# SailPoint Desktop Password Reset Documentation > Desktop Password Reset Documentation # Documentation # Frequently Asked Questions This Frequently Asked Questions (FAQs) section provides answers to the most commonly asked questions for Desktop Password Reset. **Why should I download latest CEF sharp libraries?** SailPoint's Desktop Password Reset (DPR) leverages the Chromium Embedded Framework (CEF) to power its Restricted Browser functionality. The CEF project regularly releases patches and updates to address performance issues and mitigate security vulnerabilities. To ensure the highest level of security for your environment, SailPoint provides a built-in option to update the version of CEF used by DPR. SailPoint strongly recommends that you apply these updates as soon as they are released to protect against potential threats. **What are the steps to install latest CEF sharp libraries?** For information on installing the latest CEF sharp libraries, refer to [Managing Chromium Embedded Framework Updates](). **Which specific version should I install?** SailPoint recommends that you update DPR with the latest available version of CEF. This ensures access to the newest features, performance improvements, and security updates. For more detailed guidance, including version compatibility and update instructions, refer to [Desktop Password Reset Third-Party Framework Updates](). **Can we install CEF version which is older than current installed CEF version.** The Desktop Password Reset (DPR) application is bundled with the latest version of the Chromium Embedded Framework (CEF) available at the time of each release. While DPR is designed for forward compatibility and fully supports updates to newer CEF versions, it does not support downgrades to versions older than the one it was originally packaged with. You should only use the bundled CEF version or upgrade to newer releases as they are released. **Will the DPR stop working if I don't install the latest CEF version?** No, the DPR will continue to function normally. However, SailPoint recommends that you update the DPR with the latest CEF version for optimal performance and compatibility. **Can I skip intermediate versions and install the latest available CEF version directly?** Yes, you can skip intermediate versions and install the latest CEF version directly. **How does SailPoint ensure that newly downloaded CefSharp libraries are compatible with the current version of the Desktop Password Reset (DPR) tool?** SailPoint's Desktop Password Reset (DPR) tool has a built-in validation process. After new CefSharp (Chromium Embedded Framework) libraries are downloaded, DPR automatically performs a compatibility check against the current DPR version. If you receive an error during this process, it indicates that the compatibility check has failed. If this happens, contact SailPoint Support. # Desktop Password Reset Desktop Password Reset (DPR) allows end users to access any web-based password management solution to change their password, even if they have forgotten their password or are locked out of their computer. SailPoint strongly recommends using SailPoint's Password Management solution with this application, as it is specially designed to ensure the security of the system. When a user changes their password through DPR, it resets the user's password and updates all connected accounts on different managed systems. Users can access the DPR application by selecting the Forgot Password option from the login screen on their computer. Once they change their password, their account is unlocked, and they can log in normally. During installation and configuration, Desktop Password Reset (DPR) requires the URL of the SailPoint tenant. When a user selects the **Forgot Password** link on the Windows or macOS login screen, the DPR Restricted Browser application launches and accesses the configured SailPoint URL. From this point, the password reset process is driven by the SailPoint password reset workflow. In most cases, DPR does not directly access user passwords. The secure communication of the password over the network is handled by SailPoint. The only exception is when the **Off-Network Password Reset** feature is enabled during DPR installation or configuration. In this scenario, DPR accesses the password after a successful password reset. This guide describes how to install and configure the SailPoint Desktop Password Reset. > [!IMPORTANT] > > The SailPoint Desktop Password Reset (DPR) application is designed to work seamlessly with SailPoint. Although you can use DPR with other custom web applications and web pages, SailPoint only provides support for issues directly associated with the SailPoint platform. SailPoint is not responsible for any security or integration issues that may arise when DPR is used with third-party or custom web pages and solutions. ## Deployment Overview SailPoint Desktop Password Reset (DPR) must be deployed on each user's computer. In large organizations, the deployment process can involve many thousands of computers. Therefore, it is crucial to carefully plan the process for setting up installation files and installing the product on each computer. > [!NOTE] > > The specific steps may vary depending on the method used to distribute the product to the end-user computers. The basic steps for deploying Desktop Password Reset for each operating system are listed below. ### Deployment Overview for Windows The basic steps for deploying DPR on Windows are as follows: 1. Verify that the system meets the requirements for installing Desktop Password Reset (DPR). For more information, refer to [System Requirements for Windows](). 2. Ensure that the administrator has the required permissions to install and configure DPR. For more information, refer to [Administrator Permissions](). 3. Set up a directory containing the files necessary for installing DPR. For more information, refer to [Remote Installation on Windows](). 4. Obtain the public certificate of your SailPoint tenant. 5. Use the Setup.exe file to install DPR. For more information, refer to [Remote Installation on Windows](). > [!NOTE] > > Desktop Password Reset only supports 64-bit versions of Windows. ### Deployment Overview for macOS The basic steps for deploying DPR on macOS are as follows: 1. Verify that the system meets the requirements for installing Desktop Password Reset (DPR). For more information, refer to [System Requirements for macOS](). 2. Use the `DPRConfigurator.app` to deploy the configuration for Desktop Password Reset (DPR). For more information, refer to [Managing Desktop Password Reset on macOS](). # Installing SailPoint Desktop Password Reset Desktop Password Reset (DPR) can be installed on end-user computers using one of the following methods: - [Interactive Installation](<#interactive-installation>) - [Remote Installation](<#remote-installation>) > [!IMPORTANT] > > If an older version of Desktop Password Reset (DPR) is already installed on the system, you must uninstall it before running the installer for the current version of DPR. ## System Requirements The following are the software requirements for Desktop Password Reset: ### System Requirements for Windows #### Operating System - Microsoft Windows 11 - Microsoft Windows 10 #### Software Platform - Microsoft .NET Desktop Runtime 8.0.x, 9.0.x or 10.0.x ### System Requirements for macOS #### Operating Systems - macOS 14.6 (Sonoma) - macOS 15 (Sequoia) #### Processor - Apple Silicon-based chipset ## Downloading DPR > [!IMPORTANT] > > You are only entitled to download components for which you have an active license with SailPoint. The availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Please contact your Account Representative or CSM for more information. Download the latest version of Desktop Password Reset to your system. For information about the latest release and to get the download, visit the following resources: ### Downloading DPR for Windows Refer to [Desktop Password Reset for Windows Release Notes](). ### Downloading DPR for macOS Refer to [Desktop Password Reset for macOS Release Notes](). ## Administrator Permissions ### For Windows You must have Administrator permissions to install Desktop Password Reset and edit the Deploy Configurator. > [!NOTE] > > For silent installation, open the command prompt or Powershell with Administrative privileges by selecting **Run as an administrator** from the context menu in Windows. ## Interactive Installation Follow the steps below to interactively install Desktop Password Reset (DPR) on your system: ### Interactive Installation on Windows To install the Desktop Password Reset (DPR) for Windows, perform the following: 1. Extract **DesktopPwdReset\_x.x.x.zip** to a directory. 2. (Optional) To set a custom icon of the Desktop Password Reset tile on the Windows Logon screen, save an image file to the provided location below. The file name of the customized image must be **PMIcon.bmp**. It needs to be a bitmap (.bmp) file. - (For 64-bit): `pathOfDesktopPasswordReset\x64\` 3. Depending on the operating system navigate to the following appropriate directory and run setup.exe: - (For 64-bit): `pathOfDesktopPasswordReset\x64\setup.exe` Where `pathOfDesktopPasswordReset` is the path where **DesktopPwdReset\_x.x.x.zip** file was extracted to. 4. On the Welcome dialog box, select **Next** to continue the installation. 5. On the License Agreement dialog box, select **I Agree** and select **Next**. 6. Select the directory for the installation and select **Next**. 7. Enter the following configuration parameters on the Configuration Options dialog box and select **Next**: | Key Name | Description | Values | | --- | --- | --- | | URL | Specify the product-specific URL accessible from the Desktop Password Reset restricted browser.

