Console standalone on any version of Windows using the Enzoic for Active Directory installer – it is not necessary to run it from a server. ## **Using the Console** [Dashboard](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/dashboard)\ [System Health](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/system-health)\ [Monitoring Policies](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/monitoring-policies)\ [Settings](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/settings)\ [Reporting](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting)\ [License](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/license) # Dashboard Enzoic for Active Directory v3.6
* Product upgrade notifications when new versions are available * Overall monitoring status, along with which groups are being monitored * A list of users who have compromised passwords * A list of users who have compromised credentials * NIST 800.63b compliance status, if the 1-click NIST Compliance feature is enabled * Current license status # System Health Enzoic for Active Directory v3.6
The System Health page will alert you to any error conditions that have been detected in your Enzoic for Active Directory installation. A list of all the DC’s that are running Enzoic in your domain will appear, along with reachability status, version information and any errors detected on each. # Monitoring Policies Enzoic for Active Directory v3.6

Monitoring Policies Page

The Monitoring Policies page of the Enzoic Console allows you to add, edit, and delete new Monitoring Policies. Note that if you are on a Business level license, you will be limited to a single policy named “Primary”, but for other license levels you will be able to define multiple monitoring policies to target different groups and OU’s with different monitoring settings. ## **Adding or Removing Policies** Adding or Removing policies can be done from the left hand pane, titled Policies, by using the Add and Remove buttons at the bottom of the list view. Note that it is not possible to remove the default policy. To add a new policy, click Add, select whether you want to copy the settings from an existing policy or start blank, and click OK. The new policy will appear on the right hand pane and you may edit from there. Remember to click “Update Configuration” when finished. It is necessary to select at least one OU/group/user to monitor on the Monitored Entities page in order to save the new policy. See the Policy Settings section below for more details about the various settings available. ## **Policy Precedence** Enzoic does not prevent you from including the same user under multiple policies, since it’s possible a user could end up under multiple policies later as group, OU or container memberships change. Instead policies are applied in order of precedence. If a user is included under multiple policies, the first matching policy in precedence order would be used, as follows: the (Default) policy will be checked first, then remaining policies in alphabetical order. If you are in doubt which policy is being applied to a specific user, you can enter their username on the Test Page to check which policy is being used. You can also view which policy they are falling under with the Monitored Users Report under Reporting. ## **Policy Settings** The following settings are available on each policy, grouped by tab title:
Monitored Entities ![](https://content.gitbook.com/content/qUvu5ROhAFk2o0pyF6lF/blobs/axE0YXwtvO8dCiQ0sV7j/image.png) Specifies which Active Directory accounts to protect with this policy. You can select any combination of individual users, groups, or containers/OUs.For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Password Changes ![](https://content.gitbook.com/content/qUvu5ROhAFk2o0pyF6lF/blobs/baQrtJfGCDsztTdA79S5/image.png) Specifies whether you want Enzoic to screen user password changes for users covered by this policy. When enabled, users will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected on this policy will be rejected and the user will be required to select a different password. You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however. The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools, such as ADUC.
Password Monitoring ![](https://content.gitbook.com/content/qUvu5ROhAFk2o0pyF6lF/blobs/zYIp5sODhNgj93nrl7wY/image.png) User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user. * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period. * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user. * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period. * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured under [Settings](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/settings#admin-notifications)) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” allows you to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that if you are using one of the “delayed” remediation actions and later switch to a different option, any users whose passwords were already detected as compromised but are still within the delay period will continue to process per the settings which were in effect at the time their password was detected as compromised. For example, if a monitored user’s password is detected as being compromised and the “Action to Take” at that time is *Disable Account (Delayed)* with a delay period of 48 hours, then the “Action to Take” setting is subsequently changed to *User Must Change Password on Next Login (Delayed)* with a delay period of 24 hours, that user’s account would still be disabled at the end of the original 48 hour period (provided they do not change their password prior to that time of course). If this needs to be modified, it can be manually changed from the "Compromised Users Report".
Credentials Monitoring ![](https://content.gitbook.com/content/qUvu5ROhAFk2o0pyF6lF/blobs/52K54mr29wkfWu6uo82u/image.png) When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs. The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available: * **User Must Change Password on Next Login**\ Immediately sets the *User must change password at next logon* setting in Active Directory for this user * **User Must Change Password on Next Login (Delayed)**\ Sets the *User must change password at next logon* setting in Active Directory for this user after the selected delay period * **Disable Account**\ Immediately sets the *Account is disabled* setting in Active Directory for this user * **Disable Account (Delayed)**\ Sets the *Account is disabled* setting in Active Directory for this user after the selected delay period * **Notification Only**\ The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken. Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise. If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred. Clicking “Customize Email” allows you to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from the email customization settings that may be configured for Password Monitoring, so you can use different text specific to credentials alerts here if you prefer. ![](https://content.gitbook.com/content/qUvu5ROhAFk2o0pyF6lF/blobs/2BMephvQf6WZ7dyn0mz2/image.png) Note that delayed remediations for Credentials Monitoring have identical behavior as described in the last two paragraphs of the Password Monitoring section above.
Password Policies ![](https://content.gitbook.com/content/qUvu5ROhAFk2o0pyF6lF/blobs/PSi8aou2hpmdfrr5S33C/image.png) This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied. #### **Compromised Password Screening Settings:** * **Reject common passwords found in cracking dictionaries**\ Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches. * **Use fuzzy password matching**\ Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting. * **Screen root passwords**\ Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well. #### **Additional Password Policies** * **Reject passwords without at least one lowercase character** * **Reject passwords without at least one uppercase character** * **Reject passwords without at least one number** * **Reject passwords without at least one symbol** * **Reject passwords containing user’s first or last name**\ Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s login name**\ Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing user’s email address**\ Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed. * **Reject passwords containing repeating characters**\ Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting. * **Password Similarity Blocking**\ Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking. Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function. * **Reject passwords less than a minimum length** * **Reject passwords more than a maximum length**
# Settings Enzoic for Active Directory v3.6 The Settings page of the Enzoic Console allows you to modify settings that aren’t specific to a monitoring policy, such as the local DC’s proxy server settings, your organization’s Custom Password Dictionary, Administrative Notification settings, Enzoic Client settings, the DC used as the Delegate Server, and the 1-click NIST Compliance feature. ## **Network Settings**

