Documentation for Product Version:
Please ensure you’ve reviewed the information on the Installation Prerequisites page prior to proceeding.
Links to download the most current version (Domain Controllers must all run the same version):
https://cdn.enzoic.com/files/EnzoicForAD.msi (MD5: 4ee01d1346c0a81be43b17f291021ae8)
https://cdn.enzoic.com/files/EnzoicForADClient.msi (MD5: b8815b7c89dbe5b3636deb5d7ce8eb54)
Read the current release notes.
Enzoic for Active Directory needs to be installed on every writable domain controller in the target domain – it is not necessary to install it on read only domain controllers. Note that Enzoic for Active Directory stores its configuration settings in Active Directory, so once it is configured on one domain controller, the configuration settings will replicate to all the domain controllers in the domain.
Enzoic for Active Directory runs at the domain level and does not support interacting with multiple domains. Its configuration and state are all stored at the domain level. If you have an environment with a multi-domain forest or parent-child domain relationships, Enzoic for Active Directory must be installed and managed separately on each domain in your environment. After installing Enzoic for Active Directory on the first DC in each domain, you will need to run the console application as a domain admin on that domain and go through first time configuration.
Run the installer, and then reboot the domain controller when prompted. Future upgrades will not generally require a reboot, but the initial install does.
Enzoic for Active Directory needs to run on each domain controller; however, it only needs to be configured once. All configuration settings (with the exception of the optional proxy server settings) are stored in Active Directory and automatically shared with all instances of that domain.
After the initial reboot, the Setup Wizard will walk you through the configuration process with the following steps. All settings can be modified through the console after initial set-up:
1. Network Settings
2. License
3. Monitored Entities
4. One-Click NIST Compliance
5. Custom Dictionary
6. Password Change Screening
7. User Password Monitoring
8. User Credentials Monitoring
9. Password Policies
10. Administrative Notifications
11. Test Settings
Adjust the API timeout duration. This controls how long a user password change will be held waiting for a response from the Enzoic API. If the timeout is reached, the password change will be allowed to go through without checking the user password for compromise. The compromise status will be detected subsequently if Continuous Password Protection is enabled. Although it is completely dependent on your Internet connection, typical response times for the Enzoic API from most locations are less than 500 milliseconds.
OPTIONAL: Specify an HTTP proxy server to use if your DC does not have direct Internet access. This setting will need to be configured separately on each Domain Controller.
Enter the Enzoic License Key provided for your account.
You can register to obtain a free key
Specify which Active Directory accounts to protect. You can select any combination of individual users, groups, or containers/OUs.
For best performance with large domains, it is highly recommended to not use recursive groups and to enable the “Disable Recursive Membership Checks” setting. This will ensure your users have the lowest possible latency during password changes.
Choose if you’d like to accept the default settings recommended for NIST 800-63b compliance:
If you choose NIST 800-63b compliance mode, these settings will be automatically applied and you will get an overall status on the Enzoic Console dashboard indicating whether your current settings in compliance.
If you’re unfamiliar with the new NIST 800-63b standard, a quick rundown is here and the full standard can be found here.
If you choose NIST 800-63b compliance mode, you should add words specific to your business and office locations. Add product name(s), your business name(s), names of cities your offices are in, local sports teams, etc. These will be added to the local dictionary and used to prevent passwords containing these terms. Make sure not to include words that are too short or generic, as this will prevent any passwords containing these strings from being used.
Select whether you want Enzoic to screen user password changes. When enabled, users who are in one of the monitored groups or OU’s will have their new passwords checked whenever they are changed. Passwords that are either present on Enzoic’s compromised password list or don’t meet any of the other password complexity policies you have selected will be rejected and the user will be required to enter a different password.
You may want to disable this option if you’d prefer for Enzoic to do offline checks of user passwords and/or credentials and not interactively check passwords during change. It is highly recommended that you leave this setting enabled however.
The “Screen password resets performed by administrators” option controls whether administrators are exempt from this check when manually resetting a user’s password for them via Active Directory administrative tools.
User Password Monitoring checks once every 24 hours to determine if any monitored users’ passwords have become compromised. The “Action to Take” dropdown allows you to select remediation actions to use when such a compromised password is detected. The following remediation actions are available:
Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise.
If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred.
Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email.
Lastly, you can select the Delegate Server used to run User Password Monitoring scans. This is the DC in your organization which will do the work of checking user passwords for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
Note that this page may be omitted if your license isn’t enabled for User Credentials Monitoring.
When enabled, User Credentials Monitoring (if available for your license level) checks once every 24 hours to determine if any monitored users’ credentials have become compromised. This is different from User Password Monitoring in that the exact email/password combination for the user is checked for compromise, rather than just the password. Since a compromise of this nature is much riskier, you may wish to select more stringent remediation options when this occurs.
The “Action to Take” dropdown allows you to select remediation actions to use when compromised credentials are detected for a user. The following remediation actions are available:
Regardless of the remediation setting, administrators on the notify list (configured in a later step) will always receive an email notification of a compromise.
If the “Notify affected users” setting on this page is selected, and an email address is available for the user in Active Directory, the affected user will also be notified by email. If the “Action to Take” is set to one of the delayed remediation actions, the user will be notified that if they do not change their password within the remediation delay period, that action will take affect. For an immediate remediation, users will simply be notified that the selected remediation has occurred.
Clicking “Customize Email” gives you have the ability to customize the alert emails sent to users. You can add your company name, corporate logo and customize the Intro and Footer text in the email. Note that these customization settings are distinct from those used for Password Monitoring, so you can use different text specific to this alert type if you prefer.
Lastly, you can select the Delegate Server used to run User Credentials Monitoring scans. This is the DC in your organization which will do the work of checking user credentials for compromise. This occurs in an evenly spaced out manner over the course of the day and is generally a light workload on the server, but it is recommended to choose a lightly loaded or more powerful DC for this role to avoid introducing any potential performance problems.
This page contains settings defining the specifics of how Enzoic will handle compromised password screening (i.e. inclusion of cracking dictionaries, fuzzy matching, etc.) and additional password complexity policies that can optionally be applied.
Include one or more email addresses to be notified for administrative events. These events include:
An optional Periodic Summary report is also available that can be sent to the administrators in the list, if selected here. This report can be sent Daily, Weekly or Monthly.
The Test Page allows you to test your settings are working as expected and that the Enzoic API Servers are reachable from your environment.
Entering a username here (either NT4 style or UPN) and a test password allows you to validate that:
A sample compromised password: uGetL0ckedOut!
If you receive an error indicating there is a problem reaching the Enzoic servers, please review the Troubleshooting section.
After you have finished the Setup Wizard, you will be placed on the Enzoic Console Dashboard. You will receive a prompt asking if you’d like to run an initial scan of your domain for users with compromised passwords. If you are familiar with the Enzoic AD Lite product, this is essentially the same scan.
Proceeding will scan all user passwords in your Active Directory domain to see if the exact password is present in Enzoic’s database of bad passwords (note this scan can take some time for very large domains). At the end of the scan, you will see a dialog with a report showing which users had weak or compromised passwords. From the report, you can select users to perform remediations such as disabling their account or forcing a password change on next login. You may also export the results to a CSV for reference.
Completing the setup process above will get you started with a single default monitoring policy and some initial settings. You can always tweak the settings from the Console Settings or Monitoring Policies area.