Used to configure the proxy server to connect with STA via proxy. For example, Token Validation Proxy.

Note: If you enable this setting, you must configure Proxy Server.

Used to validate STA server certificate or Proxy server certificate (if used).

Used to exclude the local and domain administrators from strong authentication (OTP).

Used to exclude the Local Groups from the STA authentication. When any group is added to this setting through GPO, DomainUserOrGroup_In needs to be set to “*”.

If enabled, WLA will cache the Microsoft password on first successful user authentication until password expiration or change.

Note: This configuration is not applicable for domain administrators.

Used to enable the GrIDsure authentication link in the login screen.

NOTE: This setting is deprecated from v3.7.0 release.

Used to exclude the outgoing RDP (remote desktop) from STA authentication.

Used to exclude STA authentication while accessing network resources over Windows Explorer.

Used to include the local users to use strong authentication (OTP).

Note: If you define a group or multiple groups in this setting, you must also set DomainUserOrGroup_Ex with a value of ‘*’.

Specifies the maximum timeout value for authentication requests sent to STA.

Enable it to improve logon performance if domain groups are not nested inside local groups.

Used to configure the client log file path.

Used to configure the proxy server username that is used to authenticate the defined proxy server.

Note: Setting 'ProxyUser' assumes setting ‘ProxyServer’ and ‘Password’, and may also require setting 'UseProxyForSPS' (if applicable).

Allows to set a custom image in the logon screen for compatible credential providers. The customization is not compatible with the Windows V2 credential provider.

Note: The custom logo must be a bitmap (.bmp) of 110 x 110 pixels and must be available locally on the client.

Prevents the management console from displaying an Incompatible Filter message. This setting can only be added in the registry if a third-party credential provider is compatible with the agent and can be wrapped successfully.

For example, if SpecOps credential provider is installed on a client machine along with the agent, then the management console may display Incompatible Filter message. To exclude SpecOps Credential Filter, add its GUID to the CompatibleFilters list. To add multiple filters, use comma (,) for separation.

Augments the secured storage of a user’s cached Microsoft password. This is mostly relevant for shared machine scenarios and is effective only when Enable Microsoft Password Caching is selected in the SafeNet Windows Logon Agent Manager > Policy tab.

If it is set to 1, the password caching will not work in the following scenarios:

> Access to a network path/resource

> Outgoing RDP connections from a WLA protected machine

> Run as a different user to access applications, such as command prompt

For such cases, Microsoft password must be provided by the user. All other use cases supported for Microsoft password caching will function as expected. This setting will be applicable on next logon.