Network Settings Tab

This tab contains settings for the password change check timeout and the local DC’s proxy server settings. * **Password Check Timeout**\ This setting controls the timeout when making calls to the Enzoic API during user password change operations. If this timeout is exceeded while waiting for a response from the Enzoic API, the operation will fail and the password change will be allowed through. * **Proxy Server Settings**\ These are the proxy server settings in use for the DC that you are running the console on. Proxy server settings are stored locally to each DC and must be edited from the local Enzoic Console on that system. * **Enzoic API Connection**\ These settings enable you to specify an alternate endpoint to use for the Enzoic API, which is used to check passwords and credentials for compromise against Enzoic's cloud database of breached credentials. Generally it is not necessary to modify these. ## **Custom Password Dictionary**

Custom Password Dictionary Tab

The Custom Password Dictionary allows you to add words or terms you wish to block from inclusion in user passwords. These can be words specific to your business or your location, e.g. local sports teams, your city name, etc. If a user password contains one of these words, it will be rejected. ## **Admin Notifications**

Admin Notifications Tab

This is the list of Administrator email addresses to be notified for administrative events. These events include: * Detection of new user password compromise * Summary of all users’ compromise status * Alert about any service operation errors An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly. The Periodic Summary contains a digest of the activity for the time period covered: users with compromised passwords, users with compromised credentials, remediation actions being taken and their current status, etc. ## **Email Settings**