Specific requirements for SailPoint are described in the **Values** column.

Ensure that this URL (host) is added as a Trusted Site through **Internet Properties \> Security TAB \> Trusted Sites \[Sites\]**.

**Note**: For better security posture, DPR supports accessing only HTTPS URLs. | `https:///passwordreset`

For example: `https://abc.identitynow.com/passwordreset`

This example refers to the Password Management Solution. | | Link Text on Logon Screen | Text for the link that appears on the Windows Logon screen. This link launches the Desktop Password Reset Restricted Browser. (Maximum length : 1024) | Forgot Password? | | Language Options | Specify the languages supported by the password management solution. The restricted browser sets the language to the browser depending on the user's selection, as long as the language is configured. | The value must be in following format:

`languageName, languageCode;`

where:

\- `languageName` can be the name of the language that needs to be displayed to the user in the Restricted Browser.
\- `languageCode` is the code of the language. Refer to [Available languages for Windows]() to get the code of different languages.

For example: `English(US), en-US;French(Canada), fr-CA;`

Separate the language name and language code with a comma (,). End each language setting with a semicolon (;).

Default value: `English(US),en-US;` | 8. (Optional) If required, select the following options on the Configuration dialog box: | Key Name | Description | Values | | --- | --- | --- | | Unblock AltGr Key | Indicates if AltGr Key is Unblocked. Possible values are `Y` and `N`. | `N` - AltGr key is blocked.

`Y` - AltGr key is unblocked.

