Monitoring Policies

Specifies which Active Directory accounts to protect with this policy. You can select any combination of individual users, groups, or containers/OUs.For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.

Specifies whether you want Enzoic to screen user password changes for users covered by this policy. When enabled, users will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected on this policy will be rejected and the user will be required to select a different password.

You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however.

The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools, such as ADUC.

User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available:

• User Must Change Password on Next Login Immediately sets the User must change password at next logon setting in Active Directory for this user.

• User Must Change Password on Next Login (Delayed) Sets the User must change password at next logon setting in Active Directory for this user after the selected delay period.

• Disable Account Immediately sets the Account is disabled setting in Active Directory for this user.

• Disable Account (Delayed) Sets the Account is disabled setting in Active Directory for this user after the selected delay period.

• Notification Only The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken.

Regardless of the remediation setting, administrators on the notify list (configured under Admin Notifications) will always receive an email notification of a compromise.

If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred.

Clicking “Customize Email” allows you to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email.

Note that if you are using one of the “delayed” remediation actions and later switch to a different option, any users whose passwords were already detected as compromised but are still within the delay period will continue to process per the settings which were in effect at the time their password was detected as compromised.

For example, if a monitored user’s password is detected as being compromised and the “Action to Take” at that time is Disable Account (Delayed) with a delay period of 48 hours, then the “Action to Take” setting is subsequently changed to User Must Change Password on Next Login (Delayed) with a delay period of 24 hours, that user’s account would still be disabled at the end of the original 48 hour period (provided they do not change their password prior to that time of course). If this needs to be modified, it can be manually changed from the "Compromised Users Report".

When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs.

The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available:

• User Must Change Password on Next Login Immediately sets the User must change password at next logon setting in Active Directory for this user

• User Must Change Password on Next Login (Delayed) Sets the User must change password at next logon setting in Active Directory for this user after the selected delay period

• Disable Account Immediately sets the Account is disabled setting in Active Directory for this user

• Disable Account (Delayed) Sets the Account is disabled setting in Active Directory for this user after the selected delay period

• Notification Only The administrators on the administrative notification list, as well as optionally the affected user, will be notified via email that the password is compromised. No other action will be taken.

Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise.

If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred.

Clicking “Customize Email” allows you to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from the email customization settings that may be configured for Password Monitoring, so you can use different text specific to credentials alerts here if you prefer.

Note that delayed remediations for Credentials Monitoring have identical behavior as described in the last two paragraphs of the Password Monitoring section above.

This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied.

Compromised Password Screening Settings:

• Reject common passwords found in cracking dictionaries Enzoic’s database contains two types of passwords: those that have been exposed in data breaches and those that have been recovered in the dictionaries that hackers use to crack passwords. Disable this option if you’d prefer to only check your user passwords against those exposed in data breaches.

• Use fuzzy password matching Fuzzy password matching ignores case and performs common “leet speek” substitutions as part of the password screening process. For example, if the candidate password is “Georgie”, with this setting enabled variants like “georgie”, “g30rg13”, “G30RG13”, etc. would be checked as well. It is recommended to enable this setting.

• Screen root passwords Users will often add numbers and/or symbols at the beginning or end of their password in an attempt to reuse the same root password. This can be problematic if a hacker learns the root password and can make some rudimentary guesses as to the pattern. For example, a user might change their password from “Password123!” to “Password124!” during a required password change. Enabling this option will instruct Enzoic to attempt to identify such root passwords and check them for compromise as well.

Additional Password Policies

• Reject passwords without at least one lowercase character

• Reject passwords without at least one uppercase character

• Reject passwords without at least one number

• Reject passwords without at least one symbol

• Reject passwords containing user’s first or last name Enabling will reject passwords containing the user’s first or last name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed.

• Reject passwords containing user’s login name Enabling will reject passwords containing the user’s Windows login name. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed.

• Reject passwords containing user’s email address Enabling will reject passwords containing the user’s corporate email address. If Fuzzy Password Matching is enabled, “leet speek” variants will also be disallowed.

• Reject passwords containing repeating characters Enabling will reject passwords containing a repeating character that appears more than the threshold defined with the setting.

• Password Similarity Blocking Enabling will reject passwords that are too similar to the user’s existing password. You can define a Minimum Required Distance which is the minimum number of differences the new password must have from the current one. This distance is defined as the number of single character additions, substitutions or deletions that would be required to transform the current password to the new one. For example, if the original password was “Flatirons2018!” and the new password was “Flatirons!2019$”, the distance would be 3 (insert ‘!’, substitute ‘9’ for ‘8’, substitute ‘$’ for ‘!’). “Normalize Password First” performs this check with case insensitivity and uses common “leet speek” substitutions prior to checking. Note that either User Password Monitoring or User Credentials Monitoring must be enabled for Password Similarity Blocking to function.

• Reject passwords less than a minimum length

• Reject passwords more than a maximum length