Email Settings Tab

The Email Settings tab lets you override the default Enzoic SMTP server used by Enzoic for sending emai notifications and alerts to administrators and users. You may choose to use your own SMTP server instead to minimize deliverability and security issues for your users. {% hint style="info" %} Since Enzoic sends email notifications and alerts from its cloud servers, the SMTP server you choose to use must be publicly routable on the Internet. If you need to source IP restrict access to this server, the source IP for Enzoic SMTP traffic is 44.225.15.204. {% endhint %} ## **Client Settings**

Client Settings Tab

These are settings specific to the Enzoic Client, which is installed on user Windows systems. The Enzoic Client provides additional information to users on the Windows password change screen, including what the policy requirements are for a new password and the reasons a password was rejected. For more information on deploying the Enzoic Client, see [Client Setup](/enzoic-for-active-directory/installation-and-setup/client-setup-instructions). The settings on this page control the following: * **Disable Enzoic Password Credential Provider**\ This can be used as a bailout if for some reason a problem with the Enzoic Client is blocking a user from being able to sign into their system. Checking this allows you to temporarily disable the Enzoic Clients throughout this domain. * **Alternate Credential Provider GUID**\ By default, the Enzoic Client will wrap the default Windows system credential provider (which just provides a password prompt for users). If your organization uses a different credential provider, to provide MFA services for instance, you will need to add the GUID for this provider in this field. This will instruct the Enzoic Client to wrap this provider instead.\ \ **Note that you will likely need to whitelist the Enzoic credential provider in the 3rd party product or it will typically disable the Enzoic provider. The Enzoic credential provider's GUID is C6522CF0-8F6E-4E5A-BC65-9D3B7E8390C2.** * **Credential Provider Whitelist GUIDs**\ By default, the Enzoic Client will disable other credential providers when it is installed. This reduces user confusion when there are multiple providers enabled. In the case where you wish for users to be able to use alternate credential providers in addition to the Enzoic provider, add the GUIDs for those providers to this whitelist. Doing this will ensure the Enzoic Client does not disable these other providers. ## **CrowdStrike Setup**

CrowdStrike Settings Tab

If you use CrowdStrike for SIEM in your environment, you can install the Enzoic Connector for CrowdStrike (coming soon). This is where you configure the settings for this connector. ## **Other Settings**