Default value: `N` | 9. (Optional) Enable **Deploy Configuration Utility** if the configuration utility needs to be installed. The product has a built-in application called the **Configuration Utility** used to customize and configure the product settings. You can select to install this application along with the product. Alternatively, you can configure the product settings during installation itself or distribute the configurations remotely as described in Remote Installation section. Enable **Allow Off Corporate-Network Password Reset** to enable the off-corporate network password reset feature for SailPoint. This feature enables users off the corporate network to reset their password. 10. Select **Next** to proceed. The screen displays the Confirm Installation page. Select **Next**. 11. In the Installation Complete dialog, select **Close** to exit. 12. If the Certificate Authority (CA) for the certificate securing your SailPoint instance is not already trusted, follow the process outlined below: 1. Obtain the SSL certificate of your SailPoint instance in the desired format. This can be done in the following ways: - Select the Secure button (a padlock) in an address bar. - Use the `s_client` OpenSSL command. For example: ```text echo | openssl s_client -servername example.sailpoint.com -connect example.sailpoint.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /Documents/certificate.crt ``` 2. Import the certificate into the Windows trust store (Trusted Root Cert authority). ### Interactive Installation on macOS Desktop Password Reset (DPR) is distributed as an installer package. You can install the product interactively with administrator privileges by following these steps: 1. Double-click the installer package file. 2. Follow the on-screen instructions provided by the installation wizard. ## Remote Installation Remote installation enables you to distribute and install the Desktop Password Reset (DPR) silently on end-user computers. Follow the steps below to remotely install DPR on your system: ### Remote Installation on Windows To install DPR remotely on Windows computers, follow these steps: 1. [Prepare for Remote Installation](<#prepare-for-remote-installation>) 2. [Install DPR using the Remote Installation Method](<#install-dpr-using-the-remote-installation-method>) > [!NOTE] > > For silent installation, open the command prompt or Powershell with Administrative privileges by selecting **Run as an administrator** from the context menu in Windows. #### Prepare for Remote Installation Pre-configure Desktop Password Reset before distributing it for remote installation. 1. Install Desktop Password Reset on one system as described in the [Interactive Installation](<#interactive-installation>) task. Choose the option to **Deploy Configuration Utility** during this setup. For example purpose, this system is named **master system**. Configurations done on this setup (except for the configurations mentioned in the below table) are duplicated on the remote systems. 2. Extract **DesktopPwdReset\_x.x.x.zip** to a directory. 3. Open the command prompt as an Administrator. 4. In the command prompt, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. 5. Run the following command and press Enter. It generates the **dprconfig.export**, **dprkey.export**, **browserruntime.zip**, and **bouncycastleruntime.zip** files in that location. ```text Configurator.exe -exportkey -exportconfig ``` 6. Copy these files to the following directory, depending on the operating system: - (For 64-bit) - `pathOfDesktopPasswordReset\x64\` Where `pathOfDesktopPasswordReset` is the path where the **DesktopPwdReset\_x.x.x.zip** file was extracted earlier. 7. Obtain the SSL certificate of your SailPoint instance in the desired format. It can be done in various ways such as: - Select the **Secure** button (a padlock) in an address bar. - Use the `s_client` OpenSSL command. For example: ```text echo | openssl s_client -servername example.sailpoint.com -connect example.sailpoint.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /Documents/certificate.crt ``` 8. Copy the required SSL certificate to the pathOfDesktopPasswordReset directory. 9. (Optional) To set a custom icon of the Desktop Password Reset tile on the Windows Logon screen, save an image file to the provided location below. The file name of the customized image must be "PMIcon.bmp". It needs to be a bitmap (.bmp) file. - (For 64-bit) - `pathOfDesktopPasswordReset\x64\` #### Install DPR Using the Remote Installation Method To remotely install Desktop Password Reset: 1. Copy the directory created earlier to the remote system. 2. On the remote machine, open the command prompt as an Administrator. 3. Depending on the operating system navigate to the following directory: - (For 64-bit) - `pathOfDesktopPasswordReset\x64\` Replace `pathOfDesktopPasswordReset` with the path from where the directory was copied earlier. 4. Enter the following command with the appropriate parameters: ```text pathOfDesktopPasswordReset/setup.exe -afterreboot /quiet ``` For example: ```text pathOfDesktopPasswordReset/setup.exe -afterreboot PRECONFIG=1 /quiet ``` > **Note** > > To suppress pop-up windows during remote installation failures, use the following command: > > ```text > pathOfDesktopPasswordReset/setup.bat -afterreboot PRECONFIG=1 /quiet > ``` 5. Run the following command to install the certificate. In the command, `certificateName` is the name of the certificate file. For example, SSLCertificate.cer: ```text InstallCert_Silent.bat certificateName ``` The following table describes available installation parameters: | Name | Description | | --- | --- | | TARGETDIR | Path of the installation directory.

Default: `"C:\Program Files"`

For example: `TARGETDIR="C:\Program Files"` | | DEPLOYCONFIGURATOR | Deploys the configurator on a target machine. SailPoint does not recommend that you deploy the configurator on a target machine if end users shouldn't make configuration change.

