# Managing Desktop Password Reset on Windows

This section provides details to effectively manage and configure DPR using the built-in configuration utility, and learn best practices for securely deploying and updating DPR settings on Windows.

## Managing Chromium Embedded Framework Updates

Desktop Password Reset uses Chromium Embedded Framework (CEF) for Restricted Browser. CEF releases patches to address various issues and reported vulnerabilities. In an effort to ensure all DPR setups run with the latest version of CEF, SailPoint provides an option to update the CEF version. The latest release (as well as previous versions) of CEF run-time can be downloaded and installed on the master machine, then later distributed to all remote systems. For more information on distributing the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

> [!IMPORTANT]
>
> SailPoint recommends updating to the latest version of the Chromium Embedded Framework (CEF). For a version verified by SailPoint, refer to the [Desktop Password Reset - Third Party Framework Updates](<https://community.sailpoint.com/knowledge/Desktop-Password-Reset-Third-Party-Framework-Updates>).

To update CEF dependencies:

1. Go to `<pathOfDesktopPasswordReset>\SailPoint Technologies\Desktop Password Reset` on the master system or the system where Configuration Utility is installed.
2. Run `configurator.exe` as an Administrator.
3. Select the **Advanced** tab.
4. Select **Download Latest \> Download** to download the latest available version of Browser Engine run-times.

   This downloads the latest version of CEF version from the [Microsoft NuGet](<https://www.nuget.org/packages/CefSharp.WinForms/>) site.
5. Select **Save** to install the downloaded engine run-times. This updates the CEF dependencies used by the DPR browser.

   > **Note**
   >
   > In case of compatibility issues with latest version of CEF, a specific version of CEF can be downloaded using the **Download Specific Version** option. Contact SailPoint Support for guidance on specific versions of CEF.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Desktop Password Reset Configurations

Desktop Password Reset has a simple built-in configuration utility that facilitates configuration updates.

If it is necessary to change the value of the configuration parameters for Desktop Password Reset, go to **master system** or the system where Configuration Utility is deployed. Update the desired attributes and select **Save** to store your changes.

### Distribute Updated Configurations to Remote Systems

To update the configurations on all remote systems, perform the following:

1. On the **master system** or the system where Configuration Utility is installed, open command prompt as an Administrator.
2. In command prompt, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`.
3. Run the following command and press Enter:

   ```text
   Configurator.exe -exportconfig -exportkey
   ```

   This creates three files at that location:

   - `dprconfig.export`
   - `dprkey.export files`
   - `browserruntime.zip`
4. Copy the new files to the remote system at `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`.
5. In command prompt, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`.
6. Run the following command at the end users system:

   ```text
   PwdResetBrowser.exe -importconfig -importkey
   ```
7. Delete all instances of the `dprconfig.export`, `dprkey.export`, `browserruntime.zip`, and `bouncycastleruntime.zip` files.

## Encrypting Configurations

Encryption keys are used to encrypt the configurations before they are stored in the Windows registry of the respective system. To generate or regenerate these keys:

1. Go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset` on the master system or the system where Configuration Utility is installed.
2. Run configurator.exe as an Administrator.
3. Select the **Advanced** tab.
4. To generate or regenerate the encryption key, select **Generate/Regenerate Encryption Key**.
5. Select **Save** to save the settings. This regenerates the Encryption Key as well as re-encrypts currently stored configurations with the new key.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Custom ToolTip for Desktop Password Reset

The Desktop Password Reset tile displays after selecting the **Sign-in options** link on the Logon screen. When users hover their cursor over the DPR tile, it displays a tooltip with more information. You can customize the message that displays in the tooltip. To configure the tooltip message:

1. Go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset` on the master system or the system where Configuration Utility is installed.
2. Run `configurator.exe` as an Administrator.
3. Select the **Basic** tab.
4. Update the value for the **Tool Tip Text on Tile** configuration. The maximum allowed length of the text is 45 characters.
5. Select **Save**.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Configure Allowed Domains

This configuration lists domain names, other than domain of the base URL, which should be allowed for navigation from the Restricted Browser. The values must be separated by a semicolon (;). If not specified, only pages from the base URL domain are accessible from Restricted Browser.

> [!NOTE]
>
> If your Password Management solution is configured to use Duo for multi-factor authentication, you are required to add `duosecurity.com` as an Allowed Domain for DPR to work appropriately.

To modify value of this configuration, perform the following:

1. On the **master system** or the system where Configuration Utility is installed, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`.

   Master system refers to the primary administrative system that is responsible for installing DPR and deploying it remotely to all other machines in the network using System Center Configuration Manager (SCCM).
2. Run `configurator.exe` as an Administrator.
3. Select the **Advanced** tab and update the value for Allowed Domains configuration.

