Use the Guest Access Privileges tab to select the Guest access method to apply to connecting Guests.
Select a method in the Guest Access Method list:
Grant all Guests default access privileges
|
This selection means that all Guests share the same privileges and use the same password to log on to the Host.
When a Guest connects, the Host requests a password. If the Guest returns the password set up for the default user, the Host grants the Guest the privileges set up for the default security role.
In the left pane, select Default Security Role to display the access privileges of this security role, i.e. what Guests should be allowed to do when connecting to the Host, in the right pane.
The Confirm access section in the right pane specifies whether and when access to the Host computer needs confirmation.
Note
For practical reasons, the Netop message and Get inventory functions have been exempted from Confirm access security, as these are often used when there is no user present on the Host side.
Select Default User in the left pane to set password and call back options. In the right pane, specify a password of max. 16 characters to enable shared password authentication.
To disable shared password authentication and request no password from a connecting Guest, clear both password fields. This, however, leaves the Host without Guest access authentication, and any Guest can then connect to the Host. Unless suppressed, a security warning is displayed when the Host starts communicating.
The Call back section below the Password section specifies whether or not to use call back.
Option
|
Description
|
No call back
|
Do not apply call back.
|
Call back to
|
Specify a telephone number or an IP address to make the Host disconnect and reconnect to the specified telephone number or IP address, if a Guest connects by a communication profile that uses a point-to-point or network point-to-point communication device.
Call back to a specified telephone number or IP address will enable connections only from a Guest on a computer with this telephone number or IP address.
|
Roving call back
|
Select this option to request a call back telephone number or IP address from a Guest that connects by a communication profile that uses a point-to-point or network point-to-point communication device.
When the Host receives this information, it will disconnect and reconnect to the specified telephone number or IP address.
Roving call back is typically used to make connection costs payable by the Host organization, e.g. when a traveling employee connects to the home computer.
|
|
|
Grant each Guest individual access privileges using Netop authentication
|
This selection means that each Guest has its own privileges and password to log on to the Host.
When a Guest connects, the Host requests the Netop credentials, i.e. ID and password, defined for that specific Guest. When the Guest returns the required information, the Host grants the Guest the privileges set up for the specific Guest.
Each security role specifies what is allowed to the Guest and the selected confirm access option. Each Guest profile specifies Guest logon credentials and the selected call back option.
Initially, the left pane contains the security role folders Full access, View only, Inventory only and Remote Management only. You can add a security role by clicking the Add security role button and defining the new security role by clearing check boxes in the right pane. Select an option in the Confirm access section to specify whether and when access to the Host computer needs confirmation.
You can add Guests to a security role by selecting it and clicking the Add Guest button. In the displayed Guest Profile dialog box, specify Guest name, password and call back option. See Guest Profile.
Select a Guest profile element in the left pane to display its Password section and Call back section to the right.
|
|
Grant each Guest individual access privileges using Windows Security Management
|
This selection means that each Guest has its own privileges and logs on to the Host by its Windows logon user credentials.
When a Guest connects, the Host requests the Windows user name, password and domain. If a match is found in Windows Security Management, the Host grants the Guest the privileges of the security role assigned to the Windows account object.
A Guest user who is assigned different security roles individually and as a member of groups is allowed what is allowed by any of the applicable security roles, i.e. the sum of privileges of the applicable security roles.
Each security role specifies what is allowed to the Guest and the selected confirm access option.
Initially, the left pane contains the security role folders Full access, View only, Inventory only and Remote Management only. Select a security role folder to display the privileges in the right pane. You can add a security role by clicking the Add security role button and defining the new security role by clearing check boxes in the right pane. Select an option in the Confirm access section to specify whether and when access to the Host computer needs confirmation.
You can add a user or group to a security role by selecting it and clicking the Add User or Add Group button. In the displayed Select Users or Select Groups dialog box, specify the users or groups you want to add.
Select a Windows user or group element to display its Domain section, RAS section and Call back section to the right.
The Domain section displays the domain of the selected Windows user or group.
The RAS section is only included if the Host computer runs on a Windows NT, 2000, XP, 2003, 2008, Vista or 7 operating system. Select the Get call back information from Windows NT Remote Access Service (RAS) check box to use call back information stored in Windows NT Remote Access Service.
The Call back section is only displayed if the check box in the RAS section is not selected.
Specify whether or not to use call back.