Default: It is not deployed.

For example: `DEPLOYCONFIGURATOR=1` | | PRECONFIG | Indicates if the Desktop Password Reset is preconfigured. Set this to 1 if the configurations and encryption key are going to be imported during this installation. Refer to [Preparing for Remote Installation](<#prepare-for-remote-installation>) for more details.

For example: `PRECONFIG=1` | | \-afterreboot | Run pre-requisites in silent mode.

For example: `-afterreboot` | | quiet | Run installer in silent mode.

For example: `/quiet` | ### Remote Installation on macOS Administrators can distribute the .pkg file to remote devices using any existing Mobile Device Management (MDM) solution. In addition to the .pkg file, administrators must also distribute the configuration file generated by the DPR Configurator app. For more information, refer to [Managing Desktop Password Reset on macOS](). #### MDM Profile Configuration To prevent users from seeing a system notification when Desktop Password Reset (DPR) is installed on macOS, you can deploy the following configuration profile settings using Jamf. > [!NOTE] > > **Screenshot** > > [![MDM configuration profile login item settings in Jamf]()]() 1. Go to **Computers \> Configuration Profiles**. 2. Select the configuration profile where you want to apply login item settings. 3. Go to **Options** tab and then, select **Manage Login Items**. 4. Within Manage Login Items, make sure to include **Manage Login Item rules** section. Define and apply your required login item rules to control what applications or services launch at login. # Managing Desktop Password Reset on macOS Desktop Password Reset (DPR) for macOS includes a simple built-in configuration utility called `DPRConfigurator.app` that facilitates configuration updates. To change the value of the configuration parameters for DPR, follow these steps: 1. Go to the master system or the system where the Configuration Utility is deployed. 2. Update the desired attributes and select **Save** to store your changes. 3. Ensure that the file name for deployment is `config.json`. ## Configuration Options The following options can be set using `DPRConfigurator.app`: | Name | Description | | --- | --- | | Password Reset URL | The URL of the identity provider that is opened in the restricted browser when a user clicks on the Desktop Password Reset icon on the login screen.

If using SailPoint as the identity provider, the password reset URL should be `[ISC_TENANT].identitynow.com/passwordreset`. | | Allowed Domains | Domain names, other than domain of the base URL, which should be allowed for navigation from the restricted browser. If not specified, only pages from the base URL domain are accessible.

