Sophos SafeGuard Disk Encryption, Sophos SafeGuard Easy
12 Recover a forgotten password
If the user has forgotten their password, there are two ways to recover it:
■ The user may recover it themselves using Local Self Help. This is the recommended method.
■ The help desk may recover it using a Challenge/Response procedure.
12.1 Recover a forgotten password using Local Self Help
1. On the endpoint computer in the Power-on Authentication, the user enters their user name.
The Recovery button becomes active.
2. The user clicks Recovery.
■
■
If only Local Self Help is activated for logon recovery on the endpoint computer, it is then started automatically.
If both Local Self Help and Challenge/Response are displayed for logon recovery, the user clicks Local Self Help.
3. In the following five dialogs, the user answers a defined number of questions randomly selected from the questions stored on the endpoint computer. After answering the last one, the user confirms the answers with OK.
4. In the next dialog, the user can view the password by pressing ENTER or SPACEBAR, or by clicking the blue display box.
The password is displayed for 5 seconds at the maximum. Afterwards, the startup process continues automatically. The user can hide the password immediately by pressing ENTER, or
SPACEBAR, or by clicking the blue display box again.
5. After reading the password, the user clicks OK.
The user is logged on at the Power-on Authentication and to Windows and can use the password for future logon.
12.2 Recover a forgotten password using Challenge/Response
Prerequisites:
The key recovery file created for each endpoint computer during installation of the Sophos
SafeGuard encryption software must be accessible to the help desk and the name of the file must be known. Challenge/Response must be enabled using a policy for the endpoint computer.
Note:
22
startup guide
We recommend that you primarily use Local Self Help to recover a forgotten password. Local Self
Help allows the user to have the current password displayed and to continue using it. This avoids the need to reset the password or to involve the help desk.
1. On the endpoint computer in the Power-on Authentication, the user enters their user name.
The Recovery button becomes active.
2. The user clicks Recovery.
■
■
If only Challenge/Response is activated for logon recovery, it is then started automatically.
If both Challenge/Response and Local Self Help are displayed for logon recovery, the user clicks Challenge/Response.
A dialog is displayed indicating the name of the key recovery file required.
3. The user clicks Next. A random challenge code is displayed.
4. The user contacts the help desk and provides the name of the required key recovery file as well as the challenge code to the help desk.
5. In SafeGuard Policy Editor, the help desk launches the Recovery Wizard.
6. The help desk selects recovery of type Sophos SafeGuard Client, confirms the key and the challenge code and selects the required recovery action Booting without user logon.
A response code in the form of an ASCII character string is generated and displayed.
7. The help desk provides the user with the response code, for example by phone or text message.
8. On the endpoint computer in the Challenge/Response Wizard, the user clicks Next to enter the response code provided. The computer is enabled to start through Power-on Authentication.
9. In the Windows logon dialog, the user does not know the correct password and needs to change password at Windows level. This requires further recovery actions outside the scope of Sophos
SafeGuard, using standard Windows means. We recommend that you use the following methods to reset the password at Windows level.
■
■
Using a service or administrator account available on the endpoint computer with the required Windows rights.
Using a Windows password reset disk on the endpoint computer.
10. The user enters the new password at Windows level that the help desk has provided. The user then changes this password immediately to a value only known to them.
11. Sophos SafeGuard detects that the newly chosen password does not match the current Sophos
SafeGuard password used in the POA. The user is therefore prompted to enter the old Sophos
SafeGuard password and, since the user has forgotten this password, needs to click Cancel.
12. In Sophos SafeGuard, a new certificate is needed in order to set a new password without providing the old one. The user has to confirm this procedure.
13. A new user certificate is created based on the newly chosen Windows password.
The user can log on to the computer and log on at the Power-on Authentication again with the new password and can use the password for future logon.
23