Other Settings Tab

This page is where the 1-click NIST Compliance feature can be enabled or disabled and where you may change the DC currently set as your Delegate Server. * **1-Click NIST Compliance**\ Enabling this setting will enable a new widget on your Enzoic Console Dashboard, showing you your current NIST 800.63b compliance status. When the option is initially checked, it will automatically update all of your policy settings to compliant values. However, you can subsequently manually modify policy settings and break compliance. If you do this, the widget will warn you about which settings/policies are out of compliance.\ \ NIST Compliance ensures the following settings are enabled: * *Screen Password Changes* * *Screen Password Resets Performed by Administrators* * *Reject Common Passwords Found in Cracking Dictionaries* * *Use Fuzzy Password Matching* * *Continuous Password Monitoring* * *Action to Take* will be set to *User Must Change Password on Next Login*, with a 72 hour delay * *Notify Affected Users by Email When Their Password is Compromised* will be enabled * **Delegate Server**\ The Delegate Server is the DC in your organization which performs the Password and Credentials Monitoring scans. These scans occur in an evenly spaced out manner over the course of the day and are generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems. * **Enzoic Console and Service Log Verbosity**\ This setting is used to adjust the detail level of logging that the Enzoic Console and Service processes use to record diagnostic and activity messages to the local log file. The verbosity can be increased to assist Enzoic support with troubleshooting, but will generate a much larger volume of log data if increased. # Reporting Enzoic for Active Directory v3.6 The Reporting page of the Enzoic Console allows you to see statistics about how many password change operations Enzoic has checked for your organization, how many were matched, as well as how many password/credentials have been checked by your continuous monitoring features. This is also where you’ll find the Monitored Users report, which contains a detailed breakdown of which users in your organization are currently being monitored by Enzoic for Active Directory and what the current status of their password security is. The dropdown menu in the upper right of this page allows you to select which report you’d like to view. Reports: {% content-ref url="/pages/jViWYRbXf3P0phgJuNZI" %} [Password Change Report](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/password-change-report) {% endcontent-ref %} {% content-ref url="/pages/6J1lHYSYeJjuHN5DyorA" %} [Continuous Monitoring Report](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/continuous-monitoring-report) {% endcontent-ref %} {% content-ref url="/pages/eefA4JdpRkIonhVdmglv" %} [Monitored Users Report](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/monitored-users-report) {% endcontent-ref %} {% content-ref url="/pages/sQ42Lp29mK5owmn4omhT" %} [Compromised Users Report](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/compromised-users-report) {% endcontent-ref %} {% content-ref url="/pages/XQ8tNS2QleWTkW5MXl3g" %} [Users Sharing Passwords](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/users-sharing-passwords) {% endcontent-ref %} {% content-ref url="/pages/w2pN4ctjxen3TFYqnbUW" %} [Users with Passwords Set to Never Expire](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/users-with-passwords-set-to-never-expire) {% endcontent-ref %} {% content-ref url="/pages/QmH2hQdfLZGCK9WQkVxQ" %} [Users with No Password Set](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/users-with-no-password-set) {% endcontent-ref %} {% content-ref url="/pages/UK21yjCnrebNFI9gJ9hG" %} [Stale User Accounts](/enzoic-for-active-directory/product-usage/enzoic-installed-product-console/reporting/stale-user-accounts) {% endcontent-ref %} # Password Change Report Enzoic for Active Directory v3.6

Sample Password Change Report

This report shows you a statistical view over time of how many user password change operations have been checked by Enzoic and how many of those ended up being matches with a compromised or weak password (i.e. the new password was rejected). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). # Continuous Monitoring Report Enzoic for Active Directory v3.6

Sample Continuous Monitoring Report

This report shows you a statistical view over time of how many user passwords and credentials were scanned by the continuous monitoring functions (User Password Monitoring and User Credentials Monitoring). It also indicates how many of those checks ended up being matches with a compromised or weak password or credentials (i.e. the user’s password or credentials were flagged as compromised). There is a bar for each month showing these numbers. Hovering over the bar provides an additional breakdown of the matches by type of match (i.e. exact match, fuzzy match, etc.). # Monitored Users Report Enzoic for Active Directory v3.6

Sample Monitored Users Report

This report shows you a list of all the users currently being monitored by Enzoic for Active Directory, along with a Compromised status for each user. For each user, you can also see what the current status is for Password Monitoring and Credentials Monitoring. The filter dropdown at the top right allows you to further filter the report, so you can, for instance, just see users with currently compromised passwords. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Monitored Users Report Fields**
FieldDescription
PolicyThe current effective monitoring policy for this user.
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
Password MonitoringIndicates whether Password Monitoring is active for this user. Possible values are Yes, No, or Limited. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks and indicate only an exact match with the user’s current password would be caught (i.e. things like fuzzy matching won’t work). Force a password change for this user to rectify this condition.
Credentials MonitoringIndicates whether Credentials Monitoring is active for this user. Possible values are Yes, No, or Pending. Pending indicates Enzoic has not observed a password change for this user to cache their current password. Until then, we will not be able to monitor this user’s credentials for compromise. Force a password change for this user to rectify this condition.
CompromisedThe user’s current compromise status. See possible status values in the section below.
#### **Compromise Status Values** The potential values for the Compromised column are as follows:
ValueDescription
Password CompromisedIndicates this user’s password was found to be compromised during a Password Monitoring scan.
Credentials CompromisedIndicates this user’s credentials (exact email/password combination) were found to be compromised during a Credentials Monitoring scan.
No (Limited Check)Indicates that while the user’s current password and credentials are not known to be compromised, currently a limited check is being used. A limited check indicates that we do not have the exact password cached, so only an exact match with a compromised password would be flagged. Limited checks are used when Enzoic has not observed a password change for this user to cache their current password for more extensive monitoring checks. Once this user changes their password, the Limited restriciton will be removed.
NoIndicates the user’s password and/or credentials are being checked completely and no compromise has been identified.
# Compromised Users Report Enzoic for Active Directory v3.6