\- If your Password Management solution is configured to use Duo for multi-factor authentication, you must add `duosecurity.com` as an Allowed Domain for DPR to work appropriately.
\- If you are using SailPoint as the identity provider, you must add the following mandatory domains as an Allowed Domain for DPR:
`[ISC_TENANT].identitynow.com`
`[ISC_TENANT].api.identitynow.com` | | Button Image | The image shown for the Desktop Password Reset icon on the login screen. | | Button Text | The text shown to the user next to the Desktop Password Reset icon on the login screen. | | Button Padding Right | The horizontal adjustment (in points) for the position of the Desktop Password Reset icon on the login screen. By default, the icon is shown in the bottom-right corner. | | Button Padding Bottom | The vertical adjustment (in points) for the position of the Desktop Password Reset icon on the login screen. By default, the icon is shown in the bottom-right corner. | | Update FileVault | When a user resets their account password using DPR, the FileVault password is also updated. This setting is enabled by default. | ## FileVault Support When Desktop Password Reset (DPR) is configured, it automatically updates the user's FileVault password whenever their account password is reset. This ensures that the FileVault password stays in sync with the user's account password, maintaining seamless access to their encrypted files and directories after a password change. ### Prerequisites For DPR to update the FileVault password during a user password reset, ensure the following conditions are met: > [!NOTE] > > **Screenshot** > > [![FileVault prerequisites]()]() 1. In the DPR configuration, ensure the **Update FileVault** option is enabled. This setting is enabled by default. 2. Configure a management account's credentials for DPR to use. For more information, refer to [Creating a Management Account](<#creating-a-management-account>). 3. Ensure **FileVault** is enabled on the user's device. 4. The user account performing the password reset must have a [Secure Token](). ### FileVault Management Account DPR requires a management account on each local device to automatically update the FileVault password when a user resets their account password. The credentials for this account must be stored in the system keychain. #### Creating a Management Account To minimize password rotations and avoid updating stored credentials in the system keychain, SailPoint recommends creating a dedicated management account for DPR. However, you can skip this step and share an existing suitable account's credentials with DPR. To create the `_sailpointdpr` management account, run the following script: ```text sudo ./create-management-account.sh new_password my_admin my_admin_password ``` Expected output: ```text 2025-05-08 12:38:47.431 sysadminctl[3236:49518] - Done! ``` This user is prevented from logging in and remains hidden from the login screen. However, the user is visible on the FileVault unlock screen. #### Sharing Credentials with DPR To store the management account's credentials in the system keychain and grant DPR access to the keychain item, run the following script: ```text sudo ./store-management-account-credentials.sh _sailpointdpr new_password ``` If you're using an existing management account, specify the correct username instead of `_sailpointdpr`. > [!NOTE] > > The same management account credentials can be used for every device. In this case, a user with root access on any device can access the DPR management account on all devices. #### Deleting the Management Account To delete the `_sailpointdpr` management account, run the following script: ```text sudo ./delete-management-account.sh ``` #### Verifying Your Setup While an end-to-end test will reveal configuration errors, you can also check that the requirements are met by following these steps: 1. Verify that FileVault is enabled: Run the following script: ```text fdesetup status ``` Expected output: ```text FileVault is On. ``` 2. Check that the management account: 1. Is an admin: Run the following script: ```text dscl . -read /Groups/admin GroupMembership ``` Expected output: ```text GroupMembership: root admin _mbsetupuser _sailpointdpr ``` 2. Has a secure token: Run the following script: ```text sysadminctl -secureTokenStatus _sailpointdpr ``` Expected output: ```text Secure token is ENABLED for user ``` 3. Is prevented from logging in: Run the following script: ```text dscl . -read /Users/_sailpointdpr UserShell ``` Expected output: ```text UserShell: /usr/bin/false ``` 3. Verify that the credentials are in the keychain: > **Note** > > Attempting to print the password fails due to limited access controls. Run the following script: ```text security find-generic-password -s "SailPoint DPR Management Account" ``` Expected output: ```text keychain: "/Library/Keychains/System.keychain" version: 256 class: "genp" attributes: 0x00000007 ="SailPoint DPR Management Account" ... ``` To see the access control, view the item through Keychain Access. > **Screenshot** > > [![Keychain Access control for the SailPoint DPR Management Account]()]() ## Exporting Configuration to Remote Systems To update the DPR configuration on all remote systems, perform the following steps: 1. Run the configuration application, set the desired configuration values, and save the configuration file to a known location. The name of the file must be `config.json`. 2. Copy the configuration file to all remote systems, using an existing solution such as a Mobile Device Management (MDM) product. The required location for the config file on the remote devices is `/Library/Application Support/SailPoint/DPR/config.json`. > [!NOTE] > > The access permissions set on the configuration file location ensure that only administrators can modify the file. Additionally, the contents of the configuration file are verified when the Desktop Password Reset (DPR) utility is launched. ## Enabling Logs By default, DPR writes log messages to the macOS unified system log, using the subsystem `com.sailpoint.dpr`. These logs can be viewed in one of two ways: - Using `console.app`, by searching for `subsystem:com.sailpoint.dpr` - Using the log command line as root. For example, `log show --predicate "subsystem == 'com.sailpoint.dpr'"` # Managing Desktop Password Reset on Windows This section provides details to effectively manage and configure DPR using the built-in configuration utility, and learn best practices for securely deploying and updating DPR settings on Windows. ## Managing Chromium Embedded Framework Updates Desktop Password Reset uses Chromium Embedded Framework (CEF) for Restricted Browser. CEF releases patches to address various issues and reported vulnerabilities. In an effort to ensure all DPR setups run with the latest version of CEF, SailPoint provides an option to update the CEF version. The latest release (as well as previous versions) of CEF run-time can be downloaded and installed on the master machine, then later distributed to all remote systems. For more information on distributing the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). > [!IMPORTANT] > > SailPoint recommends updating to the latest version of the Chromium Embedded Framework (CEF). For a version verified by SailPoint, refer to the [Desktop Password Reset - Third Party Framework Updates](). To update CEF dependencies: 1. Go to `\SailPoint Technologies\Desktop Password Reset` on the master system or the system where Configuration Utility is installed. 