Configuring settings via Group Policy Object Editor

The use of Microsoft Group Policy or Group Policy Objects (GPO) enables the SafeNet administrator to centrally manage the agent configuration for users and computers in an Active Directory environment. It allows to configure many important policy settings to provide flexibility and support extensive configuration information.

The policy settings of the SafeNet Agent for Epic are stored in a Windows Administrative Template (ADMX) file. The settings can be edited using Windows tools, and can be propagated to the entire domain, or be applied to the local computer and domain controllers only.

To configure settings, perform the following steps:

1. Add ADMX file to Group Policy Object (GPO) Editor
2. Configure ADMX Settings using GPO Editor
3. Deploy the Certificate via GPO

Prerequisites

• Microsoft .NET Framework 4.6

Adding ADMX file to Group Policy Object (GPO) Editor

To add ADMX file of the SafeNet Agent for Epic to the GPO Editor, perform the following steps:

1. Copy the ADMX file (SafeNetEpic.admx) included in the downloaded agent software package to the following location:

   • For servers: C:\Windows\PolicyDefinitions
   • For client computers: %Systemroot%\PolicyDefinitions

2. Copy the appropriate ADML language file (SafeNetEpic.adml) to a language folder under the \PolicyDefinitions folders.

   For example: In Windows Server 2019, the English language file provided should be written to: C:\Windows\PolicyDefinitions\en-US

3. Restart GPO Editor.

Configuring ADMX settings using GPO Editor

Once the ADMX file is added, open the template to configure the settings. To open the template and edit the settings:

1. From the Windows taskbar, select Start > All Programs > Accessories > Run.

2. In the Run window, enter gpmc.msc, and click OK. The Group Policy Management window is displayed.

3. Complete one of the following actions:

   • To propagate the settings to all clients in the domain, right-click Default Domain Policy under the domain node.

     

   • To apply the settings to the local machine and any other domain controllers in this domain, under the Domain Controllers node, right-click Default Domain Controllers Policy.

4. From the dropdown menu, select Edit. The Group Policy Management Editor window is displayed.

5. In the left pane, navigate to Computer Configuration > Administrative Templates > SafeNet Epic > Safenet EPIC.

   

   The SafeNet Agent for Epic settings are displayed in the right pane.

6. For performing GPO push:

   • On 32-bit clients: Configure the settings corresponding to SOFTWARE\Thales\Epic and ensure the settings related to 64-bit are set to Not Configured.

     

   • On 64-bit clients: Configure the settings corresponding to SOFTWARE\Wow6432Node\Thales\Epic and ensure the settings related to 32-bit are set to Not Configured.

     

7. Double-click the setting to be edited.

8. Select one of the following, and click OK.

   • Not Configured
   • Enabled (Enable the settings which you want to deploy, if not enabled with default value or user-defined value)
   • Disabled

Registry settings

The following table lists the details of the registry settings:

Deploying the certificate via GPO

Following are the sample ways for deploying the certificate via GPO. You can use your own certificate deployment workflow.

Certificate guidelines:

1. Ensure that the certificate must have a private key.
2. For improved security, the certificate should be deployed with non-exportable private key.
3. In case of local machine certificate, the Epic users should have read access to the private key.

GPO deployment of certificate to a trusted store

To deploy the certificate to a trusted store perform the following steps:

1. From the Windows taskbar, select Start > All Programs > Accessories > Run.

2. In the Run window, enter gpmc.msc, and click OK. The Group Policy Management window is displayed.

3. Right-click Default Domain Policy under the domain node, and click Edit.

   Note

   Ensure that the GPO is associated with a domain, site, or an organizational unit (OU) where the appropriate user and computer accounts resides.

   The Group Policy Management Editor window is displayed.

   

4. In the left pane, navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies, right-click Trusted Root Certification Authorities, and then click Import.

   

5. On the Welcome to the Certificate Import Wizard window, click Next.

   

6. On the File to Import window, click Browse to select the path of certificate file that you have placed in the shared location (for example, \\fs1\c$\fs1.pfx), and then click Next.

   

7. On the Certificate Store window, click Place all certificates in the following store, and then click Next.

   

8. On the Completing the Certificate Import Wizard window, verify that the information you provided is accurate, and then click Finish.

   

9. On the client machine, open the command prompt and run gpupdate /force.

Sample script for deploying the certificate to a personal store

Below is the sample script to deploy the certificate to a personal store of local machine with read access on private key:

param(
    [string]$userorGroupName="domain\username", //username or group name
    [string]$permission="read", //Permission to be given on Private key of the certificate
    [string]$certStoreLocation="\LocalMachine\My", //Certificate store location
    [string]$certThumbprint="AF66D91205D80BD547EADF5C1",
    [string]$pfxFilePath="C:\Desktop\share\Cert.pfx", //Expected that the file has been pushed to the machine
    [string]$pfxPassword="****" //Certificate's password
)

try {
    # Convert pfx password to secure string
    $password = ConvertTo-SecureString -string $pfxPassword -Force -AsPlainText

    # import pfx certificate to a certificate store
    Import-PfxCertificate -Password $password -FilePath $pfxFilePath -CertStoreLocation Cert:$certStoreLocation

    # Check if certificate has been successfully installed
    $certificateIsInstalled = Get-ChildItem cert:$certStoreLocation | Where thumbprint -eq $certThumbprint

    # Provide read access to a specific user on the installed certificate only
    if ($certificateIsInstalled -eq $null) {
        $message = "Certificate with thumbprint: " + $certThumbprint + " does not exist at " + $certStoreLocation
        Write-Host $message -ForegroundColor Red
        exit 1;
    } else {
        $rule = new-object security.accesscontrol.filesystemaccessrule $userorGroupName, $permission, allow
        $root = "c:\programdata\microsoft\crypto\rsa\machinekeys"
        $l = ls Cert:$certStoreLocation
        $l = $l | ? {$_.thumbprint -like $certThumbprint}
        $l | % {
            $keyname = $_.privatekey.cspkeycontainerinfo.uniquekeycontainername
            $p = [io.path]::combine($root, $keyname)
            if ([io.file]::exists($p)) {
                $acl = get-acl -path $p
                $acl.addaccessrule($rule)
                # echo $p
                set-acl $p $acl
            }
        }
    }
} catch {
    // put your exception here
}