Option
|
Description
|
No call back
|
Do not apply call back.
|
Call back to
|
Specify a telephone number or an IP address to make the Host disconnect and reconnect to the specified telephone number or IP address, if a Guest connects by a communication profile that uses a point-to-point or network point-to-point communication device.
Call back to a specified telephone number or IP address will enable connections only from a Guest on a computer with this telephone number or IP address.
|
Roving call back
|
Select this option to request a call back telephone number or IP address from a Guest that connects by a communication profile that uses a point-to-point or network point-to-point communication device.
When the Host receives this information, it will disconnect and reconnect to the specified telephone number or IP address.
Roving call back is typically used to make connection costs payable by the Host organization, e.g. when a traveling employee connects to the home computer.
|
The Windows User Manager button is included only if the Host computer runs on a Windows NT, 2000, XP, 2003, 2008, Vista or 7 operating system. Click this button to display the Windows user manager window according to the administrator rights of the user logged on to Windows on the Host computer to manage users and groups.
|
|
Grant each Guest individual access privileges using Directory services
|
This selection means that each Guest has is own privileges and logs on to the Host by directory services user credentials.
When a Guest connects, the Host requests the directory service user name, password and directory server for that specific Guest. If a match is found on the directory server, the Host grants the Guest the privileges of the security role assigned to the directory services account element.
A Guest user who is assigned different security roles individually and as a member of groups is allowed what is allowed by any of the applicable security roles, i.e. the sum of privileges of the applicable security roles.
Each security role specifies what is allowed to the Guest and the selected confirm access option.
Initially, the left pane contains the security role folders Full access, View only, Inventory only and Remote Management only. Select a security role folder to display the privileges in the right pane. You can add a security role by clicking the Add security role button and defining the new security role by clearing check boxes in the right pane. Select an option in the Confirm access section to specify whether and when access to the Host computer needs confirmation.
You can add a user or group to a security role by selecting it and clicking the Add User or Add Group button. In the displayed Select Directory Services Users or Select Directory Services Groups dialog box, specify the users or groups you want to add.
Select a directory services user or group element to display its Directory service section and Call back section to the right.
The Directory Service section displays the directory service name and the selected directory services user or group element distinguished name (dn).
Specify whether or not to use call back:
Option
|
Description
|
No call back
|
Do not apply call back.
|
Call back to
|
Specify a telephone number or an IP address to make the Host disconnect and reconnect to the specified telephone number or IP address, if a Guest connects by a communication profile that uses a point-to-point or network point-to-point communication device.
Call back to a specified telephone number or IP address will enable connections only from a Guest on a computer with this telephone number or IP address.
|
Roving call back
|
Select this option to request a call back telephone number or IP address from a Guest that connects by a communication profile that uses a point-to-point or network point-to-point communication device.
When the Host receives this information, it will disconnect and reconnect to the specified telephone number or IP address.
Roving call back is typically used to make connection costs payable by the Host organization, e.g. when a traveling employee connects to the home computer.
|
|
|
Use Netop Security Server
|
This selection means that the Host will use Netop Security Server to authenticate each connecting Guest and assign a security role to it.
When a Guest connects, the Host requests logon credentials according to Netop Security Management preferences. For further information about Netop Security Management, see the Administrator's Guide.
The Host forwards returned credentials to Netop Security Server for validation and compilation of the security role that is to be assigned to the Guest according to the security data stored in the security database. The Host applies the resulting security role to the Guest.
In the Group ID field specify the 32 digit hexadecimal Netop Security Server group ID identifying the Netop Security Server that the Host is to use.
You can copy the Netop Security Server group ID from Netop Security Manager. See the Administrator's Guide, Security Server Group Name.
|
|
|
Use the Guest Policy tab to specify Guest access security policies. The policy functions determine how the Host behaves before, during and after the remote control session.
Password
Option
|
Description
|
Maximum invalid password attempts
|
Specify a number in the range 0 - 9 for the number of logon attempts that should be allowed to a Guest before the action selected in the drop-down list below will be executed.
|
Action if maximum attempts are exceeded
|
In the drop-down list, select what should happen if maximum password attempts are exceeded:
Disconnect: Disconnect the Guest.
Disable Host: Make the Host reject any connection attempt.
Restart Windows: Restart Windows on the Host computer, which - depending on the Host setup - may load and start the Host and make it available for connection.
|
Disconnect
Option
|
Description
|
Action after disconnect
|
In the drop-down list, select what should happen after disconnect:
None: No action.
Lock computer: Lock the Host computer. The Windows Computer Locked window is displayed. The Host will remain running and available for connection.