   The value must be in the following format:

   ```text
   <Domain1>;<Domain2>
   ```

   For example, if the URL is set to `https://abc.sailpoint.com/passwordreset` and it is required to access web pages from a domain other than abc.sailpoint.com, the value of this attribute can be set to:

   ```text
   example1.com;example2.com
   ```
4. Select **Save** to save the settings.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Enabling Logs

By default, logs are not enabled for the Desktop Password Reset. To enable logs or change the traceability level for the Desktop Password Reset, modify the **Trace Level** option from configurator utility.

To modify values in the Configurator Utility to enable logs, perform the following:

1. On the **master system** or the system where Configuration Utility is installed, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`.

   Master system refers to the primary administrative system that is responsible for installing DPR and deploying it remotely to all other machines in the network using System Center Configuration Manager (SCCM).
2. Run configurator.exe as an Administrator.
3. Select the **Advanced** tab and set one of the following values for the Log Level:

   - **Off** - Disable logs
   - **Error** - Enable logging of Errors.
   - **Warning** - Enable logging of Warnings and Errors.
   - **Info** - Enable logging of errors ,Warnings and other detailed information helpful for troubleshooting.
4. Select **Save** to save the settings.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Enabling Wrapping for Third-Party Credential Providers

There may be situations where multiple credential providers are required to compliment each other to produce the required functionality on a single logon tile. In such cases, one credential provider wraps other credential providers. SailPoint Desktop Password Reset Credential Provider provides an option to wrap other credential provider for achieving similar effect subject to compatibility of other credential providers.

> [!NOTE]
>
> If you need to display the **Forgot Password** link on the logon tile of any credential provider other than Microsoft's default Password Provider, you must use this functionality. This assumes that the other credential provider supports the wrapping feature.

The following section describes the procedure for enabling a wrapper for third-party credentials with the Windows registry by adding the obtained **WrapCPGuid** string value to the Desktop Password Reset.

To find the global unique identifier (GUID) for the third-party credential provider, perform the following:

1. From the command prompt, enter the `regedit` command to open the Windows registry.
2. Locate the currently installed credential providers at the following location:

   ```text
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.
   ```
3. Copy the GUID key for the credential provider that must be wrapped, including the curly brackets.

To enable wrapping for credential providers by adding the **WrapCPGuid** string value to the **Config** registry of Desktop Password Reset, perform the following:

1. Go to the following Windows registry location:

   ```text
   HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint Technologies\Desktop Password Reset\Config
   ```
2. Add a new string value: **WrapCPGuid**
3. Enter values for the **WrapCPGuid** string value: `<GUID Key>`

   The `<GUID Key>` is the GUID key for the Credential Provider obtained earlier.

> [!NOTE]
>
> The GUID Key for the Credential Provider must be enclosed with curly brackets. For example: `{<GUID Key>}`.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Changing the Default Credential Provider

By default, Desktop Password Reset is set as the default Credential Provider. To change the default Credential Provider, modify the **Use SailPoint as Default Credential Provider** option from the configuration utility.

To change the default credential provider, perform the following:

1. On the **master system** or the system where Configuration Utility is installed, go to `pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset`.
2. Run `configurator.exe` as an Administrator.
3. Select the **Advanced** tab and deselect the **Use SailPoint as Default Credential Provider** setting to remove SailPoint Credential Provider from Default.
4. Select **Save** to save the settings.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).

## Managing Bouncy Castle Cryptography Library

> [!IMPORTANT]
>
> SailPoint recommends updating to the latest version of the Bouncy Castle library. For a version verified by SailPoint, refer to the [Desktop Password Reset Third-Party Framework Updates](<https://community.sailpoint.com/knowledge/Desktop-Password-Reset-Third-Party-Framework-Updates>).

Desktop Password Reset (DPR) relies on the Bouncy Castle cryptography library to securely handle encrypted password data. Bouncy Castle is used to encrypt and decrypt critical sections of the credential cache. Updates are released periodically to improve cryptographic functionality and ensure compatibility with the latest security standards.

To ensure the DPR setup uses the latest cryptographic standards, SailPoint provides an option to update the Bouncy Castle version. You can download the latest version or a specific version on the master machine and then distribute it to all remote systems.

To update the Bouncy Castle dependencies, complete the following steps:

1. On the master system or the system where the Configuration Utility is installed, go to

   ```text
   pathOfDesktopPasswordReset\SailPoint Technologies\Desktop Password Reset
   ```
2. Run `configurator.exe` as an administrator.
3. Select the **Advanced** tab.
4. To download the latest available version of the Bouncy Castle dependency, select **Download Latest**, and then select **Download**. This downloads the latest Bouncy Castle Cryptography version from the [Microsoft NuGet site](<https://www.nuget.org/packages/BouncyCastle.Cryptography>).
5. Select **Save** to install the downloaded Bouncy Castle dependency run-time. This updates the Bouncy Castle dependencies used by DPR.

> [!NOTE]
>
> If you encounter compatibility issues with the latest version of Bouncy Castle, you can download a specific version using the Download Specific Version option. Contact SailPoint for guidance on which specific version to use.

To distribute the updated configuration to remote systems, refer to [Distribute Updated Configurations to Remote Systems](<#distribute-updated-configurations-to-remote-systems>).