2. Run `configurator.exe` as an Administrator. 3. Select the **Advanced** tab. 4. Select **Download Latest \> Download** to download the latest available version of Browser Engine run-times. This downloads the latest version of CEF version from the [Microsoft NuGet]() site. 5. Select **Save** to install the downloaded engine run-times. This updates the CEF dependencies used by the DPR browser. > **Note** > > In case of compatibility issues with latest version of CEF, a specific version of CEF can be downloaded using the **Download Specific Version** option. Contact SailPoint Support for guidance on specific versions of CEF. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Desktop Password Reset Configurations Desktop Password Reset has a simple built-in configuration utility that facilitates configuration updates. If it is necessary to change the value of the configuration parameters for Desktop Password Reset, go to **master system** or the system where Configuration Utility is deployed. Update the desired attributes and select **Save** to store your changes. ### Distribute Updated Configurations to Remote Systems To update the configurations on all remote systems, perform the following: 1. On the **master system** or the system where Configuration Utility is installed, open command prompt as an Administrator. 2. In command prompt, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. 3. Run the following command and press Enter: ```text Configurator.exe -exportconfig -exportkey ``` This creates three files at that location: - `dprconfig.export` - `dprkey.export files` - `browserruntime.zip` 4. Copy the new files to the remote system at `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. 5. In command prompt, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. 6. Run the following command at the end users system: ```text PwdResetBrowser.exe -importconfig -importkey ``` 7. Delete all instances of the `dprconfig.export`, `dprkey.export`, `browserruntime.zip`, and `bouncycastleruntime.zip` files. ## Encrypting Configurations Encryption keys are used to encrypt the configurations before they are stored in the Windows registry of the respective system. To generate or regenerate these keys: 1. Go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset` on the master system or the system where Configuration Utility is installed. 2. Run configurator.exe as an Administrator. 3. Select the **Advanced** tab. 4. To generate or regenerate the encryption key, select **Generate/Regenerate Encryption Key**. 5. Select **Save** to save the settings. This regenerates the Encryption Key as well as re-encrypts currently stored configurations with the new key. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Custom ToolTip for Desktop Password Reset The Desktop Password Reset tile displays after selecting the **Sign-in options** link on the Logon screen. When users hover their cursor over the DPR tile, it displays a tooltip with more information. You can customize the message that displays in the tooltip. To configure the tooltip message: 1. Go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset` on the master system or the system where Configuration Utility is installed. 2. Run `configurator.exe` as an Administrator. 3. Select the **Basic** tab. 4. Update the value for the **Tool Tip Text on Tile** configuration. The maximum allowed length of the text is 45 characters. 5. Select **Save**. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Configure Allowed Domains This configuration lists domain names, other than domain of the base URL, which should be allowed for navigation from the Restricted Browser. The values must be separated by a semicolon (;). If not specified, only pages from the base URL domain are accessible from Restricted Browser. > [!NOTE] > > If your Password Management solution is configured to use Duo for multi-factor authentication, you are required to add `duosecurity.com` as an Allowed Domain for DPR to work appropriately. To modify value of this configuration, perform the following: 1. On the **master system** or the system where Configuration Utility is installed, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. Master system refers to the primary administrative system that is responsible for installing DPR and deploying it remotely to all other machines in the network using System Center Configuration Manager (SCCM). 2. Run `configurator.exe` as an Administrator. 3. Select the **Advanced** tab and update the value for Allowed Domains configuration. The value must be in the following format: ```text ; ``` For example, if the URL is set to `https://abc.sailpoint.com/passwordreset` and it is required to access web pages from a domain other than abc.sailpoint.com, the value of this attribute can be set to: ```text example1.com;example2.com ``` 4. Select **Save** to save the settings. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Enabling Logs By default, logs are not enabled for the Desktop Password Reset. To enable logs or change the traceability level for the Desktop Password Reset, modify the **Trace Level** option from configurator utility. To modify values in the Configurator Utility to enable logs, perform the following: 1. On the **master system** or the system where Configuration Utility is installed, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. Master system refers to the primary administrative system that is responsible for installing DPR and deploying it remotely to all other machines in the network using System Center Configuration Manager (SCCM). 2. Run configurator.exe as an Administrator. 3. Select the **Advanced** tab and set one of the following values for the Log Level: - **Off** - Disable logs - **Error** - Enable logging of Errors. - **Warning** - Enable logging of Warnings and Errors. - **Info** - Enable logging of errors ,Warnings and other detailed information helpful for troubleshooting. 