Log off Windows: Log off the Host computer user from Windows. The Welcome to Windows window is displayed. The Host will remain running and available for connection.
Restart Windows: Restart Windows on the Host computer, which - depending on the Host setup - may load and start the Host and make it available for connection.
|
System-wide disconnect hotkey
|
Select any of the first four check boxes and optionally specify a character in the last check box to compose a keystroke combination that will disconnect all connected Guests whether the Host window is active or not.
|
File Transfer
Select the Disable file transfer before local logon check box to disable file transfer if no user is logged on to the Host computer.
Record Sessions
Option
|
Description
|
Enable
|
Select this check box to enable Host recording of remote control sessions.
If you enable the Record Sessions function, you will be able to document any unauthorized procedures that a Guest might carry out on the Host.
|
Folder
|
Specify the path of the directory in which session recording files should be saved.
Click the Browse button to select a folder, the path of which will be specified in the field.
|
Disconnect if recording fails
|
Select this check box to disconnect if session recording fails.
Note
Session recording files will be named <Time stamp>-<Guest ID>-<Host ID>.dwr. You only can play back session recording files on a Guest.
|
Timeout
Option
|
Description
|
Confirm Access
|
Specify a number in the range 1 - 9999 to disconnect if the Host user has not confirmed Guest access within the specified number of seconds.
|
Authentication
|
Specify a number in the range 1 - 9999 to disconnect if Guest authentication has not completed within the specified number of seconds.
|
Inactivity
|
Specify a number in the range 1 - 9999 to disconnect if there has been no Guest keyboard or mouse activity within the specified number of seconds.
|
|
MAC/IP Address List
Select the Enable MAC/IP address check check box to limit the network addresses from which a Guest can connect to the addresses specified in the pane.
Click the Add button to specify MAC/IP addresses.
MAC addresses will apply if communicating by NetBIOS or IPX. IP addresses will apply if communicating by TCP/IP or TCP/IP (TCP).
|
The communication between Netop modules is protected by encrypting transmitted data.
One encryption type is used by version 6.5- Netop Remote Control modules. A range of encryption types is available on version 7.0+ Netop Remote Control modules.
Communicating Netop modules will automatically negotiate to encrypt communication by an encryption type that is enabled on both modules. Netop modules on which no common encryption type is enabled cannot communicate.
Select the check boxes next to the various encryption types to enable them.
To see encryption details about the individual encryption types, select an encryption type and click the Show Details button.
|
Use the Smart Card tab to specify Smart Card logon options to use Smart Card for authentication with Windows Security Management or Directory Services.
Windows Security Management
If you have selected the Guest access method Grant each Guest individual access privileges using Windows Security Management on the Guest Access Privileges tab, select an option in this section.
Option
|
Description
|
Never log on with Smart Card
|
Enable only credentials logon.
|
Always log on with Smart Card
|
Enable only Smart Card logon.
|
Allow both logon with Smart Card and credentials (name, password and domain)
|
Enable both credentials and Smart Card logon.
|
Directory Services
If you have selected the Guest access method Grant each Guest individual access privileges using Directory services on the Guest Access Privileges tab, select an option in this section.
Option
|
Description
|
Never log on with Smart Card
|
Enable only credentials logon.
|
Always log on with Smart Card
|
Enable only Smart Card logon.
|
Allow both logon with Smart Card and credentials (name, password and server)
|
Enable both credentials and Smart Card logon.
|
Subject Field
|
Retrieve the user identification from the Subject field of the Smart Card certificate.
|
Subject Alternative Name Field (must be a User Principal Name (UPN))
|
Retrieve the user identification from the Subject Alternative Name field of the Smart Card certificate.
|
The Certificate Field matches this Directory Services Attribute
|
Specify the directory services attribute compatible with the Smart Card certificate field contents. This is necessary only if different from a user object distinguished name.
For Directory Services Smart Card logon to succeed, the Host must be able to resolve the Smart Card certificate user identification into a Directory Services user identification. If the Smart Card certificate user identification and Directory Services user identifications are incompatible, Smart Card logon will fail.
To find available Smart Card certificate user identifications, insert the Smart Card and in Internet Explorer click the Internet Options command on the Tools menu to display the Internet Options dialog box.
On the Content tab, click Certificates to display the Certificates dialog box.
On the Personal tab, double-click the appropriate certificate record to display the Certificate dialog box. The Details tab displays the contents of available certificate fields including Subject and Subject Alternative Name.
|
See also
Program Options (Smart Card tab)
|
|