Sample Compromised Users Report

This report shows you a list of all the users with out-of-policy passwords or compromised credentials. For each user, you can see when the compromised password was detected and what remediation action was taken in response, along with the current status of that remediation action. The *More Info* link next to each user will bring up a dialog with additional details. The *Monitoring Policy* filter dropdown at the top right allows you to further filter the report, so you can filter down to just the users under a specific monitoring policy. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Compromised Users Report Fields**
FieldDescription
UsernameThe user’s username in AD.
Compromised OnThe time the compromise was detected, in your local timezone
Policy AppliedThe monitoring policy the user was under at the time of the detection
Original Action TakenThe remediation action specified on the policy at the time of the compromise
Remediation Action StateThe current status of the remediation action. In the case of delayed remediation actions, this indicates whether the delay period has expired or not and whether the action was applied. In the case where an administrator has manually applied a remediation from this console, that will appear here as well.
You can use the checkboxes on the left side of each row to select one or more compromised users and manually apply one of the three remediation actions available by clicking the buttons at the bottom of the grid: | Action Button | Effect | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Force Password Change Now | Sets the account(s) to *Force Password Change on Next Login* in Active Directory | | Disable Account(s) Now | Disables the selected account(s) in Active Directory | | Notify User(s) by Email | Resends the email notification users receive letting them know they need to change their password. This will use the custom email content you have specified for the applied policy. | Clicking the *More Info...* link on a row brings up the Compromise Details dialog:

Sample of the Compromise Details dialog

This dialog contains more detailed info about the compromised password, including an Event Log of all events that have occurred from the time of detection. You can take the same manual remediation actions from this dialog. # Users Sharing Passwords Enzoic for Active Directory v3.6

Sample Users Sharing Password Report

This report shows you a list of all the users who have been detected as currently sharing a password. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Users Sharing Passwords Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# Users with Passwords Set to Never Expire Enzoic for Active Directory v3.6

Sample Users with Passwords Set to Never Expire Report

This report shows you a list of all the users who have been detected as having a password which never expires. Depending on your organization's policies, this may or may not be acceptable. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Users with Passwords Set to Never Expire Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# Users with No Password Set Enzoic for Active Directory v3.6

Sample Users with No Passwords Set Report

This report shows you a list of all the user accounts with no password set. This is generally problematic from a security standpoint. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Users with No Passwords Set Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# Stale User Accounts Enzoic for Active Directory v3.6