4. Select **Save** to save the settings. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Enabling Wrapping for Third-Party Credential Providers There may be situations where multiple credential providers are required to compliment each other to produce the required functionality on a single logon tile. In such cases, one credential provider wraps other credential providers. SailPoint Desktop Password Reset Credential Provider provides an option to wrap other credential provider for achieving similar effect subject to compatibility of other credential providers. > [!NOTE] > > If you need to display the **Forgot Password** link on the logon tile of any credential provider other than Microsoft's default Password Provider, you must use this functionality. This assumes that the other credential provider supports the wrapping feature. The following section describes the procedure for enabling a wrapper for third-party credentials with the Windows registry by adding the obtained **WrapCPGuid** string value to the Desktop Password Reset. To find the global unique identifier (GUID) for the third-party credential provider, perform the following: 1. From the command prompt, enter the `regedit` command to open the Windows registry. 2. Locate the currently installed credential providers at the following location: ```text HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers. ``` 3. Copy the GUID key for the credential provider that must be wrapped, including the curly brackets. To enable wrapping for credential providers by adding the **WrapCPGuid** string value to the **Config** registry of Desktop Password Reset, perform the following: 1. Go to the following Windows registry location: ```text HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint Technologies\Desktop Password Reset\Config ``` 2. Add a new string value: **WrapCPGuid** 3. Enter values for the **WrapCPGuid** string value: `` The `` is the GUID key for the Credential Provider obtained earlier. > [!NOTE] > > The GUID Key for the Credential Provider must be enclosed with curly brackets. For example: `{}`. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Changing the Default Credential Provider By default, Desktop Password Reset is set as the default Credential Provider. To change the default Credential Provider, modify the **Use SailPoint as Default Credential Provider** option from the configuration utility. To change the default credential provider, perform the following: 1. On the **master system** or the system where Configuration Utility is installed, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`. 2. Run `configurator.exe` as an Administrator. 3. Select the **Advanced** tab and deselect the **Use SailPoint as Default Credential Provider** setting to remove SailPoint Credential Provider from Default. 4. Select **Save** to save the settings. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). ## Managing Bouncy Castle Cryptography Library > [!IMPORTANT] > > SailPoint recommends updating to the latest version of the Bouncy Castle library. For a version verified by SailPoint, refer to the [Desktop Password Reset Third-Party Framework Updates](). Desktop Password Reset (DPR) relies on the Bouncy Castle cryptography library to securely handle encrypted password data. Bouncy Castle is used to encrypt and decrypt critical sections of the credential cache. Updates are released periodically to improve cryptographic functionality and ensure compatibility with the latest security standards. To ensure the DPR setup uses the latest cryptographic standards, SailPoint provides an option to update the Bouncy Castle version. You can download the latest version or a specific version on the master machine and then distribute it to all remote systems. To update the Bouncy Castle dependencies, complete the following steps: 1. On the master system or the system where the Configuration Utility is installed, go to ```text pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset ``` 2. Run `configurator.exe` as an administrator. 3. Select the **Advanced** tab. 4. To download the latest available version of the Bouncy Castle dependency, select **Download Latest**, and then select **Download**. This downloads the latest Bouncy Castle Cryptography version from the [Microsoft NuGet site](). 5. Select **Save** to install the downloaded Bouncy Castle dependency run-time. This updates the Bouncy Castle dependencies used by DPR. > [!NOTE] > > If you encounter compatibility issues with the latest version of Bouncy Castle, you can download a specific version using the Download Specific Version option. Contact SailPoint for guidance on which specific version to use. To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>). # Troubleshooting for Windows If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Users need to log in twice when they use Remote Desktop to access a Desktop Password Reset-enabled system. **Resolution** - Desktop Password Reset uses a Microsoft framework to implement a custom credential provider. Users having to log in twice when using Remote Desktop is by design and is expected per the Microsoft framework which supports DPR. For more information, refer to [RDC and Custom Credential Providers]() in the Microsoft documentation. ## Compatibility Check Fails Following an Update of the CEF Version ```text Failed to verify Cef Browser objects for.. ``` After downloading a CEF update, DPR implements a check to determine whether the downloaded CEF version is compatible with the current DPR. This error indicates the compatibility check has failed. **Resolution** - Contact SailPoint Support. > [!NOTE] > > **Screenshot** > > [![Failed to verify Cef Browser objects error]()]() ## When a blank page loads in DPR, the following error appears in the logs ```text Error: JavaScript execution failed: document.getElementById("dpr-pw-nonce").value Error: Uncaught TypeError: Cannot read properties of null (reading 'value') ``` **Resolution** - Verify that the required values in proxy's, firewalls, etc. (i.e. "\*.sailpoint.com", etc.) which would be allowed in the network. ## ".NET Desktop Runtime" Installation Pop-up Appears During an application installation, a pop-up displays the following error message: ```text You must install .NET Desktop Runtime to run this application. ``` This indicates that the required .NET Desktop Runtime (versions 8.0.x, 9.0.x, or 10.0.x) is not installed on the machine. **Resolution**: To prevent this popup during a silent installation, use the `setup.bat` script with the `/quiet` argument. This ensures the installation proceeds silently, even if the .NET Desktop Runtime is missing. ```text pathOfDesktopPasswordReset\setup.bat -afterreboot /quiet ``` ## The Forgot Password? link does not appear on the Windows login screen when Duo Authentication for Windows Logon and Desktop Password Reset are installed together. This occurs when Duo Authentication for Windows Logon and Desktop Password Reset are both installed. Both applications register Windows credential providers and must be configured to work together. **Resolution**: Configure the Desktop Password Reset and Duo registry values so the credential providers can coexist, and then restart the computer. 