Sample Stale User Accounts Report

This report shows you a list of all the user accounts which have not been logged into in the last 6 months. Stale accounts can be a security risk since they could be used by an attacker or a former employee and may have old, insecure passwords. These inactive accounts also consume reclaimable database space in your Active Directory. The Update button in the header allows you to refresh the report. Since this report can be time-consuming to generate for larger domains, it is only refreshed on demand. If the data is stale (more than 15 minutes out of date), you will see a red warning message next to this Update button reminding you that you need to regenerate the report to see current data. #### **Stale User Accounts Report Fields**
FieldDescription
UsernameThe user’s username in AD.
First NameThe user’s first name in AD, if present.
Last NameThe user’s last name in AD, if present.
AdministratorWhether the user account has some form of administrative permissions in AD
# License Enzoic for Active Directory v3.6
The License page of the Enzoic Console allows you to check your license status, verify license details, and, if necessary, switch to a different product key. You may use the Synchronize Licenses button on this page to kick off a manual sync up to the server. Use this if you recently upgraded/downgraded the number of licenses on your account or the plan type to pull down the new details and refresh your license status. This typically shouldn't be necessary, as the product will refresh the license status every 24 hours. {% hint style="info" %} Note that the manual license sync operation will add some additional load to the Delegate server, as it must count the number of users protected by your monitoring policies. {% endhint %} # Test Page Enzoic for Active Directory v3.6
The Test Page of the Enzoic Console allows you to test that your settings are working as expected and that the Enzoic API Servers are reachable from your environment.Entering a username here (either NT4 style or UPN) and a test password allows you to validate that: 1. Everything is working 2. The entered username is in one of the monitored OU’s or groups. 3. The entered password is allowed or not based on your selected policies. A sample compromised password: `uGetL0ckedOut!` If you receive an error indicating there is a problem reaching the Enzoic servers, please review the [Troubleshooting section](/enzoic-for-active-directory/product-usage/troubleshooting). # Enzoic Web Product Console Enzoic for Active Directory v3.6 The Enzoic Web Product Console allows you to monitor many aspects of the function of Enzoic for Active Directory from a browser. To access the Enzoic web-based product console, login to your Enzoic account at Access for additional users can be added from the console's User Management page at The console is only accessible for installations starting with Enzoic for Active Directory version 3.5. In this release, the console data is read only. ## **Using the Console** [Overview](/enzoic-for-active-directory)\ [Alerts](/enzoic-for-active-directory/product-usage/enzoic-web-product-console/alerts)\ [Activity History](/enzoic-for-active-directory/product-usage/enzoic-web-product-console/activity-history)\ [Error Log](/enzoic-for-active-directory/product-usage/enzoic-web-product-console/error-log)\ [Server Status](/enzoic-for-active-directory/product-usage/enzoic-web-product-console/server-status)\ [Clients](/enzoic-for-active-directory/product-usage/enzoic-web-product-console/clients)\ [Password Test](/enzoic-for-active-directory/product-usage/enzoic-web-product-console/password-test)
# Overview Enzoic for Active Directory v3.6

Overview page

The Overview page provides a snapshot of activity in your monitored domain. There are two panels on this page: Alerts and Domain Stats for the Current Month. ## Alerts The Alerts panel lists out any outstanding compromised password or credentials alerts as well as any outstanding error alerts which should be reviewed. Clicking on an alert brings up a dialog with additional details. You may hide an alert by clicking the X in the top right of the alert row or clicking the Dismiss button in the alert popup dialog. Additional alert details can be found on the Alerts or Error Log pages for compromise alerts and error alerts, respectively. ## Domain Stats for the Current Month The Domain Stats panel gives you aggregate stats for your domain. It has collapsible sections for the following: * **Domain User Count**\ This section contains aggregate details about your domains' users, including total number of users in the domain, how many are protected by Enzoic, how many are currently sharing passwords, have no password set, etc. * **Monitored Domain Controllers**\ This section contains details about how many domain controllers have Enzoic installed along with online/offline status. * **Password Changes Screened**\ This section contains details related to Enzoic's password screening functionality. The stats are for the current calendar month and provide information about how many password change attempts Enzoic has screened and, if any attempts were blocked due to policy, stats on which policy rules were responsible for the rejections. * **Continuously Monitored Accounts**\ This section contains details related to Enzoic's Password Monitoring and Credentials Monitoring functionality. The stats are for the current calendar month and indicate how many user accounts have been identified with out-of-policy passwords or compromised credentials during that timeframe, as well as stats on which policy rules were violated by the out-of-policy passwords. Inline help popups next to each stat provides more details. --- [Next Page](https://docs.enzoic.com/enzoic-for-active-directory/llms-full.txt/1)