1. In the Desktop Password Reset registry, set the **WrapCPGuid** string value to the GUID of the Duo credential provider: Path: `HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint Technologies\Desktop Password Reset\Config` Value for WrapCPGuid: ` (String)` For more information, refer to [Enabling Wrapping for Third-Party Credential Providers](). 2. In the Duo registry, add the following GUID to the **ProvidersWhitelist** multi-string value: Path: `HKEY_LOCAL_MACHINE\SOFTWARE\Duo Security\DuoCredProv` Value for ProvidersWhitelist: `{0094A34B-0BF0-4789-8B2D-8339E469D756} (REG_MULTI_SZ)` 3. Restart the computer. > [!NOTE] > > Credential providers you add to **ProvidersWhitelist** are accessible without Duo two-factor authentication. Users who log in with a listed credential provider skip Duo authentication. Registered credential provider GUIDs are listed under: ```text HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers ``` For more information, refer to [Can I enable other credential providers after installing Duo Authentication for Windows Logon?]() in the Duo documentation. > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. # Uninstalling SailPoint Desktop Password Reset Follow the steps below to uninstall Desktop Password Reset (DPR) on your system: ## Uninstalling Desktop Password Reset on Windows Desktop Password Reset (DPR) for Windows can be uninstalled using one of the following methods: - [Using the Command Prompt](<#using-the-command-prompt>) - [Using the Programs and Features Console](<#using-the-programs-and-features-console>) ### Using the Command Prompt 1. Open the command prompt as an Administrator. 2. Depending on the operating system, navigate to `pathOfDesktopPasswordReset/operatingSystem directory` where `operatingSystem` is: - For 64-bit: ```text x64 ``` 3. Execute the following command: - For 64-bit: ```text msiexec.exe /x "SailPoint Desktop Password Reset-x64.msi" /quiet ``` ### Using the Programs and Features Console 1. Open **Control Panel**. 2. Go to **Programs and Features**. 3. Select **SailPoint Desktop Password Reset x.x.x**. Replace *x.x.x* with your DPR version number. 4. Select **Uninstall**. ## Uninstalling Desktop Password Reset on macOS Desktop Password Reset (DPR) for macOS can be uninstalled using one of the following methods: - [Using the Interactive uninstallation](<#using-the-interactive-uninstallation>) - [Using the Remote uninstallation](<#using-the-remote-uninstallation>) ### Using the Interactive Uninstallation Administrators can run the uninstall script locally on the macOS device. The uninstall script is located at `/Library/PrivilegedHelperTools/DPR.app/Contents/Resources/uninstall.sh` ### Using the Remote Uninstallation Administrators can use a Mobile Device Management (MDM) product to run the uninstall script on remote macOS devices. The uninstall script is located on the remote macOS device at `/Library/PrivilegedHelperTools/DPR.app/Contents/Resources/uninstall.sh` # Using SailPoint Desktop Password Reset Select the appropriate option for step-by-step instructions to access DPR on your system: ## Accessing Desktop Password Reset on Windows The Desktop Password Reset is invoked from the Windows logon screen, but before you are logged on to the computer. For security reasons and to limit access only to the internet and not to the system, pop-ups and shortcut keys are disabled (for example, right-click, Ctrl+O, Ctrl+S, Shift+left-click, and so on). To invoke the Desktop Password Reset, select the **Forgot Password?** link located below the password field on the default Windows login screen as follows: [![Windows login screen with the Forgot Password? link]()]() Depending on the parameters that are configured in the Configuration Utility, the **Forgot Password?** option will launch the Desktop Password Reset browser application. ## Accessing Desktop Password Reset on macOS Desktop Password Reset (DPR) is invoked from the macOS login screen before you are logged in to the device. To access DPR, follow these steps: 1. On the macOS login screen, select the **Forgot Password?** link. [![macOS login screen with the Forgot Password? link]()]() 2. Depending on the parameters configured in the Configuration Utility, the **Forgot Password?** option launches the DPR browser application. For security reasons, the DPR browser application is restricted to limit access only to domains allowed by the Desktop Password Administrator. The browser also cannot be used to access the system files. After the user has authenticated with their identity provider account and changed their password, they can log in immediately, even if not connected to the company's corporate network. ### DPR Compatibility with macOS Login Experience DPR is designed to work with the macOS login experience. The availability of the password reset option depends on whether FileVault disk encryption for macOS is enabled or disabled. **When FileVault is OFF**: - You can reset your password directly from the login screen that appears after the Mac starts up (pre-boot login). - You can also reset your password from the login screen shown after a user logs off. **When FileVault is ON**: At start up, macOS shows the FileVault unlock screen before the operating system fully loads. This screen is controlled by Apple's security layer and does not allow third-party integrations. Due to this limitation, password reset option is not available at the startup login screen when FileVault is enabled. However, you can still reset your password from the login screen that appears after a user logs off, once macOS has fully started. **Lock Screen**: DPR is not available from the lock screen (when a user locks the Mac without logging off) The table below provides a quick overview of DPR's compatibility with the macOS login experience: | Setup | Startup Login Screen | Lock Screen | Post-Logoff Login | | --- | --- | --- | --- | | With FileVault OFF | Supported | Not Supported | Supported | | With FileVault ON | Not Supported | Not Supported | Supported | This behavior is by design and aligns with